September 2023 Summaries

Streamlined run task reviews provide meaningful context on run task evaluations in Terraform Cloud, allowing practitioners to resolve issues faster without leaving the platform. This feature integrates third-party tools and services within the workspace, enabling users to perform various operations such as managing cost, security, compliance, or enhancing workflows with custom logic. Streamlined run task reviews are now available for use with the Palo Alto Prisma Cloud run task in Terraform Cloud, providing critical information that accelerates evaluation and resolves issues more efficiently. The feature addresses a common challenge faced by Terraform practitioners, where they lack access to external URLs for run task evaluations due to restricted third-party tools and services in large organizations. Streamlined run task reviews improve the review process by presenting detailed information in a structured format, enabling users to quickly identify resource violations, understand severity, and remediate their Terraform configuration without leaving the app.

HashiCorp has released Vault 1.15, a version that focuses on core secrets workflows and team integrations. This update includes several key features, such as fine-grained control over issued certificates using custom policies, a new landing page dashboard for better overview of a Vault instance, and improved LDAP UI. Additionally, the release supports Workload Identity authentication method in Microsoft Azure Kubernetes Service (AKS), connects Vault secrets directly into native Kubernetes secrets, enables enterprise customers to use independent seals retained in multiple KMS providers, and introduces an event monitoring beta feature that builds on the previous alpha release. The update also includes new features for HCP Vault Secrets management, such as one-way synchronization of KV v2 secrets with external destinations.

This new feature enables users to update the module version used in their no-code workspaces without having to destroy and redeploy their infrastructure, providing a seamless experience for stakeholders who need infrastructure updates. The updated no-code provisioning workflow allows administrators or module owners to upgrade the designated no-code ready version of a module, triggering notifications in downstream workspaces that use the module, making it easier for developers to keep their no-code workspaces up-to-date without requiring Terraform expertise.

The GitOps workflow using Argo CD enables the deployment and synchronization of a Consul cluster on Kubernetes, ensuring that version control remains the primary source of truth for Consul cluster and service mesh configuration. This approach allows for consistent deployment of configuration across different Consul clusters, clouds, and environments, standardizing management of Consul across multiple Kubernetes clusters. Automation with Argo CD hooks and sync waves facilitates synchronization of Consul resources on Kubernetes, coordination of changes to different resources, and upgrade of Consul servers and components. By using a GitOps tool like Argo CD, developers can centralize the automation, installation, and configuration of services onto multiple Kubernetes clusters, reducing manual effort and increasing consistency across environments.

HashiCorp has seen success with its internship program, with returning interns citing the benefits of working at the same company twice, including familiarity with colleagues and processes, improved onboarding experience, and the ability to continue building relationships established during their first summer. Many interns reported that returning for a second summer allowed them to explore different aspects of the company, develop new skills, and gain valuable work experience. The program's flexibility and opportunities for growth and development were also highlighted as key factors in the interns' decision to return. Overall, HashiCorp's internship program appears to offer a unique and beneficial experience for students looking to launch or advance their careers.

ACME protocol is a powerful tool in public key infrastructure (PKI) to automate certificate lifecycle management, solving common problems such as manual tracking and security issues associated with traditional methods of managing certificates. By leveraging ACME, organizations can improve their security posture, reduce the risk of system outages caused by human error, and easily switch between Certificate Authorities. HashiCorp Vault is a popular platform that supports the ACME protocol, providing IT teams with automation tools to manage certificate needs, eliminating dependency on manual processes or alternate products. The adoption of ACME simplifies certificate management complexities for organizations, enabling them to focus on other critical tasks.

Terraform Enterprise has introduced two new deployment options for self-hosted environments, including cloud-managed Kubernetes services, allowing customers to standardize around consistent deployment patterns and reduce operational costs by focusing on a smaller scope of technologies. The new deployment options support Docker Engine and cloud-managed Kubernetes services, enabling customers to follow industry-standard patterns for deploying applications in these environments and simplify overall operation of Terraform Enterprise. This update also includes improvements such as faster startup times, simplified license management, and the introduction of a new admin CLI called `tfectl`, which provides a consistent administration experience across all new deployment options.

As of the next minor release, HashiCorp Packer will stop bundling official plugins within its binary releases, separating them from the core to allow for community-driven updates and management through manual installation or `packer init`. This change aims to improve maintenance and flexibility for users, while providing a transition period for critical plugins already used in existing workflows. The removal of bundled plugins will be completed with version 1.10, scheduled for November 2023, and users who manage external plugins via `packer init` or `packer plugins install` are not affected by these changes. The use of `required_plugins` blocks in HCL2 templates can help pin specific plugin versions to avoid issues during the transition.

The general availability of an organization-wide default execution mode in HashiCorp Terraform Cloud enables faster, more consistent, and scalable agent pool configuration at the organization level, replacing the previous manual workspace-level assignment process that was time-consuming, error-prone, and lacked scalability. This new feature streamlines the process to save time and improve effectiveness, reduces inconsistencies in agent pool configurations, simplifies management as the number of workspaces grows, and mitigates security risks by preconfiguring agent pool mappings. With this capability, users with organization owner permissions can specify a default agent pool for all future workspaces within their organization, while team members with workspace admin permissions can break the inheritance to meet specific requirements.

Creating a golden image pipeline can help unify and streamline imaging and provisioning workflows throughout an infrastructure estate in a multi-cloud world. This is achieved by implementing a centralized shared service for image creation and management workflows using Terraform Cloud with HCP Packer, which provides policy and governance, organization-wide visibility, ease of integration with peripheral technologies, and overall reliability at scale. A golden image acts as a template on top of which developers can build applications, containing common system packages, logging and monitoring tools, security patches, and configuration hardening. HCP Packer simplifies golden image creation by enabling organizations to leverage the HashiCorp Configuration Language (HCL) and templates that specify what plugins to use, how to configure them, and in what order to run them. With a golden image built, published, validated, and promoted to an organization's stable channel, Terraform can automatically reference the updated version for provisioning pipelines, automating image management across downstream builds and provisioning workflows. The pipeline also includes health assessments to detect configuration drift and continuous validation to ensure functional validations continue to pass over time, providing users with flexible options to validate their infrastructure uptime, health, and security in one place. Integrating HCP Packer's image management capabilities into existing Terraform Cloud workflows brings key benefits such as standardizing image versions, decreasing time to deployment, and automating image management.

This partnership between HashiCorp and Microsoft enables users to leverage Terraform to scale AI adoption in Azure environments. HashiCorp has created Terraform modules that follow Microsoft's Azure Well-Architected Framework and best practices, allowing users to deploy securely and cost-effectively. The modules cover the deployment of Azure OpenAI services, providing a repeatable way to accelerate AI initiatives and simplify the building of Azure services. Additionally, the partnership provides resources for understanding AI use cases and deploying them on Azure, as well as guidance on scaling AI adoption using Terraform. Microsoft's technical community has developed content that can help users understand AI use cases and provide code examples, while HashiCorp and Microsoft are working together to improve Terraform usability and velocity with new features such as a powerful testing framework. This enables organizations to create a repeatable pattern that accelerates their AI initiatives and simplifies the building of Azure services.

HashiCorp has announced new integrations with several companies to extend the security use cases for its Vault ecosystem, providing a solid foundation for customers to migrate and secure their infrastructure, applications, and data as they move to multi-cloud. The new integrations enable Vault as an external key management server using various protocols, such as KMIP, to provide encryption keys used by databases like EnterpriseDB's Postgres solutions and Oracle's database instances. Additionally, these integrations reduce credential sprawl for IoT devices and provide secure data backup and recovery with Veeam K10, while also enabling centralized machine identity management with Venafi and providing dynamic credential creation for YugabyteDB database users. The new integrations aim to resolve secrets sprawl and enhance the security lifecycle management capabilities of HashiCorp Vault.

HashiCorp has been named in the 2023 Gartner Magic Quadrant for Privileged Access Management (PAM), marking its debut in this market. The company's approach to PAM is based on five essential principles, focusing on identity-based controls in cloud-driven environments. HashiCorp's products, Vault and Boundary, offer a modern approach to PAM, combining authentication and authorization capabilities with secrets management and automated workflows. These solutions aim to provide customers with the capabilities they need, rather than complexity, and are designed to work seamlessly across all environments. The company is committed to enabling flexible deployments, optimizing DevOps workflows, and providing auditing and logging capabilities to support compliance and regulatory requirements.

The ServiceNow Service Catalog for Terraform has been updated to version 2.3, introducing features that enable Day 2 operations and provide more robust options for platform teams to update and redeploy existing Terraform infrastructure. The new catalog items and streamlined multi-instance integrations allow users to generate new Terraform workspaces and initiate resource provisioning from the ServiceNow interface. Additionally, this version addresses issues such as duplicate workspace names by appending a ServiceNow instance ID to ensure unique identification of every workspace. This update is available for both ServiceNow Terraform Cloud and Enterprise organizations, providing seamless operation across multiple instances.

The Packer Azure plugin has been updated to version 2.0.0, which provides a consistent foundation for managing Azure infrastructure by migrating from the deprecated Azure SDK. The new plugin addresses known deprecations with minimal disruption to users and introduces new features such as building Azure virtual hard disks, managed images, and Compute Gallery images. Users can now authenticate to Azure using an OIDC provider, allowing for more flexibility in their authentication setup. However, certificates encoded in .pem format are no longer recognized by the plugin, and VHD builds have been removed from the deprecation warning list. The plugin also includes changes to let it fail faster when creating image builds that won't succeed based on invalid shared image gallery version values. Users can report any issues or provide feedback through the Packer Azure plugin GitHub issue tracker.