IBM HashiCorp

What is HashiCorp?

HashiCorp is a company that created popular DevOps tools - Terraform, Vault, Consul, Boundary. In 2024, IBM acquired HashiCorp. Products are open source (free) + paid Enterprise versions with additional features.

Four main products:

1. Terraform - “infrastructure as code” - you create servers, networks, databases by writing configuration files instead of clicking in console
2. Vault - secure storage of passwords, API keys, certificates
3. Consul - service discovery and service mesh for microservices
4. Boundary - Zero Trust server access (instead of VPN)

Terraform - Infrastructure as Code

What is it?

Instead of manually clicking in AWS/Azure/you write a file describing what you want:

# Example: create EC2 server in AWS
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"

  tags = {
    Name = "web-server-prod"
  }
}

Then terraform apply - and server exists. Want 10 servers? Change one line.

Why?

• Repeatability - dev, staging, prod environments from same code
• Version control - infrastructure in Git, code review, change history
• Automation - CI/CD for infrastructure
• Documentation - code = documentation (you know what you have)

Terraform vs manual clicking

Aspect	Manual	Terraform
Creating 50 servers	Hours of clicking	Minute (change count = 50)
“What do we have in AWS?”	Need to check	Visible in code
Recovery after failure	Remember how?	terraform apply
Test environment	Built from scratch	Code copy with different variables

Open Source vs Enterprise

Feature	OSS (free)	Enterprise
Basic IaC	Yes	Yes
State in cloud	No (local/S3 manual)	Yes (Terraform Cloud)
Policies (Sentinel)	No	Yes
SSO/RBAC	No	Yes
Private module registry	No	Yes

Vault - Secrets Management

What is it?

Vault is a safe for passwords, API keys, certificates. Instead of keeping passwords in .env files or in code, applications retrieve them from Vault.

Problem it solves

# Typical problem:
.env file:
  DB_PASSWORD=supersecret123
  AWS_KEY=AKIA...

# Is this file in Git? On server? Who has access?
# How to change password without restart?
# Who used this password?

How does Vault work?

[Application] → "Need database password" → [Vault] → "Here's password (valid 1h)"
                                              ↓
                                        Logging who, when, what

Key features:

• Dynamic secrets - Vault creates password “on demand”, valid e.g. 1 hour
• Encryption as a service - encrypt data via Vault API
• PKI - automatic TLS certificate generation
• Audit log - who, when retrieved which secret

Vault vs keeping passwords in files

Aspect	.env files	Vault
Who has access	Everyone with file	Controlled (RBAC)
Password rotation	Manual, restart	Automatic
Audit	None	Full log
Dynamic secrets	No	Yes

Consul - Service Discovery and Mesh

What is it?

In microservices environment: “Where is payment service?”. Consul answers: “At 10.0.1.15:8080, is healthy”.

Service Discovery

[Order Service] → "Where is Payment Service?"
        ↓
    [Consul]
        ↓
"Payment Service is at 10.0.1.15:8080 and 10.0.1.16:8080"

Service Mesh

Consul can also encrypt communication between services (mTLS) and control who can talk to whom.

[Service A] ←─ mTLS encrypted ─→ [Service B]
                    ↑
              [Consul Mesh]

When Consul?

• You have >10 microservices
• You need service discovery (not hardcoded IPs)
• You want mTLS between services
• Multi-datacenter

Boundary - Zero Trust Access

What is it?

Boundary is modern alternative to VPN for administrative access. Instead of “connect VPN and access everything”, Boundary gives access to specific servers based on identity.

How does it work?

[Admin] → "Want to connect to prod-db-01"
    ↓
[Boundary] → Checks: Who? Can they? What time?
    ↓
"OK, here's SSH session to prod-db-01 (recording)"

Boundary vs VPN

Aspect	Traditional VPN	Boundary
Access	To entire network	To specific server
Authentication	VPN credentials	SSO/MFA
Session recording	No	Yes
Just-in-time access	No	Yes

For whom?

HashiCorp makes sense when:

• DevOps/Platform team - Terraform is industry standard
• Microservices - Consul for service mesh
• Compliance/Security - Vault for secrets, audit

• 50 servers - automation pays off

HashiCorp does NOT make sense when:

• Small infrastructure (<10 servers) - overhead may be too large
• No DevOps - requires skills

How much does it cost?

Open Source (free):

• Terraform CLI - full core functionality
• Vault - full core functionality
• Consul - full core functionality

Enterprise/Cloud:

Product	Model	Approximate price
Terraform Cloud	Per user/month	From $20/user
Vault Enterprise	Per node	From $50K/year
Consul Enterprise	Per node	From $40K/year
HCP (managed)	Usage-based	Pay-as-you-go

Specifications

Products	Terraform, Vault, Consul, Boundary
Deployment	Self-managed or HCP (SaaS)
Platforms	Linux, Windows, MacOS, Kubernetes
Integrations	AWS, Azure, GCP, Kubernetes
OSS License	BSL (Business Source License)

FAQ

Is Terraform free? Yes. Terraform CLI is free. Terraform Cloud/Enterprise are paid add-ons (state management, policies, SSO).

Do I have to use all products? No. You can use only Terraform, only Vault, or any combination.

What changed after IBM acquisition? Not much yet. Products work the same. IBM announced Cloud Pak integration.

Does HashiCorp work with AWS/Azure/GCP? Yes. Terraform has 3000+ providers. Vault integrates with AWS IAM, Azure AD, GCP.

What is HCP? HashiCorp Cloud Platform - managed versions of Vault, Consul, Boundary. IBM hosts, you use.

Is Vault secure? Yes. Used by banks, fintech, healthcare. SOC 2, HIPAA compliance.

How long does Terraform deployment take? First environment: days. Migrating entire infrastructure: months.

Does nFlo deploy HashiCorp? Yes. Terraform for IaC, Vault for secrets, Consul for service mesh. Training, best practices.