April 2023 Summaries

HashiCorp has announced the general availability of no-code provisioning in Terraform Cloud Business, allowing organizations to provide self-service infrastructure to their application developers without requiring any knowledge of Terraform or HashiCorp Configuration Language (HCL). This feature provides validated self-service infrastructure, additional security through more granular permissions, and ease of use with variable options as dropdowns. New features include variable input dropdowns, which allow admins to create guardrails for what attributes are applied to infrastructure, variable sets for projects, which enable teams to assign granular cloud credentials for their no-code teams, and scope "manage workspace" permissions to a project, allowing teams with project-level Admin or Maintain permissions to provision no-code ready modules directly into their project. The key benefits of this feature include increased productivity, cost efficiency, and reduced risk, as well as the ability to provide self-service infrastructure without requiring any knowledge of Terraform or HCL from the user.

HCP Vault Plus now offers support for Sentinel policies and control groups, providing finer-grained governance and compliance controls within fully managed clusters. This enhancement comes in addition to existing functionality, including multi-region performance replication and path filters. Customers can create role governing policies (RGPs) tied to specific tokens or identities, endpoint governing policies (EGPs) tied to specific paths, and enforce more flexible policy logic alongside traditional access control enforcement. Control groups enable dual or human authorization for accessing secrets, ensuring governance and compliance standards are met, and can be embedded into both ACL and Sentinel policies. With the addition of Sentinel support, HCP Vault Plus clusters now offer a range of advanced security features to help enterprises manage their secrets and data more effectively.

HashiCorp has announced that dynamic provider credentials in HashiCorp Terraform Cloud now support Vault dynamic secrets engines, allowing for consolidated cloud access and reduced risks associated with managing long-lived credentials. This feature enables the automation of short-lived credentials for cloud providers such as AWS, Azure, and Google Cloud, and integrates with HashiCorp Vault to provide a seamless approach for securing cloud provisioning workflows. The unified workflow eliminates the need for manual credential rotation, offers better security and auditing capabilities, and provides a consolidated management platform for all cloud credentials and secrets. To set up Vault-backed dynamic credentials, users must perform three steps: configure the Vault provider, select an appropriate secrets engine in Vault, and add environment variables to their Terraform Cloud configuration. This feature enhances the existing Terraform Cloud dynamic provider credentials feature by integrating with HashiCorp Vault, allowing for a unified approach to managing cloud credentials and secrets.

The CDK for Terraform v0.16 improves automatic conversion of configuration code from HCL to supported languages, enabling type coercion and providing better support for iterators and functions. The release enhances the conversion process by matching the type being generated from HCL with the provider schema, reducing errors caused by type mismatches. Additionally, it introduces enhanced iterators support, allowing for more accurate conversions using iterators instead of escape hatches. The update also improves the performance of CDKTF synth and get, and updates the minimum version of Node.js to 16. With these improvements, users can convert their existing Terraform HCL code to a CDKTF-compatible language automatically, making it easier to use CDK for Terraform.

HashiCorp will be attending KubeCon Europe 2023, both in person and online, as a Silver sponsor. HashiCorp Senior Developer Advocate Kerim Satirli will lead an in-booth partner session on Kubernetes Ingress with Consul and ngrok on Wednesday, April 19. The company will also discuss how to apply zero trust security principles to Kubernetes and the role of service mesh across multiple breakout sessions. Additionally, HashiCorp will provide insights on its approach to critical trends such as zero trust security and multi-cloud adoption. The company's products, including HashiCorp Vault, Boundary, Consul, and Terraform, will be highlighted in relation to Kubernetes. Even if you cannot attend KubeCon Europe 2023, you can still keep up-to-date with the latest developments by checking out resources provided by HashiCorp.

The guide provides an overview of using HashiCorp Terraform to deploy Azure resources with security best practices and policy as code. It outlines the process of building an N-tier architecture, using Terraform modules, and implementing security features such as password management, limiting access, tier isolation, database access, and applying Terraform Cloud policies. The guide also covers next steps for maintaining secure infrastructure, including watching a video on securing cloud with Terraform Foundational Policy Library and joining Microsoft and HashiCorp's webinar series on maximizing Microsoft Azure Security with Terraform.

HashiCorp Vault and Kubernetes offer various methods for integration, including the Vault Sidecar Agent Injector, the Vault Container Storage Interface (CSI) provider, and the Vault Secrets Operator. Each method has its own design considerations, such as secret projections, scope, types, definition, encryption, governance, updates and rotation, caching, and auditability. The similarities between these methods include simplifying secret retrieval and exposing secrets to pods without changing application logic. However, there are differences in how they approach this task, including the use of sidecar containers, daemonsets, and Kubernetes Operators. Understanding these differences is crucial for choosing the best method for a specific use case. Additionally, considering factors such as secret scope, types, definition, encryption, governance, updates and rotation, caching, and auditability can help in designing an effective secrets management strategy in Kubernetes environments.

Consul’s transparent proxy allows services to resolve and connect to other services using DNS instead of through proxy upstreams listening on localhost, providing an additional layer of security. To configure Consul's transparent proxy on virtual machines, a Consul client must be set up with service mesh and DNS forwarding enabled, and the virtual machine's DNS must be forwarded to Consul. The service definition sets the service’s name, port, and proxy mode, allowing Consul to assign a virtual IP in the 240.0.0.0/4 range to the service. Once traffic is redirected to the proxy, services can connect to each other using their virtual service names. To automate transparent proxy configuration, scripts can be used to enable traffic redirection before starting the proxy and clean up iptables after stopping the proxy. Consul ACLs must be enabled to authorize communication between services. An intention must also be defined to allow inbound traffic from a source service to a destination service. Once the intention is in place, services can resolve the in-mesh IP of an upstream service using a DNS hostname and connect to it.

The HashiCorp Certified Terraform Associate (002) exam has been updated to the new version 003, which reflects changes in the product's current state and future growth. The new exam will have a different organizational structure and cover new objectives, requiring those who held the older certification to take the new one if they fail or need to reschedule their exam after May 5th. Both versions of the certification remain valid until they expire, and individuals can choose to take the new version as soon as they are ready. HashiCorp has prepared study resources, including a guide, review guide, and sample questions, to help those prepare for the new exam. The company will issue new credentials for the Terraform Associate 003 exam, but existing holders of the (002) certification do not need to take it immediately.

HashiCorp Consul Service (HCS) on Azure has been deprecated, and users are encouraged to migrate their clusters to the HashiCorp Cloud Platform (HCP) for improved service mesh architecture and user experience. The transition period is ongoing, with HashiCorp providing support and assistance to customers during this change. Users can now enjoy simplified Consul deployments and scale their service mesh capabilities more efficiently across multiple environments.

The latest release of HashiCorp Sentinel includes several new features that improve the developer experience, including improved configuration syntax, support for static JSON data, named functions, simplified expressions for unknown values, and per-policy parameter values. These features enhance policy authoring and evaluation, making it easier to create reusable policies with dynamic logic and manage exemptions. The updated language supports a standardized naming convention, allows overriding default configurations, and provides two new helpers to determine if a value is defined or not. The features are designed to make Sentinel more accessible to developers and improve the overall policy authoring experience.