January 2023 Summaries

The Terraform Cloud now supports native Open Policy Agent (OPA) integration, allowing customers to bring their existing OPA policies into the platform with minimal engineering effort. This integration extends policy as code capabilities in Terraform Cloud and enables users to choose between different policy frameworks such as Sentinel and OPA. The native OPA support simplifies policy enforcement workflows across multi-cloud environments, making it easier for teams to collaborate on policy development and enforcement. With this feature, users can now create and share reusable policies with minimal effort, group policies using policy sets, define enforcement levels, and grant role-based access control permissions. This integration is available to all Terraform Cloud customers, allowing them to take advantage of the platform's mature policy workflows and improve their overall security posture.

Hermes, an open-source document management system created by HashiCorp, aims to streamline writing and document processes for teams. The system was initially built as an internal tool to help HashiCorp employees author, review, approve, discover, and deprecate documents. Hermes supports Google Workspace and allows users to create document drafts, share them with collaborators, and send them for approval. It also features a full-text search capability and the ability to deprecate documents. The system uses Golang for the backend, Ember.js for the front end, and PostgreSQL database for storage, among other technologies. Hermes has been launched alongside Helios, HashiCorp's new open-source product design system, ensuring consistency in UI components across all products. As the project grows, HashiCorp plans to add more features, including related resources and document recommendations. Users can get started with Hermes by visiting its GitHub repository and providing feedback.

Helios, HashiCorp's new open source design system, offers a peek into how the company creates its product UIs. By establishing a standardized design language, HashiCorp aims to increase design quality with greater consistency across its product lines. The public launch of Helios is an active choice to deliver beautiful user interfaces and experiences across all customer-facing touchpoints. Helios gives designers and engineers a centralized repository of components that they can use to build inclusive, beautiful, and consistent user experiences. Engineers can leverage code samples and expert guidance to save development time and reduce unnecessary customization. The design system is built on atomic design principles, with plans to continue adding new icons, foundational components, and patterns to the library in the future.

The HashiCorp Terraform Cloud has introduced dynamic provider credentials, a new authentication model that provides a simple and safe way to authenticate with Vault and official cloud providers. This feature helps users create short-lived, just-in-time (JIT) credentials for HashiCorp Vault and the major cloud vendors, eliminating the need to manage and store long-lived static credentials. The dynamic provider credentials are standards-based, based on workload identity and implementation of the OpenID Connect standard, allowing organizations to securely authenticate to their cloud providers and Vault without manual rotation or revocation. This feature reduces friction, risk, and provides granular permissions control, making it easier for users to manage their infrastructure in a secure and efficient manner.

Here's a neutral and interesting summary of the text in one paragraph: HashiCorp Boundary 0.11.1 introduces two new features, KMS key lifecycle management and previous-root KMS key purpose, which enable rotation of internal keys and allow teams to specify a KMS root key used only for decryption. The KMS provider provides the root of trust for encryption operations, and users must assign a purpose to a KMS stanza. The post explores the root and previous-root purposes, explaining how they work and how to rotate keys in a scope. Boundary also supports rotating keys with rewrap option to ensure all KEKs are encrypted with the new root key. Additionally, the text discusses migrating from one root key to another, including updating the existing root purpose KMS stanza to previous-root and adding a new root purpose KMS stanza with the new configuration.

HashiCorp has released Image Ancestry Tracking for HCP Packer, a new feature that provides visibility into image dependencies across the cloud environment. This feature allows users to track the relationships between machine images and revoke an image and all its descendants at once. It enables better image lifecycle management by giving users understanding of image dependencies and remediating descendent images when a parent image is revoked. The feature also reduces risk by preventing the use of potentially vulnerable base images and streamlines build and deployment processes with increased efficiency.

This proof-of-concept application, called Rift, uses HashiCorp's Vault and Boundary to automate the process of granting temporary access to on-call engineers during production incidents. The system leverages event-driven workflows to trigger secure access controls, eliminating the need for manual intervention by security engineers. By integrating with alerting platforms, secrets management systems, and session management platforms, Rift enables a seamless and automated experience for on-call engineers to access underlying infrastructure. Once the incident is resolved, Rift automatically revokes access, ensuring that sensitive resources are protected. The implementation requires setup of users, host catalogs, credential libraries, and alerting platform configurations in Boundary, as well as configuration of Vault brokering short-lived credentials.

HashiCorp employees from around the world share how they’re celebrating Lunar New Year and the cultural traditions they practice. The holiday symbolizes the first day of the Lunar Calendar, which falls on January 22 this year, and marks the beginning of a 15-day celebration period. For HashiCorp team members, Lunar New Year is an opportunity to connect with family, friends, and colleagues from diverse cultural backgrounds, while also embracing traditions that bring good luck and prosperity for the new year. Employees share their personal experiences, customs, and superstitions surrounding this significant holiday, highlighting the importance of respect, gratitude, and unity in their celebrations. From wearing traditional attire to exchanging gifts and foods, team members showcase the richness of Lunar New Year traditions, demonstrating HashiCorp's commitment to fostering a culture that values diversity and inclusivity.

The CDK for Terraform (CDKTF) 0.15 release improves the ease of use with Terraform Cloud and Terraform Enterprise through automatic creation of Terraform workspaces, enabling seamless development experiences. This update also enhances parity with Terraform Cloud/Enterprise by switching to the Terraform CLI, allowing users to view complete plans while running commands on both platforms. Additionally, CDKTF 0.15 introduces improvements to the cdktf diff, cdktf apply, and cdktf destroy commands, providing a more streamlined development process.

The HashiCorp Vault ecosystem continues to grow with the addition of 25 new integrations, including nine new HCP Vault Verified Integrations and eleven new Vault Enterprise integrations. These integrations enable organizations to securely store and manage sensitive data, such as encryption keys, passwords, and certificates, using HashiCorp's fully managed platform, HCP Vault. The new integrations include partnerships with companies like Codefresh, Liquibase, PagerDuty, Palo Alto Networks, Pure Storage, SecureAuth, SnapLogic, Tines, Gurucul, Intel, Octopus Deploy, Qrypt, Thales, Alteryx, DataOps.live, Datastax, Ironchip, MinIO, ServiceNow, and VMware. These integrations demonstrate the expanding use of HashiCorp Vault to protect sensitive data across various industries and applications.

To build empathy with technical audiences, developer advocates need to work on building trust and authenticity. This involves living and showing their work, being an ally by presenting themselves authentically and visually differentiating themselves from sales teams, asking questions and offering options that meet users' constraints, following up with them in a timely manner and providing additional information required, and asking for feedback to create meaningful working relationships and build better tools. By taking these steps, developer advocates can establish trust and empathy with their technical audience, which is critical for success in roles such as developer advocacy, technical pre-sales, and community management.

Terraform Cloud has introduced a new organizational structure called projects, which allows users to isolate subsets of workspaces and define permissions within a single organization. This feature helps users organize and centrally manage their workspaces at scale while providing more granular permissions to a subset of workspaces. The introduction of projects aims to address the challenges in workspace management, such as lack of flexibility and complex workarounds, limitations with organization-level permissions, and reduced risk with centralized control. With projects, teams can safely self-manage workspaces and enable organization admins to create logical ownership boundaries to ensure security. Projects also provide increased agility with workspace organization, reduced risk with centralized control, and better efficiency with self-service capabilities.

HashiCorp conducted a scale test to observe gossip stability risk failure for Consul deployments with more than 50,000 clients. The test compared three configuration scenarios: baseline (66K clients on 1 gossip pool), 20-segment (22K clients on <default> segment and 55K across 20 segments), and 64-segment (22K clients on <default> segment and approximately 55K across 64 segments). The results showed that Consul servers remained healthy under all test configurations, and splitting a large LAN gossip pool into smaller pools with network segments reduces gossip stability risk by making the gossip converge faster. The primary goal was to observe a reduction in the `consul.serf.queue.Intent` metric, which was reduced by more than 90% post-20-segment migration. Additionally, the test highlighted the importance of configuring the ARP cache appropriately for large-scale Consul cluster deployments and introduced new labeled Serf and memberlist metrics to monitor gossip traffic between segments.

The new global management plane for Consul is now available as a free public beta, offering full visibility and control for both self-managed and HashiCorp-managed Consul clusters. This feature provides benefits such as quick bootstrapping of Kubernetes clusters, viewing health status of all Consul clusters in a single view, and discovering all services registered with the Consul clusters. The public beta focuses on two key features: global service catalog search and version labels, allowing users to quickly discover and reuse services across clusters, and determine whether their deployed Consul clusters are within the Consul version support policy. Interested parties can try the new HCP Consul management plane now at no cost with a $50 credit available for those who want to get up and running for free.

HashiCorp Boundary is a tool that provides identity-based remote access and credential management for Kubernetes clusters. It allows administrators to centrally control and precisely assign resources to each remote user using role-based access controls (RBACs). Boundary integrates with HashiCorp Vault to dynamically generate short-lived credentials just-in-time, eliminating the need to store permanent tokens on local laptops or desktops. The process involves configuring a Vault instance, creating a Kubernetes service account token, setting up a credential store in Boundary, and creating hosts and roles for remote users to access their assigned resources. By using Boundary, organizations can centralize remote access and credential management, reducing administrative burden and improving security.

As software developers consider new career paths, becoming a developer advocate or technical pre-sales professional can be a great way to use their technical skills to help others. However, this role requires strong public speaking and advocacy skills, which can be developed through practice and experience. The author, who has transitioned from various roles including help desk, implementation, systems architecture, and technical marketing, shares four steps to develop these skills: practicing at home by recording presentations and watching videos of oneself, practicing in front of people such as through karaoke or user groups, finding a mentor to collaborate with, and continuing to practice and ask for feedback. By following these steps, individuals can build confidence and stage presence, ultimately becoming effective presenters and advocates.