February 2022 Summaries

The article discusses how HashiCorp Consul can help developers and operators achieve the right DevOps workflow in cloud-based environments. It explains that while developers want to iterate often and quickly, operators are more concerned about maintaining consistency and security. Despite these differences, it is possible to merge their workflows using Consul as a unifying tool. The article also highlights how Consul can be used for service mesh integration, progressive delivery, enabling self-service delivery, controlling user access, and managing service-to-service communication. It concludes by emphasizing that both developers and operators share the same goal of creating a workflow that enables rapid, consistent, and secure application deployments.

The fourth annual global HashiTalks livestream featured over 7,500 attendees discussing observability infrastructure, network policy, Consul-Terraform-Sync use cases, and explorations around HashiCorp Nomad. Topics covered included bootstrapping a multi-datacenter cloud native observability stack using Prometheus, Loki, Tempo, Alertmanager, Grafana, and HashiCorp Consul; inspecting Nomad events using Grafana Loki for debugging cluster state and alerting operators about new deployments or failing allocations; policy as code for network as code using Sentinel to prevent network misconfigurations; creative use cases for Consul-Terraform-Sync automation beyond on-premises firewalls; running Nomad as a HashiCorp operating system in an experiment; and the harmonious marriage of lightweight systems with Flatcar Container Linux for Nomad.

HashiCorp has released version 0.5 of its Consul-Terraform-Sync (CTS) tool, which combines Terraform and Consul functionality to automate network infrastructure management across on-premises and cloud environments. The new release includes improvements in task lifecycle management with the addition of four new APIs and a CLI for creating, updating, deleting, and reading tasks. It also introduces streamlined configuration through module_input blocks that can now be used with all task types. Additionally, CTS 0.5 features new ecosystem integrations with Cisco Secure Firewall Management Center (FMC) and Fortinet FortiManager.

Three members of HashiCorp's Blacksmiths ERG discuss their outside projects aimed at supporting their communities. Mack Hendricks co-founded Detroit Black Tech, a non-profit organization focused on building a highly valued community of Black individuals in the Detroit tech community. Shanae Chapman founded Nerdy Diva to empower UX researchers, designers, and developers with tools to build inclusive products, services, and teams. Trevor Powell has been involved with Big Brother Big Sisters of America for over 15 years, a high school youth leader at his local church, and the Board Chair on the Board at Lighthouse of Hope counseling center. These projects have resulted in positive impacts on individuals' lives and communities.

The Consul API Gateway has reached its first general availability release, introducing TCPRoute support, Helm chart support, and a new HashiCorp Learn tutorial to help users get started. The gateway can now manage route destinations and protocol connections between mesh services and external clients, with added TLS settings per listener for improved security controls. Additionally, the Consul API Gateway supports Helm chart installation and configuration, allowing users to easily deploy and manage the solution. A new HashiCorp Learn tutorial is available to guide users through deploying microservices using Consul API Gateway as an ingress point and leveraging it as a load balancer.

The new Salesforce provider for HashiCorp Terraform allows administrators to create and manage users, roles, and profiles programmatically using the Terraform workflow. This provider is currently a technical preview and requires system administrator level permissions to a Salesforce organization. To use the provider, you need a connected app created for Terraform, and you can configure it with your Salesforce credentials. The provider supports creating role hierarchies and assigning them to users, as well as creating custom profiles outside of predefined Salesforce profiles. You can also create new users and assign them profiles and roles using this provider. The community is invited to provide feedback on the project, including bugs and feature requests, through the GitHub page.

HashiCorp is pleased to announce the availability of new Plus clusters featuring multi-region replication with HashiCorp Cloud Platform (HCP) Vault. These new clusters bring fully-managed performance replication support to customers that need secrets and policies across multiple cloud regions. HCP Vault enables organizations to get Vault clusters up and running quickly, providing powerful secrets management and encryption capabilities, while minimizing the steps necessary to set up Vault within their AWS environments. The new Plus tier offers performance replication for syncing secrets between two highly available Vault clusters located in separate regions, addressing common use cases such as multi-region deployments and scaling throughput. HCP Vault is generally available in multiple AWS regions with pricing tiers ranging from Development to Standard, offering a non-production single-node deployment at $0.03 per hour to larger production workflows at up to $7.489 per hour, with additional price scaling for active clients.

HashiCorp's Consul-Terraform-Sync solution automates the process of updating values of objects in Cisco Secure Firewall Management Center (FMC) by leveraging service discovery, configuration, and segmentation functionality across several environments. This allows for real-time updates to IP addresses or other node attributes, eliminating the need for manual intervention. The solution uses HashiCorp's Consul as a data source and Terraform as an automation tool to drive changes to the network infrastructure. By integrating Cisco Secure Firewall with Consul-Terraform-Sync, organizations can achieve agile solutions for tracking dynamic changes in cloud environments.

HashiCorp has welcomed 15 new verified providers to its growing HashiCorp Terraform ecosystem, bringing the total number of verified providers to over 180. These new providers include BlueCat, BuddyWorks, Coralogix, HPE GreenLake, HoneyComb, ITGLOBAL Serverspace, JFrog Project & XRay, KeeperSecurity, Kentik CloudExport & Synthetics, PaloAltoNetworks Bridgecrew, ServiceNow Lightstep, VMware Tanzu Mission Control, and Zededa ZedCloud. The growth of the Terraform provider ecosystem continues to accelerate, enabling practitioners to automate the use of a wider range of tools throughout their infrastructure deployments. HashiCorp also announced that it has now reached over 1,800 total providers, with more than 1,800 modules available for integration.

Machine authentication with HashiCorp Vault using Azure managed identity and Microsoft Azure managed identity is a crucial approach to mitigate credential exposure risks. The Azure auth method supports both system-assigned and user-assigned identities, enabling workloads to obtain their bearer tokens and exchange them for a Vault token upon verification of the bearer token's validity. To set up this workflow, an Azure application registration for Vault needs to be created using Terraform, followed by enabling the Azure auth method in Vault and configuring the auth backend with connectivity details from the Azure subscription. A role per workload is then created on Vault, scoped to the level of secret access that each workload requires. The complete configuration can be achieved by using a combination of Terraform modules, including the app-vault and azure-auth-method modules, which automate the setup and configuration of Azure managed identities for authentication to Vault.

The HashiCorp Terraform AWS provider has been updated to version 4.0, bringing significant usability improvements to data sources and attribute validations, as well as a refactored S3 bucket resource. The new version includes four major updates: updating the Amazon S3 bucket resource, implementing the full CRUD lifecycle for default resources, ensuring all plural data sources return zero results, and improving provider configuration. These changes aim to simplify configurations and improve the overall experience of using the Terraform AWS provider, with features such as a refactored S3 bucket management resource, improved fine-grained identity and access management, and support for FIPS, DualStack, unique STS regions, and multiple shared credentials files. The update also includes additional resources and recommendations for practitioners to transition smoothly to the new version.

HashiCorp's new feature, Administrative Partitions, aims to solve the challenges of managing multiple dedicated service meshes provisioned for different teams within an organization. The main goal is to reduce resource inefficiencies, improve consistency and governance, and lower costs associated with managing individual service mesh deployments. Admin Partitions provide improved multi-tenancy capabilities by consolidating multiple Consul deployments onto a single Consul control plane, allowing tenants to share resources while maintaining isolation between groups. This solution enables centralized management, reduces the need for non-overlapping IP ranges, and provides strict resource isolation between partitions. By using Admin Partitions, organizations can optimize their cloud efficiency, reduce costs, and improve overall service mesh management.

HCP Vault has integrated with Datadog's Vector to meet the observability needs of its customers by shipping metrics and audit logs to various SaaS data platforms, including Grafana Cloud and Splunk SaaS. The decision to use Vector was driven by its vendor-agnostic design, flexibility in handling data transformation, and robustness towards network partitions. HCP Vault's integration with Vector aims to provide a unified solution for customers to analyze their Vault usage insights tailored to their specific use cases, while minimizing the complexity of data ingestion across different platforms.

HashiCorp Vault provides a defense-in-depth encryption strategy to secure data in Microsoft SQL Server by extending transparent data encryption (TDE) capabilities. TDE protects sensitive data at rest by encrypting it with a data encryption key (DEK), and HashiCorp Vault's EKM module manages the security of these keys, providing an additional layer of protection against attacks such as ransomware and insider threats. With the EKM module, Vault Enterprise customers can securely store encrypted DEKs on disk, ensuring that even if an attacker gains access to the server, they still need the KEK to decrypt the data, thereby protecting sensitive customer data.