HashiCorp: Terraform, Vault, and the Infrastructure Stack

HashiCorp is a software company that provides a suite of tools designed to automate the provisioning, securing, connecting, and running of infrastructure in multi-cloud and hybrid-cloud environments. Its products, most notably Terraform and Vault, have become standard components in modern DevOps and cloud engineering practices. The company's core philosophy centers on treating infrastructure with the same principles as software development, enabling teams to manage complex systems through code, APIs, and consistent workflows, regardless of the underlying cloud provider or on-premises data center.

At its heart, HashiCorp aims to solve the problem of infrastructure complexity that arose with the shift from monolithic, on-premises data centers to distributed, multi-provider cloud architectures. As organizations adopt services from Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and others simultaneously, they face disparate APIs, tools, and security models. HashiCorp provides a control plane that abstracts away these differences, offering a unified approach to managing the entire application delivery lifecycle. This allows engineering teams to use a consistent set of tools and practices, reducing operational overhead and accelerating development.

The HashiCorp Approach: Automating the Cloud Operating Model

HashiCorp frames its product suite as the foundation for a "Cloud Operating Model." This model breaks down the challenge of managing cloud infrastructure into four distinct but interconnected layers, each addressed by a core product: infrastructure, security, networking, and application. The goal is to move from manual, ticket-based processes to automated, self-service workflows for every stage of application deployment.

• Infrastructure Provisioning: Instead of manually clicking through a cloud provider's web console to create servers or databases, teams define the desired state of their infrastructure in configuration files. This is the domain of Infrastructure as Code (IaC), championed by HashiCorp's flagship product, Terraform.
• Security: In a dynamic cloud environment, traditional network perimeter security is insufficient. Applications and services need a way to securely access secrets like API keys, database credentials, and certificates. HashiCorp Vault provides a centralized system for managing this identity-based security.
• Networking: As applications are broken down into microservices, they need to discover and communicate with each other reliably across different networks and clouds. HashiCorp Consul addresses this with service discovery and service mesh capabilities.
• Application Runtime: Applications must be scheduled and deployed onto the provisioned infrastructure. HashiCorp Nomad is a workload orchestrator designed for this purpose, capable of deploying both containerized and non-containerized applications.

By providing tools for each of these layers, HashiCorp enables organizations to build a consistent, automated platform for delivering applications in any environment.

Company History and Milestones

HashiCorp was founded in 2012 by Mitchell Hashimoto and Armon Dadgar^[1]. The company was born out of their experiences with the complexities of application deployment and infrastructure management. Headquartered in San Francisco, California, HashiCorp has operated as a remote-first company for much of its existence.

The company's history is marked by the sequential release of its core open-source tools, each tackling a different aspect of the infrastructure lifecycle:

• Vagrant (2010): A precursor to HashiCorp, Mitchell Hashimoto created Vagrant to simplify the creation and management of virtual development environments. It became the first HashiCorp project.
• Packer (2013): An open-source tool for creating identical machine images for multiple platforms from a single source configuration.
• Serf (2013): A decentralized solution for service discovery and orchestration.
• Consul (2014): A more comprehensive tool for service discovery, configuration, and segmentation.
• Terraform (2014): The company's breakout product for building, changing, and versioning infrastructure safely and efficiently.
• Vault (2015): A tool for securely accessing secrets.
• Nomad (2015): A flexible workload orchestrator for deploying and managing applications.

HashiCorp held its initial public offering (IPO) on December 9, 2021^[2], trading on the Nasdaq stock exchange under the ticker symbol HCP. At the time of its IPO, the company was valued at approximately $14 billion.

A significant event in the company's history occurred in August 2023^[3], when HashiCorp announced it was changing the license for its core open-source products from the Mozilla Public License 2.0 (MPL 2.0) to the Business Source License 1.1 (BSL 1.1). This move, intended to protect the company's commercial interests from competitors, sparked significant controversy and led to the creation of an open-source fork of Terraform called OpenTofu.

The acquisition by IBM was completed in February 2025, integrating HashiCorp's automation tools into its broader portfolio, including Red Hat OpenShift.

Core Products

HashiCorp's product suite is designed to be used either independently or together to form a comprehensive platform. While the company offers several tools, Terraform and Vault are its most widely adopted and commercially significant products.

Infrastructure: Terraform

Terraform is an Infrastructure as Code (IaC) tool that allows users to define and provision data center infrastructure using a declarative configuration language known as HashiCorp Configuration Language (HCL). Instead of writing imperative scripts that detail the how of creating infrastructure, users declare the what, the desired end state of their resources.

How it Works:

1. Write: Users define infrastructure components (like virtual machines, networks, and databases) in .tf configuration files.
2. Plan: Terraform creates an execution plan by comparing the desired state in the configuration files with the current state of the real-world infrastructure, which it tracks in a state file^[4]. This plan details what Terraform will create, update, or delete.
3. Apply: After human approval, Terraform executes the plan, making API calls to the relevant cloud providers or services to bring the infrastructure into the desired state.

Terraform's power comes from its provider ecosystem. Providers are plugins^[5] that act as a translation layer between Terraform's declarative syntax and the specific APIs of over a thousand different services, including all major cloud providers, monitoring tools, and database systems.

Security: Vault

Vault is a secrets management tool designed to handle sensitive data in modern, dynamic environments. It provides a centralized, secure, and auditable place to store and control access to tokens, passwords, certificates, and encryption keys.

How it Works:
Vault's core function is to broker access between users, machines, and sensitive data. It authenticates identities from trusted sources (like Active Directory, LDAP, or cloud identity and access management systems) and authorizes them to access specific secrets based on policies. Key features include:

• Dynamic Secrets: Instead of storing long-lived credentials, Vault can generate them on-demand for services like AWS or SQL databases. These secrets have a limited time-to-live (TTL), automatically expiring after use, which significantly reduces the risk of a leak.
• Encryption as a Service: Vault can encrypt and decrypt data without storing it, allowing applications to offload their cryptographic needs to a central, policy-controlled service.
• Centralized Auditing: All authentication and access requests are logged to an audit trail, providing a clear record of who accessed what and when.

Networking: Consul

Consul is a networking tool that provides service discovery, health checking, and a full-featured service mesh. In a microservices architecture, Consul helps services find and communicate with each other across a distributed environment.

How it Works:

• Service Registry: Services register themselves with the Consul agent, which populates a central catalog of available services and their locations.
• Health Checking: Consul agents continuously monitor the health of registered services and automatically remove unhealthy instances from the pool of available services.
• Service Mesh: In its more advanced use case, Consul can manage network traffic between services using sidecar proxies. This enables secure, encrypted communication (mTLS), advanced traffic routing, and observability without requiring changes to the application code.

Applications: Nomad

Nomad is a simple and flexible workload orchestrator for deploying and managing applications. While Kubernetes has become the de facto standard for container orchestration, Nomad offers a lighter-weight alternative that is designed to be easier to operate and can schedule a wider variety of workloads, including containers, virtual machines, and standalone applications.

How it Works:
Users submit job files to the Nomad server, which describe the task to be run, the resources it requires (CPU, memory), and any constraints. Nomad's scheduler then finds a suitable client node in the cluster to run the task. Its architecture is simpler than Kubernetes, consisting of a single binary for both clients and servers, which appeals to teams looking for a less complex orchestration solution.

Business Model: Open Core and the HashiCorp Cloud Platform

HashiCorp operates on an open-core business model. The core of each product is available as an open-source community edition. The company generates revenue by selling proprietary, enterprise-grade features built on top of these open-source projects. These enterprise features typically focus on collaboration, governance, security, and operational efficiency at scale.

For example, Terraform Community Edition is free, but Terraform Enterprise^[7] adds features like governance policies (Sentinel), cost estimation, and self-service workflows for large organizations. Similarly, Vault Enterprise provides advanced replication, hardware security module (HSM) integration, and other features required for high-security environments.

Revenue is primarily generated through two channels:

1. Self-Managed Enterprise Software: Customers purchase licenses to run HashiCorp's enterprise products on their own infrastructure, either on-premises or in their cloud accounts. This is typically sold via subscription.
2. HashiCorp Cloud Platform (HCP): Launched in 2020^[8], HCP is a fully managed platform that provides HashiCorp's tools as a service. For example, a customer can use HCP Vault without having to manage the underlying Vault cluster. This consumption-based offering is designed to lower the barrier to entry and reduce operational burden.

According to its fiscal year 2024 annual report^[9], HashiCorp generated $583.1 million in revenue, with the vast majority coming from subscriptions. The company also reported having 4,423 customers as of January 31, 2024.

Market Position and Competition

HashiCorp enjoys a strong market position, particularly with Terraform, but faces significant competition across its product portfolio.

• Terraform: While Terraform is the de facto standard for multi-cloud IaC, its primary competitors are the cloud-native solutions: AWS CloudFormation^[10], Azure Resource Manager (ARM) templates and Bicep^[11], and Google Cloud Deployment Manager^[12]. Other notable competitors include Pulumi^[13], which allows developers to define infrastructure using general-purpose programming languages, and the open-source fork OpenTofu^[14], which emerged after HashiCorp's license change and is governed by the Linux Foundation.

• Vault: In the secrets management space, Vault competes directly with the managed services from major cloud providers, such as AWS Secrets Manager^[15], Azure Key Vault^[16], and Google Secret Manager^[17]. It also competes with other enterprise security vendors like CyberArk and Delinea^[18].

• Consul: The service mesh market is highly competitive. Consul's main rivals are open-source projects like Istio^[19], which is strongly backed by Google, and Linkerd^[20], which is a CNCF graduated project known for its simplicity and performance.

• Nomad: Nomad's primary competitor is Kubernetes^[21], which has a vastly larger market share, community, and ecosystem. While Nomad is valued for its simplicity, it remains a niche player in the broader workload orchestration market.

Strengths, Limitations, and Controversies

Genuine Strengths

• Multi-Cloud and Hybrid-Cloud Native: HashiCorp's tools were designed from the ground up to be provider-agnostic, making them a natural fit for organizations with a multi-cloud strategy.
• Strong Community and Ecosystem: Terraform, in particular, benefits from a massive community that contributes to a vast library of providers, modules, and learning resources.
• Integrated Suite: The products are designed to work together, offering a potentially cohesive solution for the entire infrastructure lifecycle, from provisioning to application deployment.
• Declarative and Codified Approach: The emphasis on Infrastructure as Code and policy as code enables automation, repeatability, and auditable change management, which are core tenets of modern DevOps.

Real Limitations

• Operational Complexity: While HCP reduces this burden, running the open-source or self-hosted enterprise versions of HashiCorp's products at scale requires significant operational expertise.
• Potential for Ecosystem Lock-in: While the tools are multi-cloud, standardizing on the full HashiCorp stack (Terraform, Vault, Consul, Nomad) can create a form of vendor lock-in, making it difficult to switch to alternative solutions for individual components.
• The "State" Challenge in Terraform: Managing Terraform's state file, especially in large teams, can be complex and a source of errors if not handled carefully with remote backends and state locking.

The BSL Controversy

The most significant controversy in HashiCorp's history was its August 2023 decision to switch its products from the MPL 2.0 license to the BSL 1.1. The BSL allows for free use and source code access but forbids commercial use that competes with HashiCorp's own offerings. After a specified period (typically a few years), the code converts to a fully open-source license.

HashiCorp's stated reason was to prevent other companies from taking their open-source work and offering it as a competing commercial product without contributing back. However, the move was met with strong criticism from the open-source community. Critics argued that the BSL is not a true open-source license (as defined by the Open Source Initiative) and that the change betrayed the community's trust. This backlash culminated in the creation of OpenTofu^[22], a fork of Terraform managed by the Linux Foundation, which aims to keep the tool truly open source.

A Decision Lens for Technical Leaders

When evaluating HashiCorp's suite, technical leaders must weigh several strategic tradeoffs.

Who is it a good fit for?

• Multi-Cloud Organizations: Companies that are strategically committed to using multiple cloud providers are HashiCorp's primary audience. Terraform's ability to provide a single workflow across AWS, Azure, and GCP is its killer feature.
• Enterprises Needing Governance and Control: The enterprise versions of HashiCorp's products, with features like Sentinel for policy as code, are well-suited for large organizations that need to enforce security, compliance, and cost controls across many teams.
• Teams Seeking a Unified Toolchain: Organizations that value an integrated suite of tools for infrastructure, security, and networking may find the HashiCorp stack compelling, as the products are designed to work well together.

Who might it not be a good fit for?

• Single-Cloud Shops: Teams that are fully committed to a single cloud provider might find that the provider's native IaC tools (like CloudFormation or Bicep) are simpler, better integrated, and more cost-effective.
• Open-Source Purists: Organizations with a strict policy against using non-OSI-approved licenses will need to avoid HashiCorp products post-BSL change and may consider alternatives like OpenTofu.
• Teams Preferring Imperative Code: Developers who prefer using a familiar programming language (like Python, TypeScript, or Go) to define infrastructure may find a tool like Pulumi to be a more natural fit than Terraform's HCL.

Tradeoffs to Consider:

• Cost vs. Operational Overhead: The choice between the free open-source versions, the fully managed HCP offering, and the self-hosted enterprise software involves a tradeoff between licensing costs, operational burden, and feature availability.
• Best-of-Breed vs. Integrated Platform: A leader must decide whether to adopt the full HashiCorp stack for a unified experience or to select best-of-breed tools for each category (e.g., Terraform for IaC, Istio for service mesh, a cloud provider's KMS for secrets), which may offer more power but less integration.
• Future Under IBM: The acquisition by IBM was completed in February 2025. It could lead to deeper integration with enterprise platforms like OpenShift and broader enterprise support. It could also raise concerns about future product direction, pricing, and the continued commitment to the open-source community.