July 2023 Summaries

Terraform Cloud has introduced support for multiple configurations with unique dynamic credentials for the same provider within a single workspace, addressing the limitation of only one set of credentials per provider and workspace. This enhancement allows users to authenticate multiple aliases of the same provider across different regions and accounts, or targeting multiple clusters within the same provider. Users can now configure workspaces with environment variables to manage dynamic credential management, enabling secure provisioning workflows with Terraform and its providers. The new feature is particularly useful for managing credentials in environments where multiple instances of the AWS provider need unique roles.

This setup enables Terraform Cloud to automatically configure dynamic provider credentials for each AWS account provisioned via AFT, allowing organizations to securely deploy AWS application resources at scale. The solution leverages AWS Control Tower Account Factory for Terraform (AFT) and Terraform Cloud's dynamic credential feature, automating the process of setting up new AWS environments while ensuring secure deployment of infrastructure and applications. The setup utilizes a combination of Terraform Cloud and AWS services, including IAM OIDC identity providers, AWS Secrets Manager, and AWS CodePipeline, to provide a secure and scalable solution for managing AWS environments.

HCP Packer has added audit logs to monitor user activity across multi-cloud environments, providing organizations with visibility into their image iterations, buckets, and channels. This enhancement offers insight into the lifecycles of artifacts, allowing users to track changes and identify security risks or compliance issues. The audit logs contain metadata such as timestamp, organization and project ID, and describe operations performed in HCP Packer. These logs can be streamed in near real-time using industry-standard monitoring solutions like Amazon CloudWatch or Datadog, enabling organizations to improve their visibility and security by actively monitoring user activity and ensuring compliance standards are met.

HashiCorp Nomad is being used to run Boundary workers as dynamic workloads, utilizing the custom Boundary secrets engine for Vault to generate worker activation tokens and manage their lifecycle. The integration with Nomad and Vault allows for seamless automation of this process. To achieve this, a custom Vault plugin is required, which enables the retrieval of secrets from Vault and rendering them to a file using Nomad's templating capabilities. A Nomad job file is then created, which includes a Vault stanza specifying the policy to use when retrieving the activation token, as well as a template that populates the configuration parameter with the retrieved token. The final Nomad job file is complete and ready for deployment, allowing for the creation of a worker in Nomad to authenticate with the HCP Boundary controller.

The HashiCorp Early Career Program has provided six interns with valuable work experience and skills, preparing them for their future careers in the tech industry. Each intern has gained confidence and expertise in their respective fields, from sales to software engineering. They have worked on real-world projects that have a direct impact on the company's products and services. The program has allowed them to develop soft skills such as emotional intelligence, public speaking, and problem-solving. Many interns have also reported feeling like they are part of the team from day one, with opportunities for growth and development. Overall, the Early Career Program has been transformative for these interns, providing them with the knowledge, skills, and experience needed to succeed in their chosen careers.

This partnership between HashiCorp and Microsoft aims to provide a secure Azure reference architecture using Terraform modules that follow Microsoft's Azure Well-Architected Framework and security best practices. The focus is on post-deployment operations, including managing environment policies, additions, moves, and changes, using services such as Defender for Cloud and Azure ARC with Azure Policies. These tools enforce specific security rules and configurations across Azure resources, ensuring compliance and governance. By applying a policy set definition and utilizing Azure Policy Initiatives, users can apply a collection of related policies that align with outcomes, such as the Azure Security Benchmark, to their infrastructure. This enables the automation of policy control, including creating exceptions for time-based deployments, thereby maintaining secure and reliable infrastructure.

The ServiceNow Service Graph Connector for Terraform Cloud and Enterprise has been made generally available, enabling users to seamlessly sync infrastructure state information between DevOps and IT workstreams. This integration automatically updates the ServiceNow Configuration Management Database (CMDB) with Terraform-provided resource information, providing full visibility on cloud resource tracking and allowing organizations to scale their usage of Terraform. The connector captures resource information from the Terraform state file and sends it to the CMDB, capturing data from major cloud providers and vSphere, increasing reporting accuracy. Users can now import Terraform tags associated with resources into the CMDB, along with organization and workspace tags indicating where the resource was provisioned. There are two ways to import resources: schedule-based polling or event-based webhooks, which trigger imports upon successful completion of a Terraform run. This integration provides several benefits, including improved visibility on cloud resource tracking, increased reporting accuracy, and enhanced workflow capabilities.

The 2023 HashiCorp State of Cloud Strategy Survey reveals that more than 90% of technology firms are seeing business and technological benefits from their multi-cloud approach, with key drivers including reliability, cost reduction, scalability, and security. Despite macroeconomic uncertainty, almost half of technology firms increased their cloud spending in the last 12 months, while nearly three-quarters of respondents say their multi-cloud strategy has already advanced or achieved their company's business goals. The survey also highlights the importance of attracting, motivating, and retaining talent, with platform teams being increasingly adopted as a way to improve efficiency and standardization.

The Terraform Registry now features multi-language provider documentation for CDK for Terraform, providing code samples in languages such as TypeScript, Python, C#, Java, and Go, alongside HCL documentation, to simplify infrastructure provisioning and improve productivity. This development aims to make Terraform adoption easier by offering a single resource for discovering examples of resource configurations in various programming languages, eliminating the need for mental translation. The new multi-language provider docs are part of HashiCorp's efforts to enhance developer usability and velocity with tools like Terraform Cloud and improved testing frameworks.

HashiCorp has added several major features to Terraform Enterprise, including secure self-service infrastructure with Vault-backed dynamic credentials, no-code provisioning, and continuous validation, designed to address security, compliance, and reliability challenges in cloud platform teams. These enhancements provide a consolidated workflow using Vault for all secrets management needs and reduce the risks of managing static credentials. The new no-code provisioning workflow allows users to provision infrastructure without writing Terraform code, while guardrails reduce misconfigurations. Continuous validation provides automated health checks using assertions defined in Terraform code to ensure infrastructure remains healthy over time. Additionally, Terraform Enterprise now supports assignment of variable sets at the project level and a new Sentinel policy review UI.

HashiCorp has released Nomad 1.6, which introduces several new features to its orchestrator tool. Node pools allow users to manage multi-tenant clusters by determining which client nodes are eligible to receive workloads. This feature can be used to control workload placement using namespaces and provides a layer of hierarchy and control for workload allocation across datacenters. Nomad also includes a redesigned job UI, improved Nomad Pack, and other enhancements to its features and functionality. The new release aims to make it easier for users to understand how a job is supposed to behave by surfacing jobspec source code directly from the UI. Additionally, Nomad 1.6 supports optional jobs, improved Podman support, and new command-line options. The tool also continues to be open-source-first, with opportunities for contributors to join the community and improve the product.

In this latest update, HCP Vault Plus clusters now support all three ADP secrets engines, including KMIP, Key Management, and Transform, at no additional cost. This adds advanced encryption, tokenization, and data transformation capabilities to the platform, joining existing features like multi-region performance replication and Sentinel policies. The introduction of the KMIP secrets engine allows customers to use Vault as a KMIP server for clients, while the Transform secrets engine enables format-preserving encryption, non-decipherable encryption, and stateful encryption. With this update, HCP Vault Plus clusters can now support cross-cloud cryptographic keys and provide more flexibility in data protection methods, making it an attractive option for developers and organizations seeking robust secrets management capabilities.

The HashiCorp State of Cloud Strategy Survey 2023 reveals that financial services firms are adopting a multi-cloud approach to improve business outcomes, with almost 9 out of 10 respondents seeing benefits from their multi-cloud strategy, including reliability, scalability, and security. Despite macroeconomic pressures, more than half of financial services organizations increased their cloud spending in the last 12 months, while only a quarter cut their spending. The survey also found that training and skills shortages are common complicating factors for multi-cloud adoption, but over two-thirds of respondents believe their multi-cloud strategy is helping them attract and retain talent. Centralized platform teams are becoming increasingly ubiquitous as an organizational approach to enable cloud adoption and operation. Overall, the survey highlights the prevalence of a multi-cloud operating model in the financial services industry and its delivery of meaningful business value.

HashiCorp's Boundary 0.13 introduces a new LDAP auth method that enables organizations to integrate their directories directly with Boundary via the LDAP protocol, allowing users to delegate authentication to an LDAP directory and create new LDAP accounts when a user successfully authenticates. The feature is designed to align with Vault's LDAP capabilities and configuration parameters, making it easier for administrators to manage identities and groups across multiple systems. With this new feature, organizations can automate the process of creating and managing user accounts in Boundary, reducing manual effort and improving security.

A successful transition from engineering to developer advocacy or technical pre-sales requires a combination of soft skills, including public speaking, building empathy with one's audience, and finding the right approach to share knowledge. To craft an effective abstract for a conference call for papers (CFP), it is essential to carefully read the conference's CFP, identify the target audience and suggested topics, and choose a problem or experience that can be confidently shared. The abstract should present the problem, describe the solution, and highlight the benefits of the proposed talk, while also being concise and free from sales pitches unless specifically requested by the conference. A well-written title that captures the essence of the talk in 50 characters or less is also crucial, and having a trusted advisor review the abstract for technical accuracy can make all the difference.

The Terraform Cloud/Enterprise provider allows coordination of apply and destroy commands on downstream workspaces in Terraform Cloud, enabling the creation of complex workflows with multiple interdependent workspaces. This is achieved using the `tfe_workspace_run` resource, which can be configured to fire-and-forget or wait for completion, allowing for conditional applies and destroys. The resource provides more fine-grained control over workspace dependencies, enabling the creation of a web of dependencies between workspaces. By introducing a separate workspace runner, concurrency issues are avoided, making it easier to manage complex workflows. This pattern is useful when creating new workspaces or managing existing ones with multiple dependencies, and can be used in conjunction with run triggers for simpler use cases. The `tfe_workspace_run` resource is now an official part of the Terraform Cloud/Enterprise provider and is being improved by HashiCorp based on user feedback.

Minikube allows the creation of multiple Kubernetes clusters in a local development environment, enabling testing of Consul's cluster peering configurations. To set up Consul and mesh gateways for cluster peering, users must create a network with an IP address range, start Minikube with MetalLB, install Consul to the consul namespace, configure mesh gateways, peer clusters, and connect services between them. This setup allows testing of traffic between services across multiple Consul datacenters on different Kubernetes clusters before applying changes to production environments. The process involves creating a Docker bridge network, attaching each Minikube virtual machine to it, setting up MetalLB with IP address ranges, configuring Consul's proxies, and peering clusters. Users can run integration tests for services connecting across multiple Consul datacenters and Kubernetes clusters using this local testing environment.

The 2023 State of Cloud Strategy Survey, conducted by HashiCorp and Forrester Consulting, reveals that organizations with higher cloud maturity levels are more likely to derive better business outcomes from their cloud efforts. High-maturity companies are more committed to using operational best practices, which leads to increased security, compliance, and availability, as well as improved talent attraction and retention. These organizations also tend to use multi-cloud strategies more effectively, reducing waste and increasing cost savings. The survey found that high-maturity respondents were more likely to report increases in cloud spending, while low-maturity companies struggled with over-provisioning resources, idle or underused resources, and lack of needed skills. Overall, the survey suggests that operational best practices are key to unlocking the full potential of cloud adoption.