August 2022 Summaries

A service mesh is a powerful tool that can provide a wide range of capabilities including service discovery, zero trust security, load balancing, multi-cloud connectivity, automation, and north-south traffic control. It allows organizations to consolidate multiple existing tools into one solution, reducing management toil and costs. A cloud-agnostic service mesh provides simplification for multi-cloud architectures, enabling global service discovery, secure communication, and load balancing across different environments. By leveraging a service mesh, organizations can improve their security posture, reduce tool sprawl, and increase efficiency in managing network infrastructure.

A Kubernetes application can use Vault Agent to update secrets when they change, without having to refactor its code. The application's database username and password can be retrieved from a PostgreSQL secrets engine in Vault, and the credentials are cached by Vault Agent for faster retrieval. When the secret changes, Vault Agent sends a termination signal to the application, which shuts down and gets rescheduled by Kubernetes. If the application supports live reload, Vault Agent can send an HTTP POST request to the application's /actuator/refresh endpoint, which triggers the live reload of configuration without disrupting the web server. The refresh mechanism allows for secure access to individual actuator endpoints.

HashiCorp's Early Career Program provides 70 interns with opportunities to learn new skills, develop practical knowledge, and network throughout the company. The second cohort of interns shares their experiences, highlighting technical knowledge, teamwork and communication, and soft skills such as adaptability and growth mindset gained during their summer at HashiCorp. Interns in various departments, including engineering, marketing, customer success, recruiting, solutions engineering, investor relations, sales development, research, and software engineering, reflect on the company's principles, products, and processes, and how they can be applied to personal and professional life.

HashiCorp has expanded its Terraform Cloud ecosystem with the integration of oak9 and Torq, providing users with more options to execute their cloud infrastructure strategy and ensure compliance. Run tasks enable teams to send details about a Terraform run to partner tools between the plan and apply stages, allowing them to configure their Terraform Cloud run task to continue or halt the run. The integrations also validate with Terraform Enterprise, enabling customers to directly integrate third-party tools and services at the post-plan stage. With these additions, HashiCorp now offers 14 different partner products to help customers drive policy-related workflows across code scanning, cost management, and compliance.

The 2022 HashiCorp State of Cloud Strategy Survey reveals that IT organizations are struggling with a growing skills shortage in cloud computing, leading to the creation of cloud platform teams and investment in automated tooling. A whopping 94% of respondents reported avoidable cloud spending, with lack of training being the most common reason, cited by 33%. However, many are finding an effective way to address these issues by using centralized cloud platform teams, which leverage the skills and expertise of an enterprise's best engineers. Automated tools are also crucial in making hard-to-find engineering talent productive, with 89% of respondents saying automation tools were important or extremely important. The survey highlights the importance of automated tooling in providing benefits across each critical layer of cloud infrastructure, including scalability, cost optimization, and improved developer productivity.

HashiCorp has added native service discovery to Nomad, offering a simpler option for basic service registration. This new feature aims to simplify the user experience by providing built-in service discovery capabilities within Nomad itself, reducing the need for additional tools and products. The integration with Consul remains available for more complex use cases, allowing users to leverage both options depending on their deployment needs. By incorporating native service discovery, Nomad can provide a lighter stack without requiring external integration for simple use cases, enabling faster setup and operation.

The Consul API Gateway version 0.4 introduces support for the new beta version of the Kubernetes Gateway API and HTTP path rewrites, allowing users to route traffic requests to services within a cluster more granularly. The gateway service is a key resource in the Kubernetes environment, acting as an entry point into the cluster and supporting different listener protocols like HTTP/S, TCP, and TCP+TLS. The GatewayClass resource enables templating of how Gateway services are configured, while the HTTPRoute allows users to attach routing behavior to their gateway, including termination and protocol selection. Additionally, HTTP path rewrites are introduced as a feature that can detect the originating hostname and rewrite it before passing the request to the corresponding backend service. This release is part of the growth of three key components within the API: GatewayClass, Gateway, and HTTPRoute, and marks an important milestone in the maturity of these APIs.

Boundary 0.10 introduces enhanced identity and access management (IAM) workflows in the admin UI, allowing users to manage workers tags and control which worker proxies manage connections to targets. Additionally, it adds support for SSH key credential management, enabling users to seamlessly connect to machines remotely via SSH without having to manually enter their brokered credentials. This release also includes an SSH brokering helper function that allows users to establish connections to targets without constantly copying and pasting credentials. Furthermore, HCP Boundary now supports SSH credential injection, a method of injecting credentials into established connections, reducing the need for manual credential entry. The new release also introduces private worker upgrades for self-managed workers with HCP Boundary in version 0.10 and above.

The Microsoft Cloud Adoption Framework (CAF) provides guidance and best practices to adopt Microsoft Azure, enabling organizations to build repeatable and compliant infrastructure that follows best practices. HashiCorp Terraform Cloud can be used to deploy Azure resources based on CAF templates, allowing non-technical operators to use the platform. Industrialized workflows leverage a standard workflow or pattern to deliver a business-focused outcome, providing centralized visibility, control, and management. By using Terraform Cloud with CAF, organizations can focus on growing their business instead of managing underlying systems, capturing best practices, and building faster. The example repository demonstrates how to set up an industrialized workflow using HashiCorp Terraform Cloud and Microsoft Azure, showcasing the ease and speed of deployment without requiring extensive knowledge of either platform.

HashiCorp's 2022 State of Cloud Strategy Survey reveals that 94% of organizations have avoidable cloud spending, with common causes including idle or underutilized resources, overprovisioned resources, and lack of needed skills. This can lead to significant costs due to unmanaged cloud infrastructure, reduced developer productivity, security risks, and wasted spend. However, HashiCorp's Terraform can help optimize cloud spending by providing efficient provisioning and infrastructure lifecycle management throughout the infrastructure automation journey. By adopting Terraform, organizations can reduce their cloud spend by more than 20% through real-time control, proactive policy enforcement, reduction of unnecessary resources, elimination of manual processes, and centralized management across technologies.

HashiCorp Consul 1.13 is now generally available, offering enhanced features such as a Consul on Kubernetes CNI plugin, CLI enhancements for Envoy troubleshooting, and cluster peering in beta. The new Consul on Kubernetes CNI plugin simplifies traffic redirection configuration by distributing a chained CNI plugin that handles the pod's lifecycle network setup phase, removing the need for CAP_NET_ADMIN privileges. Additionally, Consul 1.13 introduces CLI commands to quickly troubleshoot Envoy configuration issues via the `consul-k8s` proxy list and read commands. The terminating gateway has also been enhanced to communicate with external services using transparent proxy, enabling seamless communication with external services by allowing administrators to create an allowed list of external hostnames or IP addresses. Cluster peering is a new feature that enables secure service connectivity between Consul datacenters, regardless of network topology or team ownership, providing fine-grained connectivity and operational autonomy.

HashiCorp has announced that Terraform Sentinel policies are now available in the Terraform Registry, allowing users to publish and share policies they want to use. The Registry provides a centralized location for searching and accessing Sentinel policies, with features such as filtering by provider and category. Users can browse policy libraries, select policies to use, and copy code to add it to their Terraform Cloud workspace configuration. Publishing policies is similar to publishing Terraform modules, requiring users to log in with their GitHub account and assign a category and providers. The Registry extracts information about the policy library from the source repository, making it available via the UI or API. This move aims to build out the Terraform ecosystem by leveraging community contributions and providing a platform for example and best-practice policies.

HashiCorp's State of Cloud Strategy survey found that 89% of respondents consider security the key driver of their cloud success. The complexity of managing multi-cloud environments raises new security challenges, including managing access by IP addresses, securing machine connectivity, and scaling security posture with demand. To address these challenges, organizations are turning to automated security tools and zero trust security, which involves implementing identity-based access controls and granting only least-privilege access. A comprehensive zero trust security approach can improve security posture, reduce the likelihood of a breach, and accelerate multi-cloud adoption by securing all clouds with centralized secrets management. By incorporating an automated zero trust security framework, organizations can detect and remediate security vulnerabilities while protecting themselves from expensive breaches.

A service mesh like HashiCorp Consul can help strengthen security posture and promote zero trust networking in Kubernetes environments by authorizing, authenticating, and encrypting service-to-service communications. Zero trust security principles require a fundamental shift to architecture, delivering identity-based access, including secret and certificate management, and enabling observability through audits and logging. A service mesh like Consul can provide a management layer that enforces zero trust principles, making it easy to enforce granular security policies in Kubernetes and across multiple environments without requiring extensive coding of security parameters into the application itself.

HashiCorp's new State of Cloud Strategy survey reveals that 86% of respondents rely on cloud platform teams for strategic and operational cloud responsibilities. These teams, which typically include engineers who provision, run, and manage cloud infrastructure, create highly automated platforms available on-demand across the organization. The survey highlights several challenges associated with multi-cloud environments, including different cloud service providers having different APIs, skills shortages, cultural transformation issues, governance difficulties, cost optimization problems, and business leaders trusting platform teams to address these challenges. Platform teams are responsible for standardizing cloud services, developing and distributing best practices, creating cloud management and operational policies, centralizing cloud security and compliance, keeping up with the fast pace of changes in cloud service options, and ensuring cloud operations. Despite an 86% adoption rate, industry leaders should continue to invest in platform teams to mitigate people- and process-themed challenges, assess specific gaps in technology within their organization, and find ways to scale their impact.

HashiCorp's Early Careers program has provided Zoraya Sanchez De La Vega Cayero with an opportunity to transition into the tech industry, despite being a non-traditional student and having a long-term career in healthcare. She joined the HashiCorp Engineering team as a Technical Program Manager Intern and is now pursuing a BS in software engineering at the University of Texas in UT Dallas. Zoraya's experience has been shaped by her desire to learn about programming, her curiosity about the tech field, and her need for support from her family. She faces challenges such as biases and assumptions about women in tech, but finds it rewarding to prove herself and demonstrate that there are no limits to what she can achieve. Zoraya's story highlights the importance of encouraging people of all genders to work in various job fields, avoiding inaccurate assumptions, and emphasizes the value of taking advantage of opportunities, such as HashiCorp's Early Careers program, to pursue a new career path.

The results of the 2022 HashiCorp State of Cloud Strategy Survey highlight the growing adoption of multi-cloud approaches, with 90% of respondents achieving their business goals through this strategy. The survey also emphasizes the importance of cloud security, skills shortages, and spending management in multi-cloud environments. Platform teams are playing a critical role in helping companies operationalize multi-cloud strategies, with 81% of respondents already using or planning to use multiple clouds. However, challenges remain, including ongoing concerns about cloud security, skills shortages, and waste due to overprovisioned resources and lack of needed skills. Forrester Consulting's analysis provides recommendations for enterprises to tailor their multi-cloud strategy to business goals, automate operations to reduce waste and increase efficiency, leverage security automation tools, and develop platform teams to cover all functional layers.

HashiCorp Consul has evolved into a comprehensive networking platform that bolsters zero-trust networking, works well with Kubernetes, and is remarkably easy to use. Consul can relieve pain points in security by offloading traffic between network services to be handled by its service mesh, allowing administrators to authorize communication between services based on service names rather than IP addresses. This makes it easier to manage communication between services, particularly across microservice environments where the service names are constant while the IP addresses are dynamic. Consul also thrives on Kubernetes, with powerful features for the platform and a tight integration with Vault. Additionally, Consul is easier to use than many people realize, with capabilities that can be tailored to individual needs and use cases, making it simple to deploy, manage, and use.

The Cloud Development Kit for Terraform (CDKTF) has reached its first General Availability (GA) release, version 0.12, offering full support for Go programming language and a GitHub Action to deploy with Terraform Cloud. CDKTF enables developers to write Terraform configurations in their preferred language, such as TypeScript, Python, C#, Java, or Go, while benefiting from the full ecosystem of HashiCorp Terraform providers and modules. This release increases productivity and collaboration by allowing teams to work together in a familiar syntax, reduces code duplication with constructs, and provides improved support for unit testing, resource-level and block-level iterators, and enhanced convert command functionality. The CDKTF 0.12 release includes various new features and improvements to ensure it is ready for production usage.