June 2021 Summaries

The tutorial provides a step-by-step guide on building an automated HashiCorp Vault onboarding system with Terraform, using sensible naming standards, ACL policy templates, pre-created application entities, and workflows driven by VCS and CI/CD. The key benefits of this approach include repeatability, version control, and automated workflows, which increase productivity and mitigate risk. By codifying Vault configurations, companies can onboard applications hundreds of times through a single, automated workflow. The tutorial covers the process milestones, Terraform configurations, application integration with Vault, onboarding the next application, automating the workflow using Terraform Cloud/Enterprise, testing and promotion using Terraform modules, and recap with additional resources.

HashiCorp has been named a Great Place to Work certified company with 93% of employees agreeing it is a great place to work. The company's culture is based on nine principles, including integrity, kindness, and pragmatism, which guide decision-making and drive innovation. Employees praise the welcoming environment, where they feel inspired and enabled to do their best work, and value the sense of community and responsibility that comes with working at HashiCorp. As the company undergoes hypergrowth, employees are given a lot of responsibility and abundant opportunities for growth and development.

HashiConf Europe 2021 showcased several companies, including Roblox and Starbucks, that have embraced a new paradigm to meet the security challenges of dynamic infrastructure: Zero trust security. The message from HashiConf was clear: Trust nothing. Authenticate and authorize everything. Companies are avoiding the risk of breach as they scale operations and push digital transformations by leveraging HashiCorp Vault, Consul, and Boundary to create a zero-trust security model. Centralizing secrets management is critical in dynamic environments, and companies can achieve this with identity-based security approaches. Zero trust security also requires scaling security solutions to meet the demands of cloud infrastructures, which can be achieved through centralized secrets management. Additionally, companies like Starbucks and Roblox are using HashiCorp tools to implement zero-trust security models that improve scalability and automate access controls, reducing the risk of breach. Furthermore, implementing zero-trust security does not necessarily increase development friction, as service mesh, identity-based access management, and secrets management can be used to put zero trust into action without negatively impacting developer productivity or satisfaction.

</table>` In this tutorial, we set out to create a GKE cluster, set up platform-wide services like CertManager, Istio, Grafana, Prometheus, etc., educate developers on how to get their service deployed, ensure everyone is following Kubernetes best practices, and glue the tool to deploy the server to the workload deployment tools (Helm or plain kubectl). To some degree, this walkthrough achieves all of these. The CDK for Terraform allows you to find abstractions over infrastructure that fit your team, which abstractions you choose depend on the company, the setup, and the familiarity of your developers with infrastructure. It's quite easy to change them and introduce new ones that work for you. Infrastructure automation should be run inside of a CI engine to control access and execution environment in one place.

HashiCorp has released Consul 1.10, a new version of its service mesh and service discovery software. The release includes several exciting features such as transparent proxy for service mesh, support for xDS v3, streaming, and observability enhancements. With the transparent proxy feature, users can now allow Envoy to infer the destination based on application information without requiring additional modifications. Consul 1.10 also defaults to using xDS version 3 and Incremental xDS for all supported Envoy proxy versions bootstrapped by the Consul CLI. Streaming is enabled by default for service health, reducing CPU and network bandwidth usage for large-scale Consul deployments. The new release includes a redesigned UI with a fresh layout, improved observability features, and enhanced metrics support for Kubernetes users. Additionally, the legacy ACL system is being deprecated in favor of a new access controls system, which will be removed from Consul in the near future. Overall, Consul 1.10 aims to further enable enterprise-ready service mesh implementations across both containerized and non-containerized environments.

The Google Workspace provider for Terraform allows you to manage domains, users, and groups in your Google Workspace account. This provider is a technical preview and requires incremental testing and polishing to mature into a HashiCorp officially supported project. To use the provider, you need a Google Workspace subscription, a designated Google Workspace User to impersonate, credentials to a Google Cloud service account with Domain-Wide Delegation enabled, and admin access to the Admin APIs. The provider uses a Google Cloud service account to manage resources created by the provider, and you need to grant access to your service account for domain-wide authority and impersonation. You can create users with custom schemas and attributes, manage groups, update user information, reset passwords, detect drift to user and group configuration performed outside Terraform, and add a user to a group. The provider is still in its early stages, and the community is welcome to provide feedback and contribute to its development.

Consul-Terraform-Sync (CTS) 0.2 has been released with several new features, including Task Run Conditions, Enhanced Service Filtering, HashiCorp Linux Repos and Homebrew Tap, Citrix Integration, and Terraform 0.15 Integration. These enhancements aim to improve the automation capabilities of CTS, allowing users to better manage Day 2+ operations and eliminate manual ticket-based systems. With Task Run Conditions, users can specify conditions for task execution, such as waiting for service instances to be deregistered from Consul's catalog. Enhanced Service Filtering enables filtering services based on values in other fields, while HashiCorp Linux Repos and Homebrew Tap provide easier installation options. The Citrix Integration module allows automatic creation, update, and deletion of Service groups, and Terraform 0.15 Integration enables configuration to download Terraform 0.15 upon installation.

HashiCorp's HashiConf Europe 2021 was a significant event that showcased various announcements and insights, including the release of Terraform 1.0, HCP Packer, updates to the core HashiCorp Cloud Platform, porting Vagrant to Go, and new features in Terraform Cloud. The virtual conference featured over 30 videos covering keynotes, product updates, customer presentations, case studies, interviews, best practices, and benchmarks. These sessions shared details on how customers use HashiCorp products, including securing secrets and identity at Starbucks, driving compliance with policy as code at MediaMarktSaturn, and making movie magic with Nomad at Conductor. The event also included demos and presentations from HashiCorp and the community, covering topics such as Zero Trust security, Terraform deep dives, and sustainable Nomad for SREs.

HashiCorp Consul users shared various use cases and insights on how they are utilizing the tool for their personal deployments or at work, highlighting its capabilities in service mesh, service discovery, health monitoring, and integration with other HashiCorp tools such as Terraform, Nomad, and Vault. Users reported using Consul to solve problems ranging from simple secure application delivery to complex infrastructure automation and management of microservices on Kubernetes and virtual machines services. The survey also revealed that users are leveraging Consul's automation capabilities through its service mesh or network infrastructure automation features, showcasing the tool's versatility in supporting various use cases.

The Network Infrastructure Automation (NIA) solution using Consul-Terraform-Sync (CTS) simplifies the process of managing application delivery controllers (ADCs) in hybrid cloud environments. By leveraging open-source DevOps tools, NIA automates the configuration update process for ADCs, enabling self-service models and streamlining operational tasks. The solution consists of four components: HashiCorp Terraform for infrastructure as code, HashiCorp Consul for service networking and service mesh, Consul-Terraform-Sync (CTS) for automation between those two products, and integrations provided by network devices such as A10 Thunder ADC. CTS uses Consul's service catalog as a source of truth for all applications running in a given environment, automatically creating new "slb server" configurations on the Thunder ADC whenever services are registered or removed from the Consul catalog. The solution can be implemented on any type of platform and supports CI/CD operations, including blue-green deployment, by leveraging Terraform and service tags on Consul.

HashiCorp has released version 0.3 of its Boundary identity-based access management platform, which includes managed groups and OIDC configuration improvements. The new release also brings the Windows version of Boundary Desktop to version 1.1, allowing users to connect to remote targets and view active session details from a graphical interface. Additionally, the company has released a new variant of Boundary Desktop for Windows, which provides compatibility with Microsoft Windows operating systems. The latest update also includes OIDC workflows in the administrator console, managed groups that allow population of Boundary groups based on external IdP metadata, and significant new functionality. Users are advised to review the upgrade guide and release notes before upgrading and test the release in an isolated environment.

Vagrant is being ported to Go to maintain its Ruby-based features while supporting new development workflows and ecosystems, including a client-server architecture that allows for secure actions on remote hosts and sharing of configuration resources among team members. The changes will also improve security by enabling a privileged service to execute known and trusted commands without direct user interaction, and offer better global configuration management through a server-based approach. Additionally, Vagrant 3.0 will introduce a new plugin API with the help of the HashiCorp go-plugin library, allowing for cross-platform compatibility and easier distribution of plugins. The porting process aims to be seamless, with two minor releases and one major release planned, starting from Vagrant 2.3, which will include an initial alpha version of the Go-based implementation, followed by Vagrant 2.4, which will feature a new Go implementation as the primary executable, and finally Vagrant 3.0, which will only support plugins using the new API and HCL-based Vagrantfiles.

HCP Packer is a cloud-based service designed to bridge image creation and deployment with image-management workflows, aiming to simplify image lifecycle management, centralize governance, and support current workflows. The service, currently in development on the HashiCorp Cloud Platform (HCP), will be available as a beta in the coming months, allowing development and security teams to collaborate on creating image management workflows that ensure images are up to date. HCP Packer's registry aims to reduce complexity around creating, tracking, and using image artifacts, while also providing features such as tracking image dependencies, building release channels, and acting as a data source for both Packer and Terraform. The service is expected to work with recent versions of Packer and existing workflows, requiring only environment variable settings to access the beta.

The HashiCorp Cloud Platform (HCP) has expanded its capabilities to include support for AWS Transit Gateway attachments, single sign-on with Okta, and new Terraform provider actions. HCP Consul is preparing new configurations, including a Starter tier for entry-level production environments and a Plus tier for organizations with more distributed service-networking footprints. Additionally, HCP Vault will offer more production packages, cross-region replication, and encryption-as-a-service. The platform also aims to accelerate image management workflows with HashiCorp Packer, providing a cloud-hosted registry to streamline the workflow between Packer image builds and Terraform instance provisioning. To get started, users can create an account and receive a $50 credit.

Terraform 1.0 is now generally available, marking a major milestone for interoperability, ease of upgrades, and maintenance for automation workflows. The new version features improved state interoperability between different Terraform versions, allowing users to move between versions without requiring significant changes or tools. Additionally, Terraform 1.0 has an extended maintenance period of at least 18 months, ensuring that HashiCorp will continue to investigate bugs and release features for the 1.0 release. This version also meets four key requirements: broad deployment with many years of hardening in production, understanding and well-supported major use cases, a well-defined user experience, and a mature and stable technical architecture. Users can get started with Terraform 1.0 by reviewing the documentation, trying HashiCorp's Learn tutorials, or attending the Announcing Terraform 1.0 webinar.

Terraform Cloud has introduced several improvements to enhance visibility and extensibility, including a new "Overview" page for workspaces that provides at-a-glance access to workspace information, and the integration of public modules sourced from the Terraform Registry into the private module registry. This allows administrators to share custom modules with their organization and search for specific public modules without having to fork/clone them. Additionally, Terraform Cloud will introduce run tasks, which enable practitioners to integrate existing tools and third-party platforms directly into the Terraform Cloud workflow, and make it easier to promote a curated set of public modules across an organization. All these updates are now available for free to try, with organizations able to upgrade to higher tiers at any time.

Waypoint version 0.4 introduces significant new features, including mutable deployments, which allow for updating existing resources rather than creating new ones, and platform health reporting, enabling teams to quickly take action based on the health of their applications. This update also includes enhancements such as templating, JSON processing, and improved Docker support, as well as bug fixes and breaking changes, including the removal of the Netlify plugin. With Waypoint 0.4, developers can build, deploy, and release their applications with a single file and command, using existing HashiCorp tools and configuration files to streamline their workflow.

HashiCorp has released new tutorials for its Terraform platform on the HashiCorp Learn platform, covering topics such as hosting a static website, managing AWS RDS instances, querying data sources, managing resource drift, and customizing providers. The tutorials aim to help users automate their work, host websites, manage resources, query data sources, reconcile state drift, and extend Terraform with custom providers.

The Terraform AWS provider now supports ECS Anywhere, a new capability in Amazon ECS that enables running and managing container-based applications on customers' on-premises servers. The feature simplifies on-premises container management by allowing users to run containerized workflows without requiring the installation or operation of container orchestrators. With consistent tooling and governance, users can employ the same tools and APIs for all container-based applications regardless of operating environment, making it easier to manage hybrid footprints. To get started with ECS Anywhere in the Terraform AWS provider, users need to add an additional property to a new or existing aws_ecs_task_definition. The feature is now available in the latest version of the Terraform AWS provider and can be configured using Terraform v0.12 or greater. Users can report bugs or request enhancements for this feature by opening an issue on the Terraform AWS Provider repository on GitHub.

The redesigned interface for HashiCorp Terraform Cloud brings clarity to how resources, state, and infrastructure operations are represented during a Terraform run. A new Apply UI is now available in public beta, offering an informationally rich design with a row-based representation of each resource within a Terraform run. Each resource row displays the desired action, provider type, address, and stages that have achieved its desired state. The new UI also provides a summary count of resource actions, which dynamically updates as a run progresses, offering aggregate feedback on resources created, destroyed, or updated. To access the new UI, users must enable it in their workspace settings, starting with Terraform 0.15.2 and higher versions. The UI is currently available only for new runs, while existing and historical runs remain unchanged.