February 2021 Summaries

The Packer team has released the Packer Plugin SDK, a standalone Go module for developing Packer plugins, to support the growing ecosystem and community-driven component development. This release aims to lower the barrier to entry for creating and maintaining Packer plugins by providing a standardized API and simplifying plugin development. The new SDK offers features such as support for plugins with multiple components, automatic plugin downloads via the `packer init` command, and improved maintenance burden. To ensure compatibility, users of community-built plugins will need to obtain a new version when upgrading to Packer v1.7.0, while maintainers will need to upgrade their plugins to use the SDK. The release also includes an updated documentation for writing plugins and a CLI tool to aid in the migration process.

HashiCorp Nomad is a mature orchestrator designed to focus solely on cluster management and scheduling, unlike Kubernetes which aims to build a powerful platform with all the features included. Nomad's architecture follows a Client-Server model with a single binary that can be configured as either a server or client agent. It supports virtualized, containerized, and standalone applications, and is more general purpose than Kubernetes. Nomad's core concepts include Jobs, Tasks, Task Groups, and Allocation, which are similar to Kubernetes' Deployments, ReplicaSets, and Pods. The cluster network in Nomad is the Node network, where each task group instance uses a unique port through dynamic assignment. Consul is used for networking with Nomad, providing service discovery and health checking capabilities. Nomad supports load balancing through its built-in load balancing functionality and integration with popular reverse proxies like NGINX. The system is designed to be highly available, with server nodes running in regions that can elect a leader and work together autonomously.

The HashiCorp Terraform Cloud Operator for Kubernetes is now generally available, offering a powerful way to manage Terraform Cloud Workspaces through Kubernetes CustomResourceDefinitions (CRDs). The operator has been expanded to support several features from the Terraform Cloud API, including VCS-backed workspaces, Terraform Cloud Agents, secure outputs, and integration with Terraform Enterprise. The operator can be installed using Helm and supports upgrades to the Operator SDK version 1.x, which brings stability and maturity to the SDK. Users can provide feedback on the updates through issue tracking or engage with the community on HashiCorp Discuss and Kubernetes Slack channels.

HashiCorp has released a new tutorial to help practitioners develop a comprehensive disaster recovery plan when operating HashiCorp Consul on Kubernetes in a multi-datacenter federation. The tutorial reviews essential data and secrets that must be backed up and secured, sets up a lab environment for practicing recovery, and outlines manual recovery steps that can be automated with tools like Terraform and Vault. Additionally, the tutorial includes bonus materials such as a fully functioning 4-tier app, HashiCorp Terraform code, examples of using third-party providers as a certificate authority, and configuring a multi-region, multi-datacenter federation using mesh gateways with the official Consul Helm chart.

Boundary 0.1.5 has been released with several new features that enhance its capabilities in multi-datacenter and multi-region environments, allowing for more insights into resources and providing a more streamlined experience for users to list resources across scopes. The Target-Aware Workers feature enables controlling which workers can handle a target's session, while the migrate command provides an easier upgrade path with fail-safes in case of migration issues. These features improve Boundary's ability to navigate resources over the CLI, allowing users to see what actions they're authorized to perform against resources and list resources recursively across scopes.

This new tutorial collection uses a case study about a fictional company to illustrate a migration from a monolith to microservices using HashiCorp Consul and Kubernetes. The tutorials cover topics such as understanding the value of microservices, designing patterns with Consul service mesh on Kubernetes, modeling a monolith into microservices, scoping a microservice extraction, and extracting and deploying a microservice with Consul service mesh on Kubernetes. These tutorials provide valuable information for developing services that leverage Consul during any stage of the journey, without disrupting current workflows or system availability, and help practitioners understand how to successfully migrate from a monolith to microservices using these technologies.

We have developed a baseline SELinux policy for securing Vault on Red Hat-based Linux distributions to help secure secret data managed by Vault. This policy is available as an open source GitHub repo and will eventually be made available in our Linux Repository. It provides Mandatory Access Controls to processes running on Linux distributions, including SELinux and AppArmor. The policy can be customized to specific security requirements but also comes with complexity. To get started, download and install the RPMs from our releases page or clone the repo for a customized deployment. Long-term, we plan to make these RPMs available in our official Linux repository and investigate providing similar policies for AppArmor on other distributions.

The HashiCorp Terraform Strategic Integrations team has improved the wait_for configurations on several resources, introducing an entirely new generic waiter. This allows users to specify whether Terraform should wait for a specific condition or not before continuing to apply their configuration or complete successfully. The new generic wait_for attribute gives users more control over wait conditions and is available on all Kubernetes resources. It instructs the Terraform provider to wait on a condition based on any attribute of a Kubernetes object, allowing users to specify multiple conditions that must be met simultaneously. Additionally, the Kubernetes-alpha provider introduces a new kubernetes_manifest resource and a generic wait_for attribute that supports regular expressions in conditions. This provides more flexibility and control over wait conditions, enabling users to wait for specific attributes or values within their Kubernetes resources.

Vault's Helm chart is a tool that enables users to launch a Vault cluster in various cloud environments, including Red Hat OpenShift, Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE). The chart provides a convenient way to deploy Vault and its applications, allowing for secure secrets management. The tutorials cover the installation process, security considerations, troubleshooting, and reference architecture for deploying Vault on Kubernetes. Users can learn how to configure Vault as a certificate manager and gain knowledge on how to troubleshoot it in production.

HashiCorp has developed a native integration with Kubernetes, enabling seamless application integration and fine-grained authorization through its open-source project, HashiCorp Boundary. The current access model for applications running on Kubernetes is coarse-grained, allowing direct shell access to containers, which poses security risks. HashiCorp Boundary provides an alternative by restricting network access to a single point, the Boundary pod, while still enabling role-based access control (RBAC) and seamless integration with existing solutions. This tool also allows for gate API calls to Kubernetes clusters using kubectl under the hood, making it a powerful solution for secure software-defined perimeter and multi-faceted container security. The future roadmap includes dynamic host catalogs and session recording for the Kubernetes ecosystem, further enhancing its capabilities.

HashiCorp Cloud Platform (HCP) Consul is moving into general availability, allowing users to get started with service discovery and consuming service mesh within their AWS environments. The platform provides a managed offering for deploying and consuming HashiCorp Consul natively within AWS, enabling users to take advantage of its features such as service discovery, load balancing, and secure communication. Users can explore the HCP Virtual Network (HVN), peering operations, and deploy Consul clusters within the platform. The platform also provides a guided process for deploying Consul, including setting up cluster configurations, security groups, and routing tables. With the deployment of Consul, users can start connecting workloads to the control plane, leveraging tutorials and guides provided by HashiCorp Learn to get started with connecting platforms like EKS and EC2 instances.

HashiCorp has announced that its Consul service mesh is now generally available as a fully managed service on AWS, known as HashiCorp Cloud Platform (HCP) Consul. This service provides a simple way to discover and securely connect services in AWS environments, reducing the operational burden of running a service mesh in production. To get started with HCP Consul, users need to create an account, deploy a cluster, peer their existing AWS environments, and connect their services. HashiCorp has also released a new Terraform provider for HCP Consul, which allows users to quickly provision and manage resources through a familiar workflow. Pricing for HCP Consul is available in the U.S. and Europe regions, with options including hourly, annual, and development clusters. Users can learn more about HCP Consul by visiting the HashiCorp website or signing up directly through the HCP portal.

This guide teaches how to build observability as code infrastructure automation using New Relic, Terraform Cloud, and Google's 4 Golden Signals of SRE. It covers setting up Terraform Cloud, provisioning an alert policy, creating four alert conditions based on the Four Golden Signals (latency, traffic, errors, and saturation), and configuring a notification channel to ensure proper folks get notified when an alert triggers. The guide also discusses how to maintain infrastructure code with a version control system, deploy changes safely and securely, and manage teams with Terraform Cloud. Additionally, it provides information on various approaches to building a CI/CD pipeline with GitHub and Terraform Cloud and recommended practices for evolving provisioning practices.

The release of major version 2.0 for the Kubernetes and Helm providers for HashiCorp Terraform includes significant changes to authentication, a new Terraform SDK upgrade, improved resource consistency with the upstream Kubernetes API, normalized wait conditions across several resources, removal of support for Helm v2, and deprecation of Terraform v0.11. The updates aim to promote explicit declaration of access credentials and improve user experience, particularly for users managing multiple Kubernetes clusters. Users are advised to review the upgrade guides for each provider before upgrading to ensure a smooth transition.