July 2024 Summaries

The HashiCorp Nomad team has introduced new metrics to better capture the performance of their workload orchestrator in its latest release. These metrics focus on throughput, response time, and latency, which are essential elements for understanding systems performance. By analyzing these factors, users can identify bottlenecks and optimize their cluster operations. The new metrics aim to make it easier for operators to understand the performance of Nomad servers and provide a foundation for future improvements in client performance analysis.

The HashiCorp Terraform extension for Visual Studio Code has released new versions that significantly reduce memory usage and startup time for large workspaces. Version 0.34 of the HashiCorp Terraform language server, bundled with version 2.32 of the Terraform extension for Visual Studio Code, introduces parallel loading of Terraform language constructs, enabling instantaneous autocompletion. This update brings a significant reduction (up to 99.75%) in memory usage and startup time when opening workspaces.

Vault-backed dynamic credentials provide a secure method for managing HCP Terraform infrastructure by auto-generating and revoking secrets/credentials when they are no longer needed. This approach reduces the likelihood of secrets leakage and sprawl, as well as offers several advantages over using only dynamic provider credentials without Vault, such as consolidated management and auditing, no OIDC setup required in cloud providers, leveraging Vault secrets engine configurations, and protected inbound access. By adopting HashiCorp Vault as a secrets manager, users can store their secrets securely and centrally, eliminating the need to hardcode them within Terraform configurations.

Boundary is a modern privileged access management (PAM) platform that enhances infrastructure security while simplifying access to infrastructure resources for end users. It integrates with Microsoft Privileged Identity Management (PIM) for temporary access based on request and approval workflows, allowing organizations to continue using existing standard practices and workflows for approvals. The just-in-time approval workflow ensures that certain privileged roles are restricted until a request and approval have been issued, and approved roles can be limited to a temporary time period. This automated process reduces the need for administrators to manually make configuration changes each time elevated permissions are requested or expired.

HashiCorp's HCP Terraform has added granular API access for audit trails, eliminating the need to rely on organization permissions to the audit trails endpoint. This new feature enables organization owners to generate a dedicated API key for least-privilege access to audit trails. The read-only permission to the HCP Terraform audit trails endpoint allows organization administrators to review actions performed by members of their organization, including details such as who performed the action, what the action was, and when it was performed. This improvement simplifies and enhances privilege management within organizations by adhering to the principle of least privilege access and incorporating token expiration for complete control over the token's lifecycle.

The HashiCorp Principle Awards recognize employees who embody the company's nine principles. In 2024, the awards program was updated to celebrate team-based achievements. The winning team was Madrid Tech Hub Opening, which involved over 40 people from various teams working together to establish a new location in Madrid. The finalists included Team Infrastructure Cloud Launch and Team Accessibility Remediation for a Multinational Financial Services Company. These projects exemplified HashiCorp's principles of Integrity, Kindness, Pragmatism, Humility, Vision, Execution, Communication, Beauty Works Better, and Reflection.

Nomad Bench is an open-source tool designed to load test and benchmark HashiCorp's Nomad, a simple and highly scalable cluster manager. It provides reusable infrastructure automation for running large-scale test scenarios on clusters at scale, enabling users to better understand how Nomad scales and uncover problems that only appear in large cluster deployments. The nomad-bench project consists of two main components: the core cluster and the test cluster. Data collection is facilitated by InfluxDB, which allows for real-time data analysis and monitoring via dashboards. nomad-nodesim is a lightweight tool used to simulate and run hundreds of processes per application instance, allowing users to simulate thousands of Nomad clients without having to stand up thousands of real hosts. The team validated the performance of nomad-nodesim by running experiments with both real and simulated clients, confirming that it performs similarly to real clients.

This post discusses strategies for assertions and validations using a custom Terraform provider, Assert. The Assert provider offers a rich set of assertion capabilities through provider-defined functions such as http_success(), expired(), and between(). These assertion functions simplify your Terraform configurations, making it easier to do variable validation, continuous validation, and testing. It also covers how to use these functions to validate input variables and other Terraform features that can make your configuration more robust. Additionally, the post explores continuous validation in HCP Terraform, which allows for proactive monitoring of workspace configurations or modules with assertions.

HashiCorp has introduced a new setting in Terraform that allows admins to control whether team members can manage their team's API token. This feature is now available for all tiers in HCP Terraform and will soon be added to Terraform Enterprise. The new setting helps organizations improve their security posture by limiting the exposure of team tokens, reducing operational risk when users leave the organization, and enabling admins to enforce least privilege principles in infrastructure workflows.

This post discusses the potential risks of using contextual data with large language models (LLMs) and demonstrates how HashiCorp Vault can integrate with Pinecone to tackle AI data security challenges. It highlights the complexity of securing retrieval-augmented generation (RAG) enhanced AI applications, as they fetch information from external sources to provide more accurate responses. The integration of diverse data sources increases the risk of data leakage and manipulation by malicious actors. To address these issues, HashiCorp Vault can be used to encrypt sensitive information before it is stored in Pinecone, ensuring that the data remains protected even if the vector database is compromised. The post also provides a step-by-step guide on how to integrate Vault into a RAG system using Pinecone and Terraform.

Boundary is a tool by HashiCorp that simplifies and secures remote access to systems and applications, providing administrators with fine-grained access control without the need for complex network configurations or exposure of sensitive credentials. It streamlines the process of granting and revoking access, making it easier for organizations to protect their critical infrastructure. Boundary differs from traditional solutions like jump-boxes, bastion hosts, or VPNs because it does not require any ingress firewall (NAT) rules or a bastion host (which also exposes the destination host). Instead, it only needs egress access to an upstream worker. The post demonstrates how to set up Boundary from scratch and configure a complete remote access workflow that even someone with no prior knowledge of Boundary can use. The tutorial uses HCP Boundary in order to get up and running faster than the on-premises versions, using code from the hcp-boundary-demo GitHub repository to provision Boundary and some Microsoft Azure infrastructure for the demo using HashiCorp Terraform. The post also discusses how to create an HCP Boundary cluster, deploy the infrastructure with Terraform, install self-managed workers, configure ingress and egress workers, create a target configuration, use transparent sessions (private beta), connect to Boundary from an end-user's perspective, and learn more about Boundary.

In HashiCorp Vault 1.17, custom metadata can now be created and submitted with the certificate signing request (CSR), automating the retention and association of metadata with issued certificates. This feature allows users to associate custom attributes with their PKI certificates beyond the standard data available on them. Custom metadata can be used for various purposes such as tracking business information, PKI administration, and operational information. The expiration date of the certificate is stored on the metadata entry itself, allowing automatic deletion once the certificate has expired or been revoked.

HCP Packer has introduced bucket-level RBAC, allowing users to manage access at the bucket level for enhanced security and permissions control. This feature enables organizations to mitigate security risks by practicing the principle of least privilege. With bucket-level RBAC, developers can create buckets within projects without needing full project access, while admins can assign specific permissions at the bucket level. This improvement allows sensitive golden images to remain protected from unauthorized modifications while giving developers self-service capabilities for agility and efficiency.

HashiCorp is currently hiring across India for roles such as site reliability engineers (SREs), engineering managers, and product managers. Trilok Ramakrishna, Director of Engineering at HashiCorp, leads the R&D engineering team in Bengaluru. He describes a typical day at the co-working space as a blend of structured meetings, informal interactions, and collaborative brainstorming sessions. His leadership style focuses on team empowerment, innovation, and continuous learning. Ramakrishna enjoys working at HashiCorp due to the opportunities for growth, innovation, and creating user-friendly solutions. He advises aspiring tech leaders to focus on continuous learning, embrace challenges, develop strong communication skills, and build diverse teams.

Forrester Consulting's recommendations following the 2024 HashiCorp State of Cloud Strategy Survey suggest organizations invest in cloud skills, cost optimization, AI, and more. The survey found only 8% of almost 1,200 global enterprise respondents qualified as highly cloud mature. Forrester recommends upskilling cloud teams, focusing on multi-cloud efforts, tackling wasted cloud spend with policies and tools, solidifying cloud security efforts, and experimenting with generative AI to help different parts of their cloud program. The study also highlights the need for investment in modernizing practices like infrastructure as code and addressing skills gaps by training employees in cloud, cybersecurity, and GenAI applications.

The Terraform AWS provider has surpassed three billion downloads, marking a significant milestone in its history. HashiCorp and AWS continue to collaborate on new integrations aimed at improving customer experience, speed, and functionality. These initiatives include the strategic collaboration agreement, Infrastructure Lifecycle Management (ILM) on AWS, and the AWSCC provider's general availability. The AWSCC provider enables developers to access new AWS services and supports new features and services right away.