August 2024 Summaries

Terraform Enterprise, a self-hosted distribution of HashiCorp's Terraform for customers with strict regulatory requirements, now supports deployment on two new application platforms: HashiCorp Nomad and Red Hat OpenShift. This adds to the existing options of Docker Engine, Amazon EKS, Microsoft AKS, Google GKE, and Podman. The latest release also introduces a migration service offering for customers still running Replicated-based installs, with support ending in November 2024.

This blog post outlines steps to drive the adoption of HashiCorp Vault within your internal developer community and sets the foundation for scaling secrets management over time. The process involves discovering existing applications and secrets, making a list of secret types, learning how the application retrieves and uses each secret, identifying how the application handles secret rotation, documenting availability requirements for the application, deciding on developer access to Vault, building an application landing zone, migrating secrets, updating the application, and organizing internal developer advocacy. The goal is to encourage widespread adoption of Vault within your organization while helping developers through their migration process.

HashiCorp has released version 6.0 of its Terraform Google Cloud provider, which includes updates to default labels for improved usability. The new release also introduces provider-defined functions and a default attribution label that helps users track resources created by Terraform. Additionally, the upgrade guide provides information on behavior changes and removed properties.

Secure remediation of insecure secrets is crucial to prevent downtime or breaches. The common challenges in secrets management arise from the lack of control over secret usage by SecOps teams, and the need for developers to manage high-value secrets using secret management vaults. Modern cloud security practices encourage organizations to audit code closely and require developers to manage secrets securely using secret management vaults. A standard framework for secret discovery and remediation includes a discovery and notification workflow, proactive and reactive remediation workflows, and key tasks such as assessing the impact of changing the secret, revoking, rotating, deleting, and tracking the lifecycle of a secret. HCP Vault Radar is one tool that supports the full best-practices workflow for secret discovery and remediation.

HashiCorp has released version 4.0 of its Terraform AzureRM provider, which includes support for provider-defined functions and improved resource provider registration. The new release also adds two Azure-specific provider functions to help users correct the casing of their resource IDs or access individual components of it. Additionally, users now have more control over which providers to automatically register or whether to continue managing a subscription's resource provider registrations outside of Terraform.

During the development of Nomad's 1.8 LTS release, a benchmarking infrastructure was created to test performance and find areas for improvement in efficiency. The focus of this article is on Nomad's internal garbage collection process and an optimization discovered during the project. Nomad garbage collection applies to evaluations, nodes, jobs, deployments, and plugins, and can be configured by users. When a Nomad server becomes a leader, it starts periodic garbage collection "tickers" that clean objects marked for garbage collection from memory. An interesting example is job deregistration, whereby users issue a stop command or API call, but information about the stopped job remains in memory until job_gc_interval time passes. The optimization involved removing the loop and code that creates evaluations when garbage collecting a job, reducing both Raft and eval broker load. This change resulted in higher throughput, greater stability, and minor improvements in CPU and memory consumption.

HCP Packer now supports tracking CI/CD pipeline metadata, allowing users to see which tools were used in the image-building process through integrations with GitHub and GitLab. This enhancement helps lay the foundation for a secure build pipeline and grants HCP Packer level 1 compliance with SLSA (Supply-Chain Levels for Software Artifacts). The addition of pipeline metadata tracking improves build visibility, providing critical CI/CD information such as pipeline IDs, job names, details on the operating system, VCS commits, and more. This helps organizations make risk-based security decisions and shift their security left in the infrastructure deployment process.

HashiCorp has released Boundary 0.17, which enhances management of tags and roles, improves worker failure detection, and adds more storage options for session recordings. The latest version simplifies the management experience for administrators and end users while offering increased flexibility for customers to use their preferred S3-compatible storage solutions. Boundary is a modern privilege access management solution that streamlines and secures remote user access in any cloud or on-premises environment.