Devoteam, a valued HashiCorp partner, was invited to HashiDays London, one of HashiCorp’s two flagship annual events. The day was packed with announcements, including a keynote address hosted by HashiCorp CTO Armon Dadgar, followed by customer testimonials.
HCP Vault Radar
HCP Vault Radar is now generally available, as announced a few days ago on April 30th. For those unfamiliar, it’s a SaaS tool that finds cleartext secrets in your environment. It helps discover, assess, and integrate these secrets into Vault or other managers, particularly useful for lift & shift migrations, multi-cloud deployments, and interconnected SaaS solutions.
Getting started is easy: choose a cloud source (Azure DevOps Cloud is coming soon!) or manually install an agent.
Here is the workflow:
- Secret Scanning
- Entropy and randomness
- Reduced false positives
- Notification workflows
Leaving aside the broader overview of the tool, I wish to emphasise a singular, novel functionality: a button designed to extract an unmanaged secret located directly within Vault, utilising the KV v2 engine. This addition significantly enhances workflow automation and is, therefore, highly beneficial.
My opinion:
Vault Radar really shines when you need to lock down secrets across your whole system. If it’s just Github you’re worried about, honestly, there are plenty of free, open-source options that’ll get the job done. Where Vault Radar stands out is its ability to connect with all those other tools that often get overlooked—like Jira, Confluence, and even your messaging platforms. The automatic fixes are a huge win too, way better than just getting a report. That’s key for any serious business.
And the price? It’s $7 per user monthly (keep in mind, that’s based on the sources being scanned).
Vault Enterprise
HashiCorp presented a review of recent feature introductions, specifically those incorporated in version 1.19, rather than announcing any major updates. Key among these was the implementation of automatic root credential rotation for various plugins, including AWS, Azure, Google Cloud, LDAP authentication methods, and databases. This development addresses the previously manual requirement for rotating static plugin credentials.
Other new features:
- PKI – Certification Authorities (CA): Allows you to create CAs that issue certificates limited by parameters (domain names, URIs, IP addresses).
- Securing AppRole Data with KMS or HSM (Seal Wrap): Adds “seal wrap” for AppRole data, supporting FIPS 140-2 Level 2 standards for HSMs.
- Post-Quantum Cryptography (PQC): Introduced experimental support for NIST-approved PQC algorithms, starting with the Transit secrets engine.
Is your infrastructure running on AWS? Vault now supports custom DNS.
My opinion:
Vault is now a very mature product and is becoming a must-have for managing secrets if you are on a closely linked multi-cloud or on-premise environment.
At the Red Hat Summit 2025, held recently, an announcement was made regarding the integration of Vault with OpenShift. This will be further elaborated upon at the conclusion of this article.
Boundary
Waypoint, while nearing five years in maturity, remains a valuable tool within the HashiCorp ecosystem. It facilitates secure remote access, streamlines end-user connectivity, and enhances regulatory compliance through centralised auditing.
The primary announcement was the General Availability of Transparent Sessions. The Boundary installer now deploys a client agent that functions as a local DNS resolver. Upon successful authentication with Boundary, users can employ standard client tools, such as SSH, RDP, or web browsers, utilising aliases. These aliases, which are human-readable names associated with specific targets, replace IP addresses. The client agent intercepts these connections and routes them via the Boundary worker. The demonstration was noteworthy, requiring minimal administrative configuration for target confirmation and providing a seamless and simplified user experience.
My opinion:
I haven’t gotten to try this tool out in real-world scenarios since it’s not really aimed at me. It’s built for multi-cloud environments, like other HashiCorp tools. You connect via command line to a machine, but honestly, working almost exclusively on AWS, I can do the same thing with Session Manager in one click. So, it’s not particularly useful for my needs, especially since I work mostly with Serverless.
Consul
Version 1.21 goes to GA, 2 major new features:
- Simplified deployment architecture for Consul External Service Monitor (ESM) : This enables discovery of external services where a Consul agent cannot be installed (e.g., SaaS services like Amazon RDS). ESM performs periodic checks.
- Consul Kubernetes Snapshots to Google Cloud (GCP) : Consul on Kubernetes allows you to take snapshots of the Consul server configuration for disaster recovery.
My opinion:
This is not my field at all, I will let you judge for yourself or with your colleagues over a coffee.
Terraform
In summary, HashiCorp provides an enterprise offering that is increasingly compelling and valuable. Prior to discussing the enterprise edition, it is pertinent to examine the Community edition. Terraform is a stable and largely mature product. Thus, major feature announcements are not anticipated regularly. Recent emphasis has been placed on the previously introduced features of Ephemeral Values and Resources, which were implemented in Terraform 1.10 for values and 1.11 for resources, respectively.
If you want to know more, I invite you to read this article: https://mattias.engineer/blog/2024/terraform-ephemeral-resources/
Just got a small update for Terraform Stack (still beta) that’s pretty handy – you can now link stacks using outputs. Definitely worth checking out on smaller projects, as it might just take over from Terragrunt eventually.
Terraform Enterprise Premium
For the enterprise side, there’s a new feature: Terraform Enterprise Premium.
Terraform’s strategic focus is evidently directed towards enterprises with extensive, multi-cloud, or hybrid environments facing network constraints. The forthcoming plan will feature enhanced Agents designed to operate comprehensively within partitioned ecosystems, encompassing on-premise Version Control Systems, local Sentinel/OPA deployments, and private run tasks. Integrated management of the module lifecycle will include module revocation, visibility on module usage via HCP Terraform Explorer, change communication through deprecation/revocation notifications, and the creation of change requests within the platform, as demonstrated in a recent presentation.
The current offering comprises three Terraform Enterprise plans, enabling clients to select and procure only pertinent features. HashiCorp has improved transparency regarding public pricing, eliminating the requirement for sales representative engagement. The pay-as-you-go plan can now be initiated directly through user accounts. Current pricing is structured as follows: $0.10 per resource for the standard version, $0.47 per resource for the Plus version, and $0.99 per resource for the Premium version. Platform users can now view a projected monthly cost estimate based on their usage.
Another announcement, the arrival of Pre-written Sentinel Policies in GA for AWS.
My opinion:
Clarity regarding pricing is now significantly improved, and there is a concerted effort in this area, albeit without explicit announcements. The lifecycle management feature for modules is particularly advantageous, as this aspect is often neglected by clients, leading to organisational issues with numerous module repositories and unclear version usage. A common problem is the lack of centralisation, resulting in the proliferation of multiple versions of similar modules, which is both time-consuming and costly. While comparable functionality can theoretically be achieved with robust CI/CD and governance, HashiCorp’s current offering stands out for its comprehensiveness. Furthermore, Terraform Stacks presents another compelling feature worthy of detailed examination.
Another piece of news, at the Red Hat Summit 2025, an announcement was made regarding the integration of Terraform and Ansible.
HCP Waypoint
When I discuss Waypoint with colleagues or clients, they often don’t understand the tool. It’s worth noting that some time ago, HashiCorp completely changed course regarding this tool. Simply put, it’s an Internal Developer Platform (IDP) tool.
The official announcement states that actions are transitioning to General Availability (GA). The intended function of actions is to facilitate the management of post-deployment application scenarios, specifically those categorised as “Day 2” and “Day 2+”, which occur following the initial provisioning through templates and add-ons.
My opinion:
It’s a superb tool, but it’s arriving too late compared to other competitors (Backstage, etc.). An undeniable advantage is that it integrates perfectly with the HashiCorp ecosystem, especially Terraform. However, I still have a lot of trouble seeing it in a mature enterprise environment, especially on a large scale.
HashiCorp x IBM
Despite a keynote heavily focused on HashiCorp, some synergies are beginning to emerge. Armon Dadgar (CTO of HashiCorp) humorously announced support for IBM infrastructure, a bit niche, but it’s available:
Nothing concrete yet with RedHat tools but the roadmap seems clear on their side and we should have announcements soon.
Other news worth a look
- Introducing HashiCorp Validated Patterns for product use cases
- Terraform AWS provider tops 4 billion downloads, 6.0 now in public beta
The recent HashiDays event in London featured no significant developments or groundbreaking announcements. HashiCorp is likely reserving major updates for HashiConf, scheduled to occur in San Francisco within the coming months.
Understanding HashiCorp’s roadmap is vital for organisations implementing a hybrid cloud strategy, which balances the flexibility of public clouds with the control of private infrastructure.