April 2020 Summaries

HashiCorp Consul Service (HCS) on Azure has entered public beta, allowing users to provision managed Consul clusters directly through the Azure Marketplace and leverage its service discovery and service mesh features in their Azure Kubernetes Service or VM-based application environments. The service offers a fully managed networking solution that enables secure service networking across all AKS and VM-based application environments by offloading provisioning, management, and upgrades of the Consul control plane to HashiCorp. The public beta includes several security-related enhancements, such as configurable CIDR ranges, ACL bootstrapping, and elimination of public IP addresses, which were informed by feedback from private beta customers. Users can access HCS on Azure through the Azure Marketplace or by registering for a webinar, and get started with guides and resources available in the HashiCorp Learn platform.

HashiCorp Consul Service (HCS) on Azure has been released with a set of Learn guides and a video resource to help deploy ACL's and establish a service mesh. The platform allows for the deployment of virtual machines, joining them to a service mesh, and deploying security policies to control access between workloads. HCS enables a policy-driven approach to security and service-to-service communication by leveraging concepts such as service-defaults, service-resolvers, and service-splitters within Consul. This allows customers to test application migration or deployment of new versions with granular control over where application workloads are resolving to.

The management of TLS certificates is a major issue for companies, especially in cloud environments. The current process of requesting certificates manually can lead to unsustainable long validity periods. To automate this process, HashiCorp Vault and JetStack Cert-Manager are used to create and manage the lifecycle of TLS certificates in a Kubernetes environment. The workflow involves deploying a Vault server as the root PKI and intermediate CA, and integrating it with JetStack Cert-Manager, which checks for certificate changes and requests new certificates from Vault when necessary. Terraform is used to automate the deployment and configuration of the components, including Helm, Kubernetes provider, and Vault provider. The demo uses a Java application and a Kubernetes cluster, and the process is repeated to deploy the application with a TLS ingress route configured and validated by the PKIaaS.

Terraform is providing cloud infrastructure automation with infrastructure and policies as code, using Sentinel policy as code to embed policies. HashiCorp has introduced the Terraform Foundational Policies Library for Terraform Cloud and Enterprise, which provides controls for common security standards such as those defined by the Center for Internet Security (CIS). The library focuses on developing controls that align with CIS Benchmarks for Amazon Web Services, Microsoft Azure, and Google Cloud Platform. It implements over 40 controls to secure commonly used cloud services like networking, databases, storage, and compute services. CIS Benchmarks provide prescriptive guidance for establishing a secure baseline for each cloud service provider, covering topics such as Identity and Access Management, Logging and Monitoring, and encryption of storage, disks, and database services.

Apr 22 2020Kevin FishnerPrecautions to limit the spread of COVID-19 have required many office workers to work from home for the past few weeks. Given our distributed organization with over 950 employees across 13 countries, other companies and individuals adopting remote work for the first time have asked us to share our best practices. Rather than trying to write a list of tips or general remote advice, we collected stories of HashiCorp employees' remote work habits and how they're adapting their routine due to COVID-19. These folks have a diversity of roles, backgrounds, and history with distributed work; each approach it in their own way. We hope their stories are informative and humanize working remotely as people explore it for the first time. If this is your first experience working remotely, know that even our organization, which has had remote-first operations for years, is struggling to find new routines. Now, more than ever, with kids at home, local businesses closed, and travel restricted, there’s no one right way to work remotely. Each employee's interview showed a different approach to working remotely, from interweaving their work and life schedules to keeping them completely distinct. While there are definitely differences, HashiCorp employees have a few things in common in approaching remote work — they look inwards to understand what's important to them, they shape their work environment and calendar to reflect those priorities, and they thoughtfully communicate and connect with colleagues. Working remotely is a blank slate; you don't have to work standard hours, commute to an office, or work a specific way. The only expectations are to contribute to the company goals while following our Principles. When presented with a blank slate, our employees look inwards to understand what they value. Cameron, a solutions engineer, shared his process to build a home working space that reflects himself. Ernesto, a senior recruiter, emphasized the importance of introspection and iteration until you find the right combination for you. Our environments shape us; we often overvalue willpower and undervalue the environment. In his book Atomic Habits, James Clear states that motivation (and even talent) is often overvalued. Remote work is an opportunity to have more influence over personal environments — both time and space. Time in terms of how employees schedule their days, and space in terms of how they construct their work setting. Employees look inwards to understand what's important to them, then shape their spaces and routines to not just reflect their priorities, but encourage them. While employees aren't expected to be in an office from 9 to 5, most employees build their own structure. Distributed work enables flexibility, but that doesn't mean employees aren't disciplined. Quite the opposite, they enforce a disciplined schedule that works for them. Each person has found their own work-life balance. Some integrate work and life by staying connected throughout the day, others create strict boundaries. It takes time, introspection, and adjustment for each person to find their own personal rhythm. The thoughtfulness of constructing an intentional environment extends beyond the individual; it's a core part of how our employees communicate and connect as a community. Distributed companies don't provide a social network "for free" like co-located companies, so it's essential for employees to be more intentional about creating both their work community and their local community. Our employees apply the same level of thoughtfulness to building relationships inside and outside of work. Communication is probably the most important practice in distributed organizations. Email, Slack, Zoom are the main tools of the trade at HashiCorp, and each requires thoughtfulness. While our history of remote communication and connection is a good starting point, COVID-19 affects each of us differently. Employees have been resourceful and resilient in adapting to the circumstances. These stories provide some useful insights and approaches, and help others find their unique way of working remotely.

HashiCorp has introduced Cloud Engineering Certifications to demonstrate expertise in multi-cloud environments and the mastery required for cloud engineers. The certifications, available in Infrastructure Automation and Security Automation, assess knowledge and skills using HashiCorp's Terraform, Vault, and Consul tools. To prepare, three tools are available: a curated list of learn guides, a comprehensive review guide, and examples of exam questions. The certification exams are online, proctored, and can be taken at home or work, with results shared immediately upon completion. Upon passing, a digital badge is provided, allowing for instant recognition on social media and other platforms.

The latest release of HashiCorp Vault, version 1.4, offers several exciting features and improvements, including the general availability of Integrated Storage, which was initially introduced as a Technical Preview feature in Vault 1.2. The new storage backend provides a more efficient and scalable way to store sensitive data, and a series of guides has been created to help users understand its usage and deployment practices. Additionally, the Transform Secrets Engine has been introduced in Vault Enterprise 1.4, allowing for more advanced encoding and decoding of secrets based on user-defined formats. The Disaster Recovery (DR) operation token enhancement also provides improved business continuity by making batch DR operations available. Furthermore, HashiCorp continues to expand its ecosystem with new integrations and features, including improvements to logging and alerting, as well as the addition of a Kubernetes Secrets Engine in Vault 1.11.

The Vault Helm chart enables Kubernetes users to bring Vault into their environment for managing secrets in a declarative way, providing core deployments and supporting various modes such as highly-available, standalone, development, and external cluster configurations.

HashiCorp has released additional learning resources for its Consul Service on Azure, including guides and a video demonstrating how to extend the service mesh to include Virtual Machines in addition to Kubernetes clusters. This allows for consistent service networking between Virtual Machines and containerized workloads, enabling secure communication and observability capabilities. The resources also showcase using Terraform Cloud to manage service mesh security policies and application configurations "as-code" within Consul.

Terraform Cloud is a collaborative platform that allows users to manage and collaborate on shared Terraform state, while ensuring consistent and reliable environment for Terraform runs. Users can migrate their existing state files to Terraform Cloud without interruption or recreation of infrastructure, and start from scratch using the getting-started track. The community provides support through forums and tutorials, including a newly updated guide that walks users safely through the process of migrating state.

Nomad 0.11 is a widely adopted workload orchestrator that enables organizations to deploy and manage containers and non-containerized applications at scale, with new features including extensible storage volumes, autoscaling, task dependencies, remote execution, and audit logging. The release delivers on the community's feedback and provides improved orchestration capabilities for enterprise customers, while also introducing a Container Storage Interface Beta feature that enables deployment of stateful applications using third-party storage providers.

The company, HashiCorp, is offering support services to help businesses during the COVID-19 pandemic by providing free access to their Terraform Cloud service for organizations directly or indirectly involved in the response efforts, as well as public and private virtual office hours with technical experts from HashiCorp's engineering and product teams. These services aim to alleviate operational and economic burdens on IT operations teams while they continue to provide essential services despite working remotely. The company is also hosting regular live public virtual office hours and offering 1:1 private virtual office hours for customers who need more personalized support.

HashiCorp has released Vault 1.4, a tool for secrets management, data encryption, and identity management for any application on any infrastructure. The new version includes several major features such as Integrated Storage, Transform Secrets Engine, Vault Helm Chart, OpenLDAP Secrets Engine, Kerberos Auth Method, NetApp Enterprise Key Management Support, and Improved Disaster Recovery Workflow. These enhancements aim to simplify deployment, operations, and security of production Vault clusters, as well as provide support for various environments like Kubernetes and NetApp systems. The release also includes numerous bug fixes and new features such as MongoDB Atlas Secrets, Redshift Database Secrets Engine, Venafi Secrets Engine, Service Registration Config, and Usage Monitoring. Users are advised to upgrade in an isolated environment and report any issues on the Vault GitHub issue tracker or discuss forum.

Integrated Storage is a Vault internal storage option that leverages the Raft consensus protocol to persist data to disk, supporting features like support for Vault Enterprise replication capabilities, providing backup and restore capabilities, supports High Availability, provides automated node-to-node TLS by using Vault's cluster communication, and allows for an automated join process with auto-unseal. It eliminates the need to set up, manage, and monitor a third-party storage system like Consul, resulting in operational simplicity and lower infrastructure costs. When compared to the Consul storage backend, Integrated Storage provides better network performance due to fewer network hops, and it consumes less system resources. Integrating Storage is recommended for users running in production today who are interested in migrating their storage backend, with learning guides available to assist with the process. The decision on whether to migrate from Consul or another existing storage backend to Integrated Storage depends on individual operational requirements, and a preflight checklist can help inform this decision.

The HashiCorp Vault Enterprise team has released a new feature called Transform, which is a Secrets Engine that allows Vault to encode and decode sensitive values residing in external systems. This enables Vault to protect application secrets stored in untrusted or semi-trusted systems while maintaining compliance requirements such as PCI-DSS and HIPAA. The Transform feature uses two types of transformations: Masking, which anonymizes data using a custom character mask, and two-way transformation, which protects the input structure while maintaining the same data type of the encoded ciphertext. Unlike traditional tokenization methods, Vault Transform procedure generates ciphertext that retains the data's structure and format while ensuring security. The feature uses AES FF3-1 algorithm for encryption and does not store protected secrets, maximizing decode performance and minimizing exposure risks. This empowers developers, operations, and security staff to securely work with sensitive information while maintaining compliance and governance, all within a single endpoint.

The Nomad 0.11 release introduces a lifecycle stanza for tasks that enables users to control when a task is run within the lifecycle of a task group allocation, allowing for more fine-grained control over task dependencies and sidecar tasks. The lifecycle stanza can be used to express task dependencies between tasks in a task group, as well as inter-job task dependencies with Consul. Users can create init tasks that are ephemeral prestart tasks that must run to completion before the main workload is started, or sidecar tasks that are started before main workload starts and run for the lifetime of the main workload. The Nomad Task Dependencies feature is now available in beta for Nomad 0.11, allowing users to try out new features and provide feedback, with a live demo session scheduled for registration.

Apr 02 2020Buck DoyleNomad 0.11 introduces a new Web UI incarnation of the allocation exec feature, allowing operators to investigate allocations without leaving the browser. This feature uses Xterm.js for web-based terminal implementation and opens a WebSocket API to interact with tasks and allocate shell commands. The current implementation has limitations, including static sidebar updates and lack of permission checking, but future improvements aim to address these issues.

The next generation of Sentinel imports in Terraform Cloud is now stable and generally available for production use. The new API requires using "/v2" suffixes for the import paths, which will be transitioned to the default path in the future, with an option to control this behavior. The new imports can be found in the Terraform Cloud documentation, and Sentinel is offered as part of the Team and Governance Tier or in Terraform Enterprise. Existing customers can provide feedback on the new imports by submitting a support ticket.

Nomad Enterprise introduces audit logging to gain insights into user actions on a Nomad cluster and fulfill compliance requirements. Audit logging is implemented at the HTTP API level, with each request containing multiple audit log entries for different stages of the request lifecycle. The delivery guarantee mode can be set to either enforced or best-effort, allowing operators to choose between fault tolerance and risk acceptability. Configuration options are available to customize audit logging, including file rotation and filters to exclude certain operations from being logged. The audit log contains detailed information about each request, including authentication data, request metadata, and response details. Nomad Enterprise Audit Logging is now available as part of the Governance & Policy Enterprise Module in beta for Nomad 0.11, with feedback and testing opportunities for practitioners.