March 2022 Summaries

HashiCorp has expanded its private registry support in Terraform Cloud and Enterprise to include providers as well as modules. This feature allows teams to centralize and distribute privately maintained providers, offering several usability and security advantages for organizations using public providers. With this update, users can now host and distribute providers directly from their organization's private registry, making it easier for team members to find both modules and providers. Additionally, the new support enables control over provider versions and enforces the use of providers alongside modules using Sentinel policy as code.

The Cloud Development Kit for Terraform (CDKTF) 0.10 has been released, enabling multi-stack deployments and improving the CLI experience. Key improvements include support for automated multi-stack deployment with dependency resolution, full Terraform output streaming to the CLI for diff, deploy, and destroy commands, improved types for computed lists in generated provider code bindings, and various other enhancements and bug fixes.

HashiCorp has announced the general availability of variable sets for its Terraform Cloud and Terraform Enterprise platforms. This feature allows users to reuse both Terraform-defined and environment variables across an entire organization in a centralized manner, reducing management overhead when updating variables used across multiple workspaces. The public beta phase offered a well-documented API to automate the workflow for managing variable sets and their associated variables. Variable sets are available for users of every tier on Terraform Cloud, with documentation and a new HashiCorp Learn guide available to help get started.

HashiCorp has released Vault 1.10 with new features and enhancements. The release includes the ability to move secrets engines and auth methods across namespaces, IBM Db2 credential management using OpenLDAP secrets engine, updated Vault usage metrics dashboard, multi-factor authentication (MFA) integration for additional authentication, server-side consistency tokens, automatic key rotation, an update to the Vault AWS Lambda Extension tutorial, and general availability of Vault as an OIDC identity provider. These features are covered in detail with step-by-step tutorials on HashiCorp Learn.

Four women at HashiCorp share their personal journeys into tech careers, highlighting the challenges they faced and overcame along the way. Sara Asano, a Solutions Engineer, discusses her transition from language studies to tech after being diagnosed with multiple sclerosis. Support Engineer Ciara Clements shares how she developed an interest in tech by helping others with their computer issues. Senior Design Systems Engineer Melanie Sumner recounts growing up in a strict religious environment and eventually turning her hobby of making websites into a career. Lastly, Customer Success Manager Dorina Timbur details her move from Moldova to Czech Republic for better opportunities in the tech industry. All four women emphasize their passion for helping others succeed in tech and offer advice and inspiration to those pursuing similar paths.

AzureRM 3.0, the latest version of the Azure provider for Terraform, brings significant parity between the Azure services currently available and the provider itself. The new release includes major improvements such as new data sources and resources for App Service/Function Apps, Key Vault soft delete recovery/purging, switching to Microsoft Authentication Library (MSAL), and updates to existing behaviors for Application Gateway, API Management, Resource Groups, Storage, and all resources with specific fields. The upgrade guide provides more information on these changes, deprecations, and breaking changes. HashiCorp is committed to delivering an ideal user experience for practitioners using this provider and providing significant coverage for new services and resources.

HashiCorp has released Vault 1.10, focusing on improving its core workflows and making key features production-ready to better serve users' needs. The latest version includes login multi-factor authentication (MFA) support, promotes Vault as an OIDC provider to generally available status, adds support for public key infrastructure (PKI) to use hardware security modules (HSM), and many other improvements across the project. Other features include IBM Db2 credential management, database plugin multiplexing, telemetry added to Vault Agent, server-side consistent tokens, auto-key rotation for Transit, usage metrics enhancements, user interface updates, and moving secrets engines and auth methods.

This blog post discusses how using policy as code to enforce governance for certificate creation inside HashiCorp Vault can reduce cost of ownership and lower risk. It introduces Sentinel, HashiCorp's policy as code solution that provides targeted, shift-left policy enforcement across all workflows. The author presents a hypothetical scenario where Acme Corp wants to allow its applications in Microsoft Azure to generate short-lived certificates using HashiCorp Vault Enterprise. The post then outlines the problem and solution, which involves using Vault's identity system and Sentinel to govern access to a single endpoint for creating certificates. It covers the workflow, including Vault PKI, Azure authentication, Vault identity, and Sentinel policies. Finally, it concludes by emphasizing the importance of Sentinel in enforcing corporate governance across HashiCorp's Enterprise products and how pairing Sentinel with Vault's entity model enables more granular authorization and simplifies secrets management.

Five women from HashiCorp share their experiences in giving back to their communities during Women's History Month. Hope Blaythorne, Director of Customer Success, discusses her work on local community boards and environmental advocacy groups. Laura Haller, Security Engineer II, mentors for the international Women in Cybersecurity group and helps women feel like they belong in cybersecurity. Sarah Ramsey, Talent Development Partner, creates workshops to help employees manage stress and practice self-compassion. Caroline Paine, Strategic Account Manager, volunteers at The Soup Kitchen and supports lonely elderly people through phone calls. Rae Krantz, Manager, Engineering, applies her skills as a part-time journalist for an indie news outlet in Delaware, covering topics such as Black maternal health, housing reform, and food justice.

The final post spotlighting HashiTalks 2022 content focuses on useful Terraform, Packer, and CI/CD strategies. Topics covered include handling out-of-band infrastructure changes in Terraform, writing high-quality Terraform modules for exponential organizations, safely importing critical resources into Terraform Cloud, creating preview environments for code changes using Terraform, destroying non-production with Terraform, best practices for Terraform AWS tags, scanning Terraform code for misconfigurations, building a secure AWS golden image pipeline with Packer, Vault, and Terraform, automating image pipelines with HCP Packer, creating GitHub and GitLab CI/CD pipelines in minutes using Nomad, and more.

The HashiTalks 2022 event highlighted useful strategies and use cases for HashiCorp Vault and Boundary. Topics covered included static typing in Vault, migrating from Vault Open Source to Vault Enterprise, codifying JWT/OIDC Vault auth methods with Terraform, upgrading Vault using failover, integrating HashiCorp Vault for data backup solutions, and zero-trust security and identity management with Boundary. The event also featured talks on observability, Consul-Terraform-Sync, HashiCorp Nomad experimentation, Kubernetes integrations, and case studies.

HashiCorp Consul enhances application resiliency by deploying applications within a service mesh, avoiding the need for additional infrastructure changes. By decentralizing networking responsibilities such as routing and failover using proxy sidecars like Envoy, Consul allows applications to dynamically adjust network behaviors without altering application code, thus increasing resilience. Chaos engineering, a methodology involving deliberate testing of an application's ability to withstand various failure scenarios, is used to validate and build confidence in the system's resilience. This process involves forming hypotheses about potential failure points, such as a backend service's ability to handle container failures, and running experiments to attempt to disprove these hypotheses. Successful navigation of chaos experiments, facilitated by Consul's dynamic traffic management, indicates a robust and resilient application architecture.

The 2022 HashiTalks conference featured numerous insightful case-study sessions highlighting real-world use cases of various HashiCorp products across different industries. Topics included compliance at scale using secure Terraform modules, managing massive Terraform imports to avoid monolithic structures, adopting HashiCorp tools for replatforming efforts, building a symmetric multi-cloud architecture with Terraform and Vault, creating DevOps Dojos to upskill organizations in Terraform, incident management program building at HashiCorp, and developing an internal development platform using Terraform. Further highlight roundup blogs are expected covering topics such as Terraform tips and strategies, CI/CD, image pipelines, and Vault and Boundary techniques.

In honor of International Women's Day, three HashiCorp leaders share their inspirations, challenges, and hopes for the future. Preeti Somal, Executive Vice President of Platform, IT and Security, discusses her early life inspirations from Indian historical figures like Lakshmi Bai and Indira Gandhi. She has overcome obstacles such as the "glass ceiling" and the "old boys club." Kat Williamson, Vice President of Talent Development, is inspired by Melinda Gates and Jacinda Ardern for their unapologetic leadership and compassionate strength. Lucia Salazar, Vice President of Financial Planning and Analysis, shares her experiences as a woman belonging to four minorities and overcoming challenges in her career. She encourages women to be the change they want to see and support each other.

HashiCorp has announced the general availability of its HashiCorp Cloud Platform (HCP) Packer service, which automates image management across multiple clouds and provides a standardized way to secure images within an organization. The release includes new features such as security workflows and custom metadata tracking for images. HCP Packer integrates with Terraform Cloud Business tier users, allowing them to integrate HCP Packer image compliance checks into their Terraform Cloud workflows. The service also enables codification of golden images across downstream images, providing visibility into how they are used and automating updates using a single packer build.

Tencent Cloud has integrated HashiCorp Vault, a comprehensive secrets and encryption management solution, to provide its customers with a verified and seamless user experience. The integration includes two parts - the Tencent Cloud Secrets Engine and Tencent Cloud Authentication Method. The Secrets Engine dynamically generates Tencent Cloud access secret ID/key or tokens based on CAM policies, while the Authentication Method provides an automated mechanism to retrieve a Vault token for Tencent Cloud entities. These integrations enable users to fully manage their Tencent Cloud secrets and auth with HashiCorp Vault, ensuring secure storage and controlled access to tokens, passwords, certificates, and encryption keys.

HashiCorp introduces its first lab-based certification exam for Vault professionals, allowing them to demonstrate their knowledge of configuring, managing, and monitoring a production Vault environment. The HashiCorp Certified: Vault Operations Professional exam includes multiple-choice questions and lab-based scenarios. This professional-level certification is the next step after the HashiCorp Certified: Vault Associate. Practitioners should have Linux skills, understanding of IP networking, experience with public key infrastructure (PKI), information security fundamentals, and knowledge of Docker containers. The exam costs $295, and a free 30-day trial binary is available for those without access to Vault Enterprise.

The HashiTalks 2022 conference highlighted various Kubernetes use cases with different HashiCorp products. Topics included secret management and rotation in highly regulated environments, features of Waypoint 0.7, connecting cloud-based microservices to on-premises legacy apps using Consul's mesh gateway, routing traffic outside the Kubernetes cluster network, creating a multi-context lab environment for Kubernetes, dynamic user creation with MySQL and HCP Vault, and integrating HashiCorp Vault for secure data backup.