April 2021 Summaries

HashiCorp is releasing a survey to gather information about how users are deploying Consul in production and other environments. The goal of the survey is to provide insights into Consul's usage and help users who may be unsure how to get started with the tool. To encourage participation, HashiCorp will send special swag to respondents as a thank you for sharing their experiences. The survey results will be anonymized and shared with the community, and participants' permission will be requested before sharing specific anecdotes. Consul is a versatile tool used in various use cases such as key-value stores, service discovery, and full-featured service meshes.

HashiCorp Terraform Provider for Checkly allows users to automate infrastructure-monitoring setup and configuration, bringing transparency and replayability to a previously manual workflow. The approach mirrors the existing infrastructure-as-code (IaC) workflow, consolidating configurations in source control and making it easier to maintain consistency across teams. By using monitoring as code (MaC), users can create check definitions closer to the source code of their application, allowing for cross-team visibility, increased transparency, and easier rollbacks. The HashiCorp Terraform Verified Provider for Checkly integrates with Terraform Cloud, enabling users to provision API and synthetic monitoring checks as part of their existing infrastructure codebase. This setup allows for faster provisioning, improved transparency, and unification of previously fragmented processes in a CI/CD workflow.

We're showcasing our Terraform sessions from HashiTalks 2021, which featured over 10,000 people watching at some point during the two-day livestream. This was our largest number of HashiTalks ever, with a record-breaking increase in high-quality submissions that led to a longer virtual livestream duration. The session videos are available on our newly redesigned HashiCorp Resource Library, where you can also find related GitHub repositories and slides for some of the videos. We're humbled by the extensive knowledge shared by our community and hope you benefit from it. The Terraform sessions covered various topics, including CDK for Terraform, the state of infrastructure drift, deploying sensitive values securely, and more.

HashiCorp Packer 1.7 has introduced support for HCL2-only functions, allowing users to build multiple operating systems with less duplication of configuration using the templatefile function in combination with http_content. This functionality simplifies the build process while making it more powerful by enabling the use of a variable preseed file that can be easily maintained. The example demonstrates how to create two Ubuntu images, one with HashiCorp Nomad and one with HashiCorp Consul, using this new feature.

Terraform Cloud's Business Tier allows management of private environments through self-hosted agents, which can run within a private environment and poll Terraform Cloud for workloads to execute, without exposing resources to the public internet. The agent is available as both a Docker container and standalone x86 binary, and configuring it on local machine enables management of an Nginx container. This setup allows taking advantage of the Terraform Cloud management interface for more infrastructure topology without public exposure.

The article demonstrates how to automate a canary analysis and deployment for an application using Spinnaker, Prometheus, and HashiCorp Consul service mesh on Kubernetes. It shows how to deploy Consul and Prometheus to collect metrics, configure the service mesh, and set up Spinnaker for automated canary analysis. The example uses a simple application with two services, "ui" and "web", where all traffic from the "ui" service goes to the baseline version of the "web" service. A new version of the "web" service is released as a canary release, and Spinnaker analyzes the metrics from Consul's proxy metrics and generates a score based on the error rate. If the analysis passes, Spinnaker increases traffic to the canary version; if it fails, it rolls back to the baseline version. The pipeline also controls traffic splitting between the baseline and canary versions using Consul's service splitter. The example uses Grafana for visualization of request metrics and demonstrates how to configure Spinnaker canary analysis with various parameters, such as lifetime, delay, and interval.

The Snowflake database secrets engine for Vault is a managed service that provides secure access to sensitive data stored in Snowflake. It supports static and dynamic roles as well as root credential rotation, allowing users to tightly control access to their secrets while meeting governance and compliance requirements. The engine can be used to manage the lifecycle and access to passwords in Snowflake, including root accountadmin user credentials and service user accounts. With its integration with HashiCorp Vault, the Snowflake Secrets Engine enables organizations to take advantage of a managed service offering that aligns with their deployment model. By leveraging just-in-time ephemeral credentials, organizations can reduce the blast radius in case of credential leakage and ensure the secure management of sensitive data. The engine is packaged as part of the Database Secrets Engine plugin and is available with all versions of Vault.

HashiCorp Consul has successfully demonstrated its ability to scale with thousands of nodes and hundreds of thousands of services in under 1 second. The company conducted a benchmark test with Datadog and Amazon Web Services, testing the control plane scalability of Consul with 10,000 virtual machines. The results show that Consul's control plane can deliver updates to 172,000 service instances in under 1 second, highlighting its ability to handle large-scale environments. This achievement demonstrates Consul's reliability at scale, making it suitable for enterprise use cases and encouraging users to try running the product at their required scale.

HashiCorp Cloud Platform (HCP) Consul is a managed service mesh that provides discovery and security capabilities for services running on Amazon Web Services (AWS). It's designed to help organizations manage their infrastructure, secure their services, and connect them across cloud providers. HCP Consul is different from AWS in that it doesn't provide infrastructure for running applications, but rather allows users to leverage HashiCorp tools to manage any infrastructure. The platform provides a dedicated virtual private cloud (VPC) called the HashiCorp Virtual Network (HVN), which must be peered with an active VPC to deploy HCP Consul. HCP Consul also provides identity access management (IAM) roles and is designed to work across multiple cloud providers, including AWS, Azure, and Google Cloud. It offers service discovery, load balancing, and DNS resolution capabilities, as well as a service mesh that facilitates secure connections between services. Users can use HCP Consul for simple example use cases such as tracking IP addresses of applications or automating networking for newly provisioned services, and it's designed to work with existing cloud-provider-specific tools like AWS App Mesh.

HashiCorp Vault has been implemented by HireVue to secure its backend systems and sensitive personal information, providing a safe and seamless recruitment process for the company. The platform uses Vault's automation capabilities to grant "least privilege" access to various backend systems, ensuring control and security while maintaining productivity and efficiency across development teams. With Vault, HireVue can easily manage thousands of secrets, strengthen compliance with regulations such as PCI and FedRAMP, and streamline its infrastructure, ultimately enhancing its ability to attract high-quality talent in a competitive job market.

The HashiCorp Packer team is excited to announce the release of Data Source, a new component type to fetch or compute data for use elsewhere in a Packer configuration. Starting with Packer 1.7.0, users and plugin developers will utilize data source plugins within HCL2-enabled build templates, as legacy JSON templates are phased out in favor of HCL2. Data sources function similarly to Terraform's data sources, fetching external data and providing detailed information about it for use in the Packer configuration. Two initial data sources, Amazon AMI and Amazon Secrets Manager, have been included in this release, with additional ones planned for future updates, including Consul and Vault. Users can leverage data sources as local variables to access their values and versions, and developers can create custom data sources by following specific instructions. The goal of introducing data sources is to improve stability and flexibility in Packer configurations.

The Terraform Cloud Operator for Kubernetes allows you to manage the lifecycle of cloud and on-premises infrastructure from within the Kubernetes control plane. The Operator uses a Kubernetes Custom Resource Definition (CRD) to manage Terraform Cloud workspaces, which execute a Terraform Cloud run to provision Terraform modules. This tutorial guides you through deploying the Operator to your Kubernetes cluster and using it to create a Terraform Cloud workspace and provision application-related infrastructure such as a message queue.

HashiCorp has released version 0.2 of its Boundary identity-based access management platform, which provides improved authentication methods, including Open ID Connect (OIDC) and supports MacOS desktop application. The new release also includes features such as worker tags and filters, resource filtering and listing improvements, Kubernetes access enhancements, reference architectures for popular platforms, and many minor bug fixes and improvements.

HashiCorp has released Terraform 0.15, which marks the beginning of the pre-release period leading up to Terraform 1.0. This release includes improvements that solidify Terraform workflows and ensure stability for the long term, such as relaxed remote state data source parser requirements, unified console support across platforms, provider-based sensitivity and sensitive functions, structured logging levels, and a conclusion of several ongoing deprecation cycles. The new release also provides better error handling through improved logging behavior and code contributions from the community. Users can learn more about Terraform 0.15 by reviewing the documentation, trying HashiCorp Learn tutorials, or joining an announcing webinar on April 21.

HashiCorp Terraform Cloud has introduced a new workspace Overview page that provides instant access to essential information about each workspace, including configuration details, outputs, and overall status. The new page offers an improved user experience with interactive links to repository or commit, providing users with fast access to the right information at the right time.

HashiCorp is hosting a 90-minute hands-on workshop at its upcoming community conference, HashiConf Europe, which will take place from June 8-11, 2021. The workshops are designed to provide attendees with in-depth learning and practical experience on various HashiCorp tools, including Terraform Cloud, Vault, Consul, and Nomad. Each workshop is led by an experienced instructor and includes access to technical experts, a pre-built personal cloud workstation, and additional resources. The workshops cover topics such as linking workspaces with infrastructure pipelines, enforcing policy with Sentinel, building custom Terraform providers, securing Consul datacenters, and more. Space is limited, and there will be a nominal fee of €65 EUR to reserve a spot. Registration is required by May 28, 2021.

HashiCorp has introduced Autopilot for Integrated Storage in Vault 1.7, which simplifies and automates workflows for managing and operating Vault's integrated storage clusters. This feature eliminates operational overhead by storing data internally, reducing complexity and improving diagnosis and troubleshooting. Autopilot provides improved insight into cluster state, ensures cluster stability when new nodes join, and takes away the burden of monitoring and cleaning up failed servers. With Autopilot enabled, operators can benefit from automated workflows and improved cluster management, making it easier to deploy and manage Vault clusters in cloud environments.

HashiCorp Waypoint version 0.3 has been released, introducing powerful workflows such as GitOps, along with major improvements. The new features include support for GitOps workflows, deployment to AWS Lambda, remote runners for operations like builds and deploys, and more. With the addition of remote runners, developers can now perform operations such as build and deploy remotely, enabling necessary security functionality. Other notable improvements include a Terraform Cloud config sourcer, improved Docker image building in unprivileged environments, and enhanced Kubernetes deployment platform. The next major release is expected to support variables within the waypoint.hcl file for "mutable" deployment patterns.

Terraform is a popular open-source tool used to manage cloud infrastructure. It uses providers to define cloud infrastructure, resources, and data sources. Data sources represent information that Terraform queries from cloud provider APIs to fetch disk image IDs or information about the rest of the infrastructure. Terraform configurations allow for flexibility by using data sources to query cloud provider APIs and can be customized with input variables and functions to perform dynamic operations.

HCP Vault is now generally available on AWS as a fully managed service, providing organizations with secure secrets management and encryption capabilities without the complexity of managing HashiCorp Vault themselves. It offers a push-button deployment, resilient infrastructure, and operational excellence as a service, allowing users to quickly get started securing sensitive data across various AWS services. The service is designed to minimize setup steps, requiring only three actions: creating an account, deploying a cluster, and peering with AWS environments. HCP Vault is priced based on hourly or annual agreements for development and production clusters, offering a free month for new users. With its launch in US and European regions, the service aims to expand globally in the future.

The HashiCorp Vault-focused talks from the 2021 HashiTalks community event are now available, covering topics such as secure deployment pipelines, serverless secrets management, ephemeral cloud infrastructure, and building fast-moving environments with PKI compliance at scale. The talks also cover using Vault with various tools like Terraform, Nomad, Consul, and Puppet, as well as integrating Vault with Active Directory and Azure Key Vault. Additionally, there are sessions on storing sensitive values securely, edge security in untrusted IoT environments, and how to use HashiCorp products in a tool stack, among others.

HashiCorp has released Vault 1.7, introducing exciting new features and enhancements, including Key Management Secrets Engine and Tokenization features that are now generally available. The release also includes a tutorial on Integrated Storage Autopilot, which provides hands-on demos for cluster node health check, server stabilization, and dead server cleanup. Additionally, the Terraform Cloud Secrets Engine tutorial demonstrates how to enable, configure, and manage Terraform Cloud API tokens using Vault. Furthermore, the Database Secrets Engine UI has been improved, allowing admins to manage MongoDB database credentials via the UI, and Vault Agent can now run as a Windows service. The release also includes standard operating procedure guides for data backup, upgrade, and restoring a Vault cluster.

Modules for HashiCorp Terraform are an easy way to make provisioning infrastructure simple and consistent. The Terraform Registry has a wealth of publicly available modules, which can be referenced from several different places. Additionally, modules can also be shared and consumed through the private module registry, available in Terraform Cloud and Terraform Enterprise. Furthermore, for Terraform Enterprise customers, a registry can be shared throughout the entire environment or specific organizations, promoting management consistency and reducing VCS registrations required. This enables easy sharing of modules between different Terraform organizations without manually adding them to each organization.