January 2021 Summaries

A mono repository organizes multiple Terraform configurations as separate directories within a single repository, while a multi-repo approach uses separate repositories for each configuration. Mono repos are suitable for small projects or teams with uniform access to infrastructure configurations, but can lead to increased module maintenance overhead and debugging complexity. In contrast, multi-repos offer better granular access control and configuration changes, making them ideal for large teams with complex infrastructure systems. By separating configurations into individual repositories, teams can self-service and compose based on shared building blocks, allowing for independent testing of modules and optimized continuous integration pipelines. However, this approach may result in slower Terraform initialization times due to the need to download remote modules. Ultimately, the choice between mono and multi-repos depends on the organization's specific needs and patterns.

Sentinel 0.17 introduces Map Expressions and Rich Return Types, enabling fine-grained policy decisions with improved reporting capabilities. With these new features, users can create rich sets of report data without resorting to workarounds, allowing for more meaningful compliance reporting. The new Sentinel language supports all basic types, including collections, strings, and numeric values, making it easier to evaluate expressions and identify violations. The release includes several enhancements, such as filtering violations, reporting compliance issues with clear messaging, and addressing machine-readable tracing. Users can now explore these new capabilities by downloading the latest version of the Sentinel CLI or visiting the Sentinel Playground for a safe development environment.

Terraform outputs are used to export data about infrastructure resources, such as IP addresses and regions, which can be used for automation purposes or as a data source for another Terraform workspace. Outputs can also be used to connect Terraform configuration through modules or separate workspaces. Additionally, Terraform supports the sensitive flag, which redacts sensitive values in console output and log messages.

HashiCorp is continuing its Ambassador program in 2021, focusing on community growth and accessibility through knowledge sharing, kindness, and mentorship. The program aims to recognize efforts by community members who have been active in sharing knowledge around HashiCorp tools in 2020. Applicants or nominators can submit their applications or nominations until February 24, 2021, highlighting specific examples of how the nominees engaged with the community. The goal is to create a more vibrant and collaborative community that supports the health of the broader ecosystem.

Kubernetes Initializer built by Ambassador Labs simplifies the deployment of Ambassador and Consul in a sandbox Kubernetes environment, providing a new experience for onboarding applications onto a service mesh or integrating with existing applications. The tool allows you to quickly deploy a sandbox environment of Ambassador along with other platforms such as Prometheus and Consul across various different Kubernetes distributions. It provides a quick way to select your desired infrastructure, specify how to handle insecure traffic, and configure Observability, including collecting metrics via Prometheus for both Consul and Ambassador. Additionally, the initializer can configure Consul to collect distributed traces to an installation of Jaeger and deploy Consul with Ambassador together.

The latest release of CDK for Terraform (version 0.1) brings support for C# and Java programming languages, in addition to Python and TypeScript, allowing users to define infrastructure using these languages while leveraging the hundreds of providers and thousands of module definitions provided by HashiCorp Terraform and the Terraform ecosystem. The new release also includes enhanced collaboration features on Terraform Cloud, such as Terraform Runs and Remote Operations, making it easier for teams to work together on CDK for Terraform projects. Additionally, Sebastian Korfmann has joined HashiCorp as an employee, ensuring full-time support for the project and allowing it to move closer to its goal of releasing beta and stable versions. The 0.1 release is now available for download, with step-by-step examples and a Docker quick start tutorial provided. Users are encouraged to provide feedback through GitHub issues, pull requests, and the HashiCorp Discuss forum.

Terraform Enterprise can now be deployed in a highly available manner across two instances, providing increased reliability and scale for customers who need it. This new deployment pattern, called Active/Active Architecture, allows customers to prepare their existing network and provision Redis next to their Terraform Enterprise instance before scaling up to two nodes. The migration process has been seen as smooth, with customers making the transition in a matter of days across all three public clouds, and HashiCorp offers support for customers who need help planning out this journey.

HashiCorp Vault is now available on HashiCorp Cloud Platform in public beta, offering organizations a quick and secure way to manage secrets and protect sensitive data in the cloud. The platform provides fully managed infrastructure, including deployment of a dedicated, highly available cluster running Vault Enterprise, making it easier for teams to get applications up and running in the cloud. HCP Vault clusters are created within an isolated network environment, and customers can interact with them using a generated admin-level token. The platform supports additional regions throughout the beta, as well as additional cloud providers in the future, and enables secure networking for workloads across various AWS services.

HashiCorp's Consul is an infrastructure automation tool that enables organizations to come as they are and scale as they like, reducing costs and increasing service resilience. The author, a seasoned IT professional with over a decade of experience, took on the role of an Education Engineer for Consul after having previously worked with various cloud providers and infrastructure-as-code concepts. To get started with Consul, he recommends diving into the Getting Started collection and utilizing the Certification Review Guide as a learning path. The author found some concepts challenging to understand due to his previous experience in networking specialist-led environments, but was able to grasp the concept of service mesh through tutorials and walkthroughs. He now focuses on turning theory into reality by enhancing personal projects with Consul's service discovery and health checking capabilities, and plans to incorporate Consul's service mesh features, including Intentions, in future projects.

The HashiCorp Vault system is designed to protect sensitive data from well-resourced, skilled adversaries, including those who have infiltrated an organization's perimeter security. This is crucial in the face of rising insider threats and supply chain attacks. The system uses a cryptographic barrier to encrypt data at rest, which is protected by industry-vetted cryptography and provides options for users to secure their infrastructure according to their threat model. Vault also implements key management features such as manual unsealing using Shamir's Key Sharing Algorithm or utilizing a trusted external system like an HSM or cloud KMS. The system minimizes the possibility of privilege escalation or key exfiltration attacks by keeping users and operators separate from keys used to protect secrets. Additionally, Vault has features like multilevel security, role-based access control, and attribute-based access control, as well as extensive audit logging, dynamic credentials, and trust independent of the network. The system is designed with the zero-trust principle in mind, requiring explicit client authentication/authorization and short-lived, ephemeral credentials to make lateral movement and persistent access more challenging. The ciphers used in Vault have been shown to resist cryptanalysis against well-resourced adversaries, including those armed with supercomputers and near-term quantum computers. The development team of HashiCorp also follows safe coding practices, internal security checks, external audit and compliance, and a community-driven approach to secure the system.

Levant, an open source tool, enhances the user experience for HashiCorp Nomad by providing a unified and consistent deployment workflow across all paths to production environments with improved feedback in CI systems. Levant allows operators to share job files across environments while altering key parameters via variables stored in supported formats. A single deploy command renders the job template, provides real-time feedback on the status of the job and deployment, and logs debug information for quick issue identification in case of a deployment failure. Levant has been migrated to the HashiCorp GitHub organization where it will be maintained and enhanced by the Nomad Ecosystem team, ensuring continued support and updates with the latest Nomad features.

HashiCorp has released a new tutorial on their Learn platform, focusing on protecting sensitive data when using Terraform. The tutorial covers the use of the `sensitive` variable flag to redact sensitive values from console output and log messages, as well as methods for securing the Terraform state file. By following this tutorial, users can learn how to manage sensitive inputs in their Terraform configurations and reduce the risk of accidental disclosure.