## HashiCorp Vault
A major innovation regarding Vault is [HCP Vault Secrets](https://www.hashicorp.com/blog/announcing-hcp-vault-secrets-public-beta), which is currently in **public beta**.
In essence, this new feature allows:
- **Simple and centralized storage of secrets**: The goal is to view the solution as a "keyring SaaS".
- **Centralizing secrets between HCP Vault Secrets and cloud providers/machines**: Currently, the solution only supports[AWS Secret Manager](https://developer.hashicorp.com/hcp/docs/vault-secrets/integrations/aws-secrets-manager), but support for others is coming soon.
- **Accessibility via an API or CLI**: With a focus on providing "Developer Flexibility," an API is available to retrieve a secret using Curl, Terraform (via the Vault provider), a [dedicated CLI for Vault Secrets (called **vlt**)](https://developer.hashicorp.com/hcp/docs/vault-secrets/commands), or an SDK. In terms of SDK, the community wasted no time, as a [GO SDK](https://github.com/ssbostan/vault-secrets-sdk-go) has already been developed.
To top it all off, **HCP Vault Secrets** is [free during the **public beta**](https://www.hashicorp.com/cloud). It's a great opportunity to test the product for yourself.
Another innovation for Kubernetes users, which was released a few months ago but highlighted during HashiDays as a GA (Global Availability) announcement, is the [**Vault Secrets Operator**](https://www.hashicorp.com/blog/vault-secrets-operator-for-kubernetes-now-ga). This integration allows seamless synchronization with all Vault secret types.
For those interested in understanding the differences and comparing it with other methods, you can refer to [HashiCorp's blog post on Kubernetes integrations with Vault](https://www.hashicorp.com/blog/kubernetes-vault-integration-via-sidecar-agent-injector-vs-csi-provider).
For more information:
- [HCP Vault Secrets news](https://www.hashicorp.com/blog/announcing-hcp-vault-secrets-public-beta)
- [Synchronization between HCP Vault Secrets and AWS Secrets Manager](https://developer.hashicorp.com/hcp/docs/vault-secrets/integrations/aws-secrets-manager)
- [Vault Secrets Operator](https://www.hashicorp.com/blog/vault-secrets-operator-for-kubernetes-now-ga)
## HashiCorp Boundary
**HashiCorp Boundary 0.13** has been released! Among the new features, some are accessible through the Open Source version, while others are available via HCP.
For the Open Source version, we have:
- **LDAP authentication method (beta)**
- **OIDC authentication improvements**: The CLI can display the authentication URL so that it can be continued on another device (especially for devices without a web browser).
- **Shared KMS workers**: The use of one or multiple KMS to register downstreams across multiple networks.
- **Static ports for targets**
- **Dynamic host catalog external name**
On the Enterprise side:
- **Boundary Enterprise version**: The ability to deploy an Enterprise version of HashiCorp Boundary in a self-hosted environment. It includes most of the features of HCP Boundary but not all (e.g., automated updates, streaming of audit logs, etc.). You can see the [difference between HCP Boundary and the enterprise version on the pricing page](https://www.hashicorp.com/products/boundary/pricing).
- **SSH session recording**: Records all commands in a session and stores the recording as a GIF. Currently, this feature only supports SSH and stores the recording in an AWS S3 bucket. It's worth noting that the Boundary worker sends the file (along with the integrity file) to the S3 bucket ONLY when the session ends. One improvement to note from my testing is that access to the AWS S3 bucket is currently done via [static Access Key & Secret Key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). We hope to see integration soon with AWS Role or other more [dynamic access methods](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). In terms of pricing, this new feature introduces the **HCP Plus** offering at $0.90 per session (compared to the **HCP Standard** offering at $0.50).
- **HCP Boundary maintenance window**: You can now choose a maintenance window to update your Boundary (for patching or upgrading to a major version).
For more information:
- [Boundary v0.13 blog post release](https://www.hashicorp.com/blog/boundary-0-13-introduces-ssh-session-recording-boundary-enterprise-and-more)
- [The changelog for the v0.13](https://developer.hashicorp.com/boundary/docs/release-notes/v0_13_0)
- [HashiCorp Boundary pricing & feature difference](https://www.hashicorp.com/products/boundary/pricing)
## HashiCorp Consul
On the Consul side, the new features are divided into two parts, with **HCP Consul Management Plane** and **Consul v1.16 in BETA**.
For **HCP Consul Management Plane**, we have two featured components:
- **Cloud-based observability (beta)**: Focused on three key elements: Telemetry extraction, Metrics storage & Visualizations. It provides a global view across multiple environments, services, and overall health status.
- **Cluster peering (GA)**: Simplifies cross-cluster connectivity through the HCP interface, supporting both HCP and self-managed clusters.
On the other hand, with **Consul v1.16** still in BETA, we have:
- **Sameness groups (Consul Enterprise)**: Enables failover between a service distributed across multiple clusters/partitions.
- **Enhanced control plane protection (Consul Enterprise)**: Adds rate limiting based on IP address.
- **FIPS 140-2 compliant (Consul Enterprise)**: Built to comply with [FIPS 140-2 Level 1](https://en.wikipedia.org/wiki/FIPS_140-2) standards.
- **JWT auth for service-to-service traffic**: Consul service intentions can now authorize JWT (Json Web Token) claims.
- **Transparent proxy for failover and virtual services**: Introduces a [transparent proxy](https://developer.hashicorp.com/consul/docs/connect/transparent-proxy) mode.
- **Permissive mTLS**: When enabling mTLS (Mutual TLS), Consul previously required ALL communications to be secured with mTLS. With **Permissive mTLS**, the transition to mTLS can be made without requiring all communications to use mTLS.
- **Simplified API Gateway installation for Consul on Kubernetes**
- **External AuthZ Envoy extension**: Allows the use of an [external Envoy](https://developer.hashicorp.com/consul/docs/connect/proxies/envoy-extensions) to filter authorizations on TCP and HTTP listeners.
- **Property override Envoy extension**
- **Wasm Envoy extension**: Enables the use of the [WebAssembly (Wasm)](https://istio.io/latest/blog/2020/wasm-announce/) extension for TCP and HTTP listeners via Envoy.
- **Catalog sync support for health checks and ingress**
For more information:
- [HCP Consul Management Plane](https://www.hashicorp.com/blog/announcing-hcp-consul-management-plane-with-cloud-based-observability)
- [Consul v1.16 (Beta)](https://www.hashicorp.com/blog/consul-1-16-enhances-service-mesh-reliability-user-experience-and-security)
## HashiCorp Terraform
To conclude the wave of new features, we end with HashiCorp Terraform.
In a similar fashion to Consul, the new features are divided into two parts: **Terraform Cloud** and **Terraform v1.5**.
Let's start with the exciting new features in **Terraform v1.5**:
- **Config-driven import**: THE long-awaited feature of [**importing resources with automatic code generation by Terraform**](https://developer.hashicorp.com/terraform/language/import) has arrived. The process consists of two steps:
1. Create the target resource and an `import {}` block:
```hcl
import {
id = "i-abcd1234"
to = aws_instance.example
}
resource "aws_instance" "example" {
name = "test"
}
```
Here, `id` represents the `ID` of the existing resource, and `to` indicates the Terraform resource to be generated.
2. You can then run your `plan` and/or `apply` to view and/or generate the resource in Terraform with its attributes. Unlike the `terraform import` command, the use of the block is `idempotent`, making it easy to remove the configuration if desired.
Warning
Caution with imports: Imports bring in all attributes, and some may conflict.
> What about the talks?
The talks were organized into four phases:
1. Keynote (morning)
2. Deep Dive sessions on the new features (morning/noon)
3. Experience-sharing talks (early afternoon)
4. Learning sessions with demonstrations/labs to reproduce (late afternoon)
Overall, the program was good with regular breaks. However, it lacked a second track to choose topics based on individual preferences, and more dedicated time in small groups for the **Learning sessions** for those who wanted to follow along the demonstration (as the pace was very fast, and it was difficult to ask questions during the demonstration).
> Final thoughts?
For those who are new to HashiCorp products, considering the Pro or Enterprise offerings, and looking to discuss with experts on the subject, HashiDays is the ideal place to be. However, for those who already have advanced knowledge of HashiCorp products and mainly focus on open-source offerings, you may be generally less satisfied, except for the networking time and a few talks.
To wrap up, here are a few bonuses:
- [HashiCorp Twitch](https://www.twitch.tv/hashicorplive)
- [Communauté HashiCorp](https://www.hashicorp.com/community)
- [HashiCorp Learn](https://learn.hashicorp.com/)
---
Originally published at https://mehdilaruelle.com/posts/2023/06/back-to-hashidays-paris-2023/