October 2022 Summaries

HashiCorp Vault is being used together with Kubernetes to securely introduce secrets into applications. The most common integration method is using a sidecar agent to inject static and dynamic secrets from Vault into Kubernetes pods. Another integration method is the Kubernetes auth engine, which allows for authentication with Vault using a Kubernetes service account token. Additionally, there are integrations such as the Helm chart, which provides a production-ready way to get up and running quickly, and the Kubernetes secrets engine, which dynamically generates Kubernetes service account tokens, service accounts, role bindings, and roles. The company is also considering an operator approach to enhance vault-k8s integration, which would provide a better developer experience and more native Kubernetes experience.

HashiCorp Vault provides a central place to secure, store, and control access to sensitive data, including secrets management and protection of tokens, passwords, certificates, and encryption keys. It offers a dynamic secret approach to X.509 public key infrastructure (PKI) certificates, allowing for the generation of short-lived certificates on-demand and automatic rotation. To configure Vault to manage PKI certificates with self-signed and offline root certificate authorities (CAs), enable the PKI secrets engine at the pki/ path using `$ vault secrets enable pki`. The validity period of certificates can be configured by adjusting the global maximum time-to-live (TTL) for the secrets engine. A hierarchical CA hierarchy is recommended to protect the root CA, and each intermediate CA issues leaf certificates to applications and services. Each PKI secrets engine requires a URL configuration, certificate revocation list (CRL) distribution points, and online Certificate Status Protocol (OCSP) server endpoints. To generate certificates, users must supply a Vault role, which defines the conditions under which a certificate can be generated. Roles are created using `$ vault write pki/roles/<name>`, and templates are used to extract values from the `pki/issue` endpoint. Vault Agent uses the role and secret ID to authenticate to Vault and retrieve certificate information, writing it to files defined by the template source and destination directives. Vault Agent renews certificates at half the lease duration of the original, providing a secure and centralized way to manage certificate rotation and revocation.

HashiCorp recently held its annual conference, HashiConf Global 2022, which brought together over 10,000 attendees from around the world to learn about the company's products and share ideas. The event featured 40+ keynote and technical sessions, as well as several social events. Key announcements made at the conference included updates to HashiCorp's cloud offerings, such as new features for its Boundary security solution and HCP Vault on Microsoft Azure. Additionally, the company shared updates for its infrastructure and application automation products, including Terraform Cloud, Nomad 1.4 GA, and HCP Waypoint Public Beta. The conference is now available to watch on YouTube, featuring videos of all keynote and technical sessions. HashiCorp expressed gratitude to attendees and partners for their participation, and looks forward to seeing the community again next year.

Enhance your Terraform Cloud workflow by adding run tasks before the plan and/or apply stages. The general availability of pre-plan/pre-apply run tasks allows teams to integrate third-party tools and services at multiple stages of the Terraform run lifecycle, enabling customizable workflows and addressing common use cases such as security and compliance requirements. With this release, customers can now check Terraform configuration before the plan is generated, reevaluate compliance prior to applying, or trigger customized workflows in whichever stage is most suitable to their needs. Several partners have created validated pre-plan and pre-apply run tasks, including BlinkOps, Check Point, Tines, and Torq, which provide solutions for automation, security, approval, and tracking with ticketing systems.

HashiCorp has introduced the Partner Technical Competency Program for Systems Integrators (SIs), a new program that allows partners to display earned competency badges on their websites and HashiCorp.com, recognizing their ability to deliver and integrate HashiCorp products and solutions into end customers' initiatives. The program validates SIs' investments in the HashiCorp ecosystem and confirms their expertise in delivering and integrating HashiCorp products and solutions. Two competencies have been launched: Infrastructure Competency and Security Competency, which cover areas such as infrastructure as code with Terraform, image management with Packer, secrets management with Vault, and zero trust security with HashiCorp products. To earn these competencies, partners must demonstrate technical staff certified on HashiCorp products, proven customer success with HashiCorp products in deployment, and undergo a successful audit. By participating in the program, partners gain access to HashiCorp marketing, sales, and other incentives, as well as recognition from CDW, TeraSky, and other launch partner companies.

HashiCorp has won the 2022 Datadog Partner Network Integration Developer Partner of the Year Award, chosen for its revenue contribution and growth, product expansion, and commitment to innovation and support. The award recognizes HashiCorp's work with Datadog to create integrated solutions for joint customers and go-to-market campaigns, including integrations across Terraform, Vault, Consul, and Nomad. This partnership has provided joint customers with a seamless deployment experience, and HashiCorp looks forward to continuing to build on this relationship. The award is part of the Datadog Partner Network, which recognizes Sales and Services Partners as well as Technology Partners that offer integrations and complementary technologies or services to help customers achieve immediate time to value.

The HashiCorp Vault ecosystem continues to grow with 19 new integrations completed this past quarter, showcasing strong partnerships between HashiCorp and its partners. Five new HCP Vault Verified Integrations were announced, including Cockroach Labs, Dynatrace, ForgeRock, and others, which demonstrate the platform's ability to integrate seamlessly with various applications and services. Additionally, nine new Vault Enterprise integrations were added, featuring companies like Cockroach Labs, Crypto4A, Dynatrace, ForgeRock, Futurex, Securosys, Utimaco, BigID, Kaleido, and Palo Alto Networks. These integrations highlight the platform's expanding capabilities for secure data management and access control.

HashiCorp's Unidos Employee Resource Group, led by Karla De La Garza and Abraham Martinez, aimed to serve as a resource for Hispanic and Latinx employees during Latinx & Hispanic Heritage Month in Mexico. The group encouraged an inclusive culture, provided opportunities for connection and development, and supported HashiCorp's inclusion and diversity goals. Karla and Abe shared their experiences of reconnecting with their roots while working remotely in Mexico, discovering new aspects of themselves, and finding inner peace through embracing their identity. They also reflected on the progress made towards creating a more inclusive environment at HashiCorp, highlighting the importance of small steps towards progress. The duo offered tips for people interested in working remotely in Mexico, emphasizing the need to be open-minded and trust oneself. Finally, they advised reconnecting with one's heritage by exploring quiet spaces, contemplating the underlying reasons for disconnection, and embracing the fluidity of identity.

HashiCorp has released Vault 1.12, a significant update that improves core workflows and adds new features such as Redis and Amazon ElastiCache secrets engines, a new PKCS#11 provider, and enhanced Transform secrets engine usability. The release focuses on improving Vault's core workflows and making key features production-ready. Key features include support for Transparent Data Encryption for Oracle, PKI revocation improvements, and the addition of a new database secrets engine that supports the generation of static and dynamic user roles. Additionally, Vault 1.12 introduces significant changes to the Terraform provider, Vault usage metrics, and licensing behavior, and provides improved PKCS#11 provider capabilities, including support for Transparent Data Encryption for Oracle and key management with cloud KMS systems. The release also includes numerous other features, workflow enhancements, general improvements, and bug fixes.

The Cloud Development Kit for Terraform (CDKTF) 0.13 has improved performance across all supported languages, reducing synthesis time by up to 96.8% compared to the previous version. This improvement was achieved through the introduction of namespaces in every class in provider bindings, which were previously flat lists of constructs. The change requires users to update their import paths for provider-related classes and is a breaking change that will be fully supported in CDKTF 0.14. Users can upgrade to 0.13 without changing their code if they are using the backwards-compatible provider bindings, but will need to update their code when migrating to CDKTF 0.14. The next release of CDKTF, 0.14, will focus on quality-of-life improvements for pre-built providers and making it easier to use them in projects.

HashiCorp Nomad 1.4 is now generally available, offering several enhancements to its native service discovery support with health checks, introducing Nomad Variables for storing configuration values securely. The new feature allows users to store encrypted configuration values directly in Nomad, making configuration management simpler and more secure. Additionally, Nomad 1.4 introduces improved service discovery, ACL roles and token expiration, UI improvements, and various operational enhancements such as keyboard navigation and templating improvements. These updates aim to provide a better experience for users, including improved security, ease of use, and faster navigation through the Nomad interface.

HashiCorp Waypoint is now available on the HashiCorp Cloud Platform (HCP) in public beta, offering a Platform-as-a-Service (PaaS) experience for application delivery that simplifies and standardizes deployment across various platforms. It uses a single declarative file to achieve consistency across infrastructure, platforms, and tooling, with an extensible plugin system and customizable lifecycle features. The HCP Waypoint server is fully managed by HashiCorp, providing a UI-integrated portal and reducing operational overhead. Users can take advantage of identity access management (IAM) capabilities and grant access to sensitive variables, ensuring a stronger security posture. The public beta is free to use and aims to gather early user feedback for common workflows, with the goal of supporting production environments in future iterations.

HashiCorp has introduced several significant upgrades to HashiCorp Terraform at HashiConf Global 2022, including continuous validation, no-code provisioning, native Open Policy Agent (OPA) support for Terraform Cloud, and general availability of Terraform 1.3. These features aim to address challenges in cloud migration, multi-cloud infrastructure management, skills shortages, security breaches, and regulatory compliance. The upgrades provide improved visibility, self-service capabilities, and enhanced policy enforcement, enabling users to standardize their infrastructure automation, mitigate risks, and drive innovation. Additionally, HashiCorp has introduced new features such as Azure Provider Automation, ServiceNow Service Graph Connector for Terraform, and Terraform Plugin Framework, which expand the functionality of Terraform and enable developers to build custom providers.

HashiCorp has announced the general availability of HCP Boundary, a fully managed version of HashiCorp Boundary available as a service on the HashiCorp Cloud Platform (HCP). HCP Boundary provides a consistent workflow for securing access to infrastructure in ephemeral cloud environments without exposing network credentials. It builds on top of the open-source Boundary project and offers a production-ready managed offering for remote access in cloud-based zero trust security architectures. The solution bolsters zero trust security with an automated workflow that gives users easier remote access to critical infrastructure, automating user and target onboarding and minimizing configuration overhead. As a Software-as-a-Service (SaaS) solution, HCP Boundary combines a single-click deployment experience with operational hardening, enterprise support, security hardening, and service level agreements (SLAs). Users can get started by creating an HCP account, deploying HCP Boundary, and connecting to their initial infrastructure target. The first 50 sessions are free to help organizations easily get started securing remote access for their users.

In addition to its availability on AWS, HCP Vault can now be deployed on Microsoft Azure infrastructure, enabling organizations to streamline secrets management for workloads running on Azure Virtual Machines or Azure Kubernetes Service. This announcement marks the latest milestone in the HashiCorp and Microsoft collaboration, providing a multi-cloud workflow, push-button deployment, and fully managed infrastructure. The beta version of HCP Vault on Azure supports a single-node cluster designed for proof-of-concepts and non-production workloads, with plans to expand it to include more tiers over time. Users can get started by selecting Azure as their deployment option from the HashiCorp Cloud Platform or using the HCP Terraform provider.

HashiCorp Developer is a unified platform that brings together interactive labs, sample code, videos, tutorials, and in-depth documentation for all HashiCorp products and related technologies. The new platform consolidates product documentation under one roof, with hands-on labs running in the browser, code samples, videos, and certification prep integrated into one easy-to-use interface. This rollout replaces the current documentation and tutorial experiences, providing a consistent UI and comprehensive search across all content. A powerful search bar has been added to help users find answers quickly, while video, labs, and code samples boost learning. The platform is currently being rolled out, with automatic redirects from HashiCorp product.io and HashiCorp Learn expected by the end of October.

The latest beta release of HashiCorp Consul version 1.14 introduces several enhancements designed to improve operational efficiency, scalability, and resiliency. Simplified deployments of Consul service mesh with Consul dataplane eliminate the need for deploying node-level Consul clients on Kubernetes, reducing network requirements, setup complexity, and runtime support needs. Mesh traffic management across cluster peers is now supported, enabling operators to configure advanced traffic management capabilities such as canary or blue/green deployments, A/B testing, and service failover. Service failover enhancements enable critical services to always be available even when infrastructure components fail. Consul 1.14 also introduces first-class support for AWS Lambda functions, allowing serverless workloads to be managed like other workloads in the mesh. Additionally, beta support for Consul service mesh on Windows VMs is now available, enabling network control from a single pane of glass across hybrid workloads.

The HashiCorp Cloud Platform (HCP) has introduced new visibility and management controls for self-managed and HCP-managed Consul deployments, providing global visibility and control of services across multiple environments. This update aims to simplify operations for practitioners and operators, enabling them to streamline their service networking workflows from a central location. The new capabilities include a global service catalog, single unified view of clusters, secure bootstrapping, and hosted UI, which will be available as a tech preview on October 31, 2022, at no extra cost to users.

The 2022 HashiCorp Technology Partner Awards have been announced, recognizing HashiCorp's technology partners who have expanded ecosystem solutions for customers through new integrations and co-engineered solutions. Palo Alto Networks was awarded Technology Partner of the Year for its proactive collaboration on new integrations and marketing initiatives, while Traefik Labs earned Integration Partner of the Year for building multiple integrations with HCP Consul, HCP Vault, and HashiCorp Nomad. Snyk was recognized as Collaboration Partner of the Year for its extensive collaboration and joint marketing opportunities, and Sophos took home Emerging Partner of the Year for its rapid growth and cross-product integrations since joining the partner program. The awards celebrate the contributions of HashiCorp's ecosystem partners, who are foundational to the company's success.