July 2021 Summaries

The HashiCorp Enterprise product licensing deployment process has been updated to align with industry best practices, introducing a new licensing enablement process that requires a valid license for server instances to start. The change affects product upgrades and the boot-up order of operations, with enhanced automation for license loading being introduced. Customers can access a learning guide and tutorial to install an enterprise license, and HashiCorp Enterprise customers can contact their customer success manager or email support for assistance.

The CDK for Terraform 0.5 release introduces code generation from HCL and a new `cdktf watch` workflow designed for serverless workloads. The new `convert` command automatically translates existing HCL Terraform configurations to C#, Python, TypeScript, and Java, making it easier to apply the existing library of HCL Terraform content to CDK for Terraform. This feature enables users to convert full projects from HCL to other languages with support for future releases. Additionally, `cdktf watch` is a new experimental workflow that deploys changes and shows diffs as you edit code in a production-like environment, intended to be used in a production-like development environment and works in all supported languages.

HashiCorp has released Vault 1.8 with several key features and improvements, including a new `Vault Diagnose` command for troubleshooting, Enhanced Integrated Storage Autopilot support for disaster recovery clusters, General Availability of Key Management secrets engine on AWS, Expiration manager improvements, Control Group triggers enhancements, Licensing updates, User interface updates, and many other new features and bug fixes.

You can use Kong Ingress Controller for Kubernetes with Consul's service mesh to manage traffic to and between your Kubernetes services. By deploying Consul and Kong, you can define and control traffic to Kong Gateway, a UI service, and a web service using Consul intentions. You can also use Kong's rate-limiting plugin to limit the requests to the ui service and manage north-south traffic. Additionally, you can use Consul's application-aware intentions and traffic shaping to shape traffic between services in a Kubernetes cluster, such as splitting traffic between two versions of a service.

HashiCorp Nomad and Consul are being used by Chatsight, a content moderation service provider, to speed up deployment and maximize uptime for its customers. Chatsight uses Nomad to deploy new containers safely and eliminate downtime with native rolling updates, while Consul provides service discovery capabilities that automatically notify Nomad of changes, ensuring continuous availability. The use of these tools has allowed Chatsight to reduce reliance on cloud load balancers, simplify its VM architecture, and gain greater control over Nomad through its detailed API. By using Nomad, Chatsight is able to deploy updates rapidly without disrupting its customers, and invest more time in product development to drive the business forward.

I've taken on a new individual contributor role at HashiCorp, stepping down from my executive position after nearly 10 years of learning and growing as an executive. I founded HashiCorp in 2012 and served as CEO until 2016, then became one of our CTOs until today. This change has been planned for years and is now possible due to the company's maturity and strong leadership team. In my new role, I'll focus on engineering and will no longer be part of the executive team or board, but will remain a passionate and active HashiCorp employee and engineering leader.

Two approaches to injecting variability into your Nomad batch job template without having to modify the template in the future. One approach is to use a UUID as an ever-changing value, which can be achieved by using HCL2 functions and the meta block to inject variation into a batch job without altering the job specification template. Another approach is to use an HCL2 variable, where a unique value is provided each time the command nomad run is issued with the variable flag, ensuring that the job allocation is successful only when a unique value is submitted. Both approaches allow for injecting variability into Nomad batch jobs without modifying the job template itself.

Apache Camel can be used with HashiCorp Consul to address challenges in tracking services and communication in multi-cloud or hybrid cloud environments. Consul provides service discovery, health checks, and possibly a service mesh if needed, making it a simpler solution than Kubernetes for orchestrating containers and service registration. Using the Service Call Enterprise Integration Pattern (EIP) with Consul, developers can create load-balancing flows that let clients call available services, and if not available, communicate with an external service registry to figure out what is available. A Consul service registry maintains a list of healthy, available services in the form of a catalog that can be queried by external components. The example demonstrates how to use Consul with Camel using Spring Boot, including configuring service filters and discovery services, and testing the setup with curl commands.

HashiCorp's developer advocacy approach prioritizes integrity, pragmatism, and humility. They hire experienced engineers with a passion for their tools to represent the community, encouraging them to share their struggles and mistakes publicly. Developer Advocates engage with practitioners through consulting, feedback gathering, and content creation, aiming to improve and expand HashiCorp tools. Their work involves building global communication channels, collaborating with industry groups, and contributing code and tutorials. With a focus on creating content in various forms and pursuing topics that excite them, Developer Advocates strive to help the community achieve an "aha!" moment, whether through implementing workflows or learning new tools.

Terraform is an infrastructure management tool that allows users to manage cloud and on-premises environments through a single, unified interface. It achieves this by making calls to the APIs of cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud using plugins called providers. This means Terraform can manage almost any service, not just cloud infrastructure. A community member named Conrad Ludgate created a Spotify provider that uses Terraform's data source to search for artists, albums, or songs on Spotify and build playlists. Conrad wrote the provider after learning about Terraform and using it to set up cloud infrastructure automatically in his previous job. He relied on HashiCorp Learn's custom provider tutorial series and existing code to structure his project and used GoReleaser to release the provider to the registry. The provider has undergone changes since its initial release, including updates to work with newer versions of Terraform. Conrad is open to community contributions to the provider and plans to create new providers in the future.

HashiCorp is hosting its first developer-focused edition of HashiTalks, a virtual community event series, on July 21-22, 2021. The event will focus on the inner workings of HashiCorp products and how to build new features and integrations for them. Attendees can expect over 40 live-streamed sessions covering topics such as Terraform protocol development, Vagrant's transition, and building device drivers for Nomad. Hands-on workshops will also be available, including a session on writing excellent technical content and another on debugging skills for Nomad. Registration is free for the livestream, but workshops can fill up quickly, so it's recommended to sign up soon.

This architecture simplifies secure administration access to Unix-like servers using a scalable, secure, and consistent experience both on-premises and in public clouds. It uses SSH certificates and HashiCorp Vault to manage SSH key authentication, providing short-lived SSH certificates that minimize the impact of leaked credentials. The solution also allows for granular access control based on user roles, functions, or teams, with minimal changes required on the host side. Additionally, it provides a flexible architecture that can be used across any cloud and on-premises environments, making it suitable for large-scale SSH access management.

Consul 1.10 introduces a new feature called transparent proxy that allows applications to be deployed without modification into the service mesh. This feature provides an easier onboarding experience by automatically redirecting traffic from services within applications to their sidecar proxies, eliminating the need for explicit modifications or defining upstreams. Transparent proxy ensures encrypted application communication and removes the requirement for explicitly dialing sidecar proxies or defining application upstreams. It also enables services to communicate with each other using Kubernetes DNS hostnames without requiring explicit configuration. The feature is enabled by default on Kubernetes deployments starting from Consul 1.10, and users can control its behavior via Helm stanzas or Kubernetes annotations. Transparent proxy allows for better controls over communication between applications inside or outside the service mesh, providing a more secure and efficient way to deploy and manage services.

HashiCorp has released version 0.4.0 of its Boundary product, which includes features such as brokering of HashiCorp Vault secrets for Boundary targets to end-users, enhanced session cleanup, and foundational features for event logging. The new release adds support for brokering Vault secrets for boundary clients, allowing users to configure Vault credential libraries and stores through the Terraform provider or command-line interface. Additionally, Boundary 0.4 introduces significant enhancements to session cleanup, including logic on the worker side to shut down all connections in the event of a failure to contact the controller after a short period of time. Users are advised to review the general upgrade guide and release notes for details on upgrading to this new version.

HashiCorp Vault has achieved Red Hat OpenShift Certification, enabling users to easily deploy and manage secrets on Kubernetes. HashiCorp Vault is an identity-based security solution that provides a unified interface to any secret while offering tight access control and recording a detailed audit log. The certified Vault Helm chart allows for repeatable deployment processes in less time, making it easier to set up a Vault cluster running on Kubernetes. With the certification, users can now search for and find the certified Vault Helm chart directly in the OpenShift console, ensuring its validation for use in the OpenShift environment.