March 2023 Summaries

HashiCorp-managed HashiCorp Consul (HCP Consul) now supports cluster peering on Amazon Web Services (AWS) and Microsoft Azure, enabling enterprises to achieve multi-cloud and hybrid-cloud connectivity. The feature is currently available for customers with Flex billing and will be available in Entitlement contracts the first week of April. HCP Consul also introduces new tiers, including a Premium tier that supports cluster peering in development and production deployments, and a Plus tier that allows organizations to configure Consul cluster peering across multiple regions within the same cloud provider. Additionally, HCP Consul offers enhanced security features, such as an allow-list feature to limit access to a select group of source IP addresses or CIDR ranges within the customer's subnet. The HCP management plane now supports cluster peering, allowing operators to configure cluster peering from a single pane of glass and simplifying the cluster peering process.

HashiCorp has launched its recertification program for certification holders, allowing them to renew their certifications six months before expiration. The new program offers different paths to recertification based on the type of HashiCorp Cloud Engineer certification held, including taking the same exam again or upgrading to a professional-level certification. The program also includes customer-focused features such as reminder emails and direct registration from the certification account, making it easier for credential holders to track and update their credentials. Additionally, HashiCorp has manually extended the lifespan of active, un-expired credentials to expire after March 2023 to mitigate any lapse in credential coverage.

HashiCorp has received awards from Comparably in 2023 for Best Company Outlook, Best Marketing Team, Best Sales Team, and Best HR Team. These awards are based on feedback from HashiCorp employees who provided reviews on Comparably's culture and compensation platform. The recognition is especially meaningful as it highlights the company's commitment to creating a collaborative community where every employee can thrive. The awards cover various aspects of HashiCorp's culture, including work-life balance, professional development opportunities, perks, and benefits. The company's marketing team was recognized for its creative vision, messaging, campaigns, and experiences that educate and inform audiences while delivering joy and delight. The sales team was praised for its dedication to building partnerships with customers as they transition to the cloud. Meanwhile, the HR team was commended for creating an environment where employees can build successful and fulfilling careers through meaningful programs and professional development. Overall, these awards demonstrate HashiCorp's commitment to its employees and its mission to deliver essential services to the world.

HashiCorp's Terraform has reached a milestone, surpassing 3,000 providers in its integrations ecosystem, allowing organizations to standardize infrastructure as code and manage all their infrastructure with standardized provisioning workflows. Terraform supports more than 250 partners, including major cloud providers like AWS, Azure, and Google Cloud, as well as networking, private datacenter, and SaaS tooling providers. The platform's unique approach to ecosystem extensibility enables the creation of new and custom providers that leverage infrastructure-specific APIs, preserving unique capabilities for each provider. Terraform also offers modules, policies, and run tasks that help organizations add security, compliance, and governance into their workflows without sacrificing speed or agility, allowing them to automate provisioning, reduce manual errors, and improve overall efficiency.

The Vault Secrets Operator is a Kubernetes Operator that integrates HashiCorp Vault with Kubernetes, allowing for native synchronization of secrets between the two systems. This operator pattern removes service management burdens from human operators and provides a first-class integration method for managing secrets in Kubernetes clusters. The operator synchronizes static, dynamic, and PKI-based secrets from one or more Vault server instances and handles secret rotation, providing controllers for handling custom resources. The operator uses standard Kubernetes declarative patterns to reconcile the current state with the desired state specified in custom resource definitions. The beta version of the operator is now available as part of the HashiCorp Vault 1.13 release and supports only the Kubernetes authentication method during the beta period. Additional authentication methods are planned for future releases. The operator provides a Prometheus metrics endpoint and support for the PrometheusOperator, allowing users to be alerted to potential issues with the system and providing meaningful signals for determining the overall health of its secrets management processes.

The growing adoption of multi-cloud strategies in enterprises presents operational challenges due to the complexity of managing multiple cloud-based technologies and applications. To address this, infrastructure producers and consumers require different capabilities from their automation tools. Infrastructure producers need flexible solutions that meet users at various levels of expertise to manage provisioning, resource management, and life cycle management, while infrastructure consumers prioritize easy access to infrastructure for application deployment. Tight collaboration between these two personas is crucial for an optimal DevOps process.

Recent Terraform Enterprise releases have introduced powerful new features such as projects, native OPA support, dynamic provider credentials, and drift detection to enhance infrastructure provisioning workflow management, security, governance, and visibility. A fresh user interface has been designed to align with the Terraform Cloud UI, while cross-organization provider sharing eliminates manual effort required for publishing providers in each organization. Terraform projects allow organization admins to create logical ownership boundaries and teams to safely self-manage their workspaces with project-level permissions. GitHub App authentication provides enhanced integration between Terraform Enterprise and GitHub, improving security posture and auditability. An improved run pipeline model enables native OPA support, dynamic provider credentials, and drift detection, while also improving run queueing and distribution across nodes in an active/active deployment.

HashiCorp Boundary provides secure session access to workloads on private networks, addressing challenges with traditional approaches like jump boxes and bastion hosts. The platform consists of two architectural components: Controller and Workers. Workers are dynamic, can be managed in a stateless way without persistent storage, and come in two flavors - ingress and egress workers. A custom Boundary secrets engine using HashiCorp Vault facilitates the deployment of ephemeral workers as Nomad jobs, automating tasks like worker cleanup, token management, and revocation. The engine allows for on-demand, short-lived controller-led worker entries, tied to the lifecycle of their workload, mitigating worker sprawl risks.

HashiCorp has announced the public beta of a new Sentinel policy review experience in Terraform Cloud, designed to simplify policy reviews at scale and make it easier for users to identify compliance issues. The new design features enhancements such as individual policy result examination, filtering by status, and first-class support for policy descriptions. This update aims to empower users to manage their infrastructure with ease and confidence, and HashiCorp is eager to hear feedback from its users on how to continue improving the platform. Users can start exploring these new capabilities now by enabling the new Sentinel policy experience in Terraform Cloud's policies workspace settings.

The HashiCorp team has released the public beta of their OpenAPI-based Vault client libraries for Go and .NET, allowing developers to access Vault's secrets in an application-native mechanism with a secure posture. The new libraries are designed to provide a familiar look and feel between languages while being idiomatic, and they leverage code generation to keep libraries up-to-date with the latest changes to the Vault API. The libraries aim to replace existing API libraries and offer quality-of-life improvements, such as easily discoverable functionality and consistent interfaces. The team plans to continue expanding the feature set and improving the libraries through community feedback and issue tracking.

HCP Packer has released two new features: channel assignment history and channel rollback, which provide visibility into image channels and enable a simple one-click remediation workflow. Current limitations of artifact management make it difficult to track the assignment history of iterations and roll back a channel without custom tooling, resulting in multi-step processes prone to human error. HCP Packer's new features aim to solve these challenges by providing a complete record of artifact activity in a channel and a simple workflow for remediation, enabling users to see when images were made available to downstream consumers and the user that assigned them, as well as easily view the status of parent images. Channel rollback provides a simpler remediation process with one-click access to assign a previous iteration, reducing custom code needed to automate reliable rollback and allowing organizations to reduce their time to remediation during security incidents.

Terraform's dynamic provider credentials offer secure, short-lived authentication for HashiCorp Vault and cloud providers, eliminating the need to manage long-lived static credentials and reducing security risks. This new authentication model simplifies processes, reduces risk, and provides more granular permissions control, allowing users to scope privileges down to specific Terraform operations based on the run phase, workspace, project, or organization. To get started with dynamic provider credentials, users can check out the documentation and tutorials, and sign up for a free Terraform Cloud account to begin provisioning and managing their infrastructure in any environment.

HashiCorp has released Terraform 1.4, now generally available for download, which introduces enhanced run output in Terraform Cloud, support for Open Policy Agent (OPA) policy results in the CLI, and a native replacement for the null resource. With this release, Terraform Cloud runs initiated using Terraform 1.4 can display improved UI output, and CLI-driven runs now integrate OPA policy checks, providing parity with Sentinel policies. Additionally, a new `terraform_data` resource is introduced as a built-in replacement for the null resource, removing the need to include the null provider in configurations and supporting similar capabilities.

Nomad 1.4.3 introduces significant improvements to the evaluation broker, reducing Raft load by over 80% and scheduler load by 99%. This update improves performance during rapid cluster changes, making it easier for users to manage large clusters with thousands of jobs. The new evaluation broker logic reduces the number of evaluations that need to be processed by schedulers, resulting in a significant decrease in scheduler loads. By upgrading to Nomad 1.4.3 or newer, users can enjoy reduced recovery time during incidents and faster scheduling performance.

HashiCorp has expanded its Consul ecosystem with 13 new integrations, enhancing observability, resilience, and security for applications across various runtime platforms and cloud environments. The company has also announced the general availability of Consul 1.15, which simplifies user onboarding, improves troubleshooting workflows, and reduces operational complexity. Additionally, HashiCorp has completed a new Consul Deployment Guide on Google Kubernetes Engine (GKE) and released new integrations with industry players such as Circonus, Grafana Labs, iLert, Netdata, Neustar Security Services, Rancher, Splunk, Zscaler, F5, New Relic, Sophos, Cisco, Datadog, Fortinet, VMware, Gravitee APIM, Traefik Ingress Gateway, and others. These integrations aim to provide customers with improved visibility, automation, and security for their Consul environments.

HashiCorp has released Vault 1.13, which brings enhancements to team workflows, integrations, and visibility. The release includes improvements to multi-namespace access workflows, Azure auth method, Google Cloud secrets engine, KMIP secrets engine, MFA login, Vault Agent, and certificate revocation for cross-cluster management. Additionally, new features such as event-based notifications, Vault Operator, HCP link for self-managed Vault, PKI health checks, managed transit keys, and enable rotate-root in Azure auth method have been introduced. The release also includes significant new functionality, and HashiCorp recommends upgrading and testing new releases in an isolated environment to ensure smooth adoption.

The new global management plane for Consul is now generally available, providing full visibility and control for both self-managed and HashiCorp-managed Consul clusters. This feature offers significant benefits to Consul operators, including quick bootstrapping of Kubernetes clusters, health status viewing, and discovery of all services registered with the Consul clusters in a centralized view. The global service catalog search allows users to see a single view of all discovered and registered services across all Consul clusters, regardless of their location, while version labels enable users to determine whether their deployed Consul clusters are within the Consul version support policy and update them if needed.

HashiCorp has released Consul 1.15, which simplifies user onboarding, enhances troubleshooting workflows, and reduces operational complexity. This release includes several important new features such as Envoy access logging, Consul Envoy extensions, service-to-service troubleshooting, Linux VM runtime support in Consul-native API gateway (Beta), Consul server rate limiting, and an experimental Raft write-ahead log storage backend. These features aim to improve the overall experience for users of Consul, a tool used for service discovery and service mesh management. The new release provides enhancements for all types of Consul users, including those leveraging it for serverless functions, and is designed to enable a consistent enterprise-ready control plane to discover and securely connect any application.