Comment by candiddevmike | Hacker News Reader

Comment by candiddevmike | Hacker News Reader

Series E have never been a good indicator for success, especially with the stock market behavior of late, and I don't see how HashiCorp's enterprise offerings are worth a 5.1B valuation. They've continuously struggled to find a good fit for their "enterprise only" features, and the amount of money they charge for these features is nothing short of extortion. Vault seems to be the only runway they have, and I see that area ripe for competition (or even AWS Vault like they did with MongoDB). Also, based on the company's glassdoor reviews, it seems the exec team are a bunch of jerks, which is an interesting contrast to Armon/Mitchell.

Unlike some of the other comments, I see HashiCorp as a textbook example of poor execution for converting customers. They clearly have the things people want, but they have always struggled to give people a reason to pay for them. They've created a community that would easily raze the goodwill they've floated on if they started to heavily monetize their products, so they're in a lose/lose situation to me.

I see them being acquired, but I can't think of any cloud provider that would pay for them. Maybe Oracle? :)

I know of orgs who are writing 7 figure checks to Hashicorp without batting an eye. They are seeing rapid adoption in large enterprises who are willing to pay for it

https://stackshare.io/terraform

https://www.hashicorp.com/blog/category/case-study/

It seems like you don't think the value is there, and I supposed for some use cases that may be true, but I assure you they're getting paid for the value they're delivering (which is substantial).

Disclaimer: I am not associated with Hashicorp, just a satisfied user of their products who freely teaches Terraform and Vault usage and pays my own way to go to Hashiconf.

My viewpoint is based on the products they're competing against:

- Their OSS offerings

- Other OSS offerings like Istio, Ansible, Conjour, and Kubernetes

- Hybrid cloud solutions like Outpost and Anthos

Additionally, I think HashiCorp not embracing kubernetes and trying to push Nomad was a huge miscalculation. None of their products have particularly noteworthy integrations with it, with the community picking up the slack (almost like internally they don't care).

As soon as you're working with more than a few people at a time, or in an environment that has compliance, governance, or auditing requirements, you're moving up to Terraform Enterprise (either SaaS or on-prem). I admit you can get pretty far on their OSS offerings, but most folks who need the enterprise features are going to pay for them (SAML/SSO, audit log emissions, private datacenter/on-prem installs, etc). Small shops, startups, and the like? Probably not, but they don't have that much cash anyway; the benefit of marketing to them is a) if they do get big, you're already in the door to sell to them or b) they don't get big, but they grow the ecosystem with engineers knowing and using the products. Those engineers might either end up working for Hashicorp, or landing a gig at a job where they can evangelize the tools and advocate paying for them. Very similar to GitHub's model, and I'd argue it works for everyone; people who can pay, do, people who can't or won't still get value they otherwise wouldn't.

IMHO, configuration management compliments Packer and Terraform, it doesn't compete against it (based on my experience using Ansible and Packer for VMs of all sorts). Kubernetes is a beast in itself; the firms who implement Nomad are not the same as those who would go all in on k8s. Personally, I think Kubernetes is overly complex and prefer Nomad as a scheduler, YMMV (my jobs are more batch in nature, less services).

> Additionally, I think HashiCorp not embracing kubernetes and trying to push Nomad was a huge miscalculation.

Nah, embracing kubernetes is the miscalculation that every other company is making. It's a dead end. This part they're doing right. (Not saying I'm fond of nomad, but kube is absurd.)

Lol, that is why it took HashiCorp 6 months to write a broken Ansible playbook for Vault that takes an hour to deploy (they couldn't even do it with Terraform) when it takes less than 30 seconds to deploy on Kubernetes natively.

Can you please share a link to ansible playbook and Kubernetes manifest for comaprison?

You can find the Kubernetes deploy here:

https://github.com/hashicorp/vault-helm

I can't share the Ansible stuff because it isn't public.

Thanks. Too bad Ansible playbooks are not public. To be clear I'm not defending Hashicorp, as I have played quite a bit with their tools (only opensource versions) and getting deployments production ready, can be painful, especially setting up security correctly, with so many moving parts.

I know about Helm chart for Vault (btw also created and maintained by Hashicorp). It's quite handy for quick deployments, but getting it to production will require changes, as most security things are disabled. All Helm chart does, it gets Vault up and running, unsealing has to be done either manually or via third party (cool thing, if your use-case allows storing such secret on third party HW). Not to mention, that if you want to use Consul as storage backend, you will have to deal with that using separate chart.

Without knowledge what Ansible playbook does, it's hard to compare the two. If ansible is configuring host OS from scratch (updates/tools installation etc) then yes, it might take much longer, then deploying to fully managed K8s cluster.

True, I think the nice thing about Vault Helm chart (and Consul) is that you can swap in the enterprise image. You can customize the image to your liking as well. It is lightweight and easy to scale comparably. There is definitely extra work involved, but the Ansible playbook is just sequential tasks that could be baked into the container and make it a lot faster.

I'm a big fan of Kubernetes and Helm/Kustomize as a whole, though there are times where Terraform and Ansible makes sense too.

There are a handful of Ansible Roles that are community-maintained that might be of interest to you:

- https://github.com/ansible-community/ansible-consul - https://github.com/ansible-community/ansible-nomad - https://github.com/ansible-community/ansible-vault

(These were originally started by brianshumate who did an amazing job that makes starting out from scratch easy)

How many checks does it take to payback $175M? The VC treadmill is concerning for many tech companies.

Fortune 500 companies represent two-thirds of the U.S. GDP with $13.7 trillion in revenues, $1.1 trillion in profits, $22.6 trillion in market value, so there's money to be had in helping them accommodate cloud agnostic best practices through tooling.

There are lots of companies that aren't tech companies, but who still need tech (insert the caveat "software eating the world", "all companies are tech companies", and so on).

They are a giant part of the US economy, however they don't represent 2/3 of US GDP, their sales are equivalent to that figure. These are global corporations that in many cases do business in nearly every country.

Many of the largest S&P 500 companies have 2/3, 3/4 or more of their business overseas. They're typically under-represented in the US domestic economy, as the US is ~22% of global GDP, and these are typically among the largest corporations in their segments.

Point taken! I still put forth that Hashicorp’s valuation is sound based on the market size and their lack of competitors.

I would invest my own funds into Hashicorp if I could at this valuation.

So instead of being “locked in to the cloud”, you’re “locked in to Hashicorp”. Meet the new boss....

But the idea that you’re not de facto locked into your cloud provider once you are at any type of scale is a fantasy. To paraphrase Cory Quinn (?) “Infrastructure has weight”. Its a major undertaking fraught with regressions and unexpected costs to migrate from one provider to another and the benefits are usually not worth it.

>There are lots of companies that aren't tech companies,

I would like to expand on it even more, MOST companies aren't even tech.

Public market valuations for tech companies are generally 10x-100x forward earnings or higher (often much much higher. Zoom is over 1000 at the moment).

So a $550M annual run rate would mean the VCs make money at a 10x valuation in a normal market.

At 100x it is $55M.

Microsoft trades at 27, Atlassian at 127, Zoom at 1100 (!)

(I assume you realise that VC money isn't a loan and you don't "payback" the money you take. They expect a return when the company has a liquidity event, ie floats or is bought)

$175 is round E, not the valuation nor the total money raised. 10x forward earnings would mean a $500M run rate to just equal this valuation and breakeven to these latest investors.

EDIT: Since you've changed your comment, I'll re-ask my original question: How many checks will it take to get to $500M run rate? It's a high goal for infrastructure companies.

Yes, sorry about the edits - I was adding examples.

It's a private company, so revenue has to be guessed.

Puppet (Hashicorp competitor, and I think most would agree smaller competitor) announced "approaching" $100M revenue in early 2017[1].

Given Hashicorp's tempo in raising money it looks like they are hitting goals, so their growth rate must be ok.

Based on that it's not difficult to imagine Hashicorp is at $300M+ now?

[1] https://www.oregonlive.com/silicon-forest/2017/04/puppets_ce...

What is the purpose of Vault if you’re already on AWS?

Even though I prefer CloudFormation, Terraform is quite popular. As far as Consul and Nomad, they are both nice for on prem infrastructure - I’ve used both - but once you’re on either AWS or Azure, the native solutions are a lot less of a hassle and Nomsd (sadly) will never get the mindshare of k8s.

.. if you're in more than one cloud, and want a singular solution.

This is pretty rare, and it's getting rarer.

Clouds are successfully locking people in volume discounts, proprietary technology (like AWS Aurora), and non-transferrable configuration tasks.

I agree that cloud-agnostic tooling should exist, but as a for-profit company trying to find a large customer base, it's not a big market.

AWS Aurora is not “proprietary”. It’s basically a fork of Mysql/Postgres with a more performant storage layer.

Even if you're right about that, it doesn't refute my overall point that clouds are seeking to create lock-in and succeeding to some degree.

Once you’re at any scale, you’re already de facto locked in. “Infrastructure has weight”. It’s a major undertaking to migrate infrastructure once you e spent time creating data, setting up a hybrid network infrastructure, training, going through compliance, DNS entries, configuration, load balancers, validation and regression testing, etc.

The typical large corporation depends on so much third party software and so many services, it’s a pain and costly to migrate from any of them.

You can’t imagine how much coupling companies can do to something as simple as WorkDay.

I wish all of the idealists who want to maintain “cloud independence” would do a thought experiment and set up a realistic project plan and budget to migrate their infrastructure to another platform even if they didn’t use any proprietary offerings.

And then take that plan to their CTO and see where he wouid place it on the list of priorities for their company and do a realistic cost/benefit and risk analysis.

Then call my Fortune 100 bank rare. Everything we do is going with a multi-cloud strategy where it makes sense, especially around secrets management and infrastructure as code.

OK: it’s rare. You actually proved it’s rare by telling me that it’s a large bank and a Fortune 100 company.

Most people are neither banks nor Fortune 100 firms.

Why do you prefer CloudFormation?

It’s the “native” solution. All of AWS’s examples and getting started guides use CF. Also you can find examples for anything for CF on places like Github.

You have access to the “easy button”. AWS business support if there is something you just don’t get.

SAM, CodeStar,Elastic Beanstalk, etc all use CF and you can modify the templates.

You don't want to pay $1/month to store a single secret. You want a nicer workflow for creating ephemeral users and tokens than AWS themselves have. You want to do on-the-fly encryption of all sorts of things. You want a real PKI without every bit of know-how.

1$ per secret a month sounds extremely cheap considered on how much does it host to run vault

You can run vault on a single t3.medium backed by s3 with auto unseal and get pretty decent performance.

If you don’t care about silly things like high availability and reliability. Hashicorp even recommends a cluster of three.

https://www.vaultproject.io/docs/concepts/ha/

And what business at scale is optimizing over 0.25 per secret and doesn’t care about HA?

It’s 0.25 cent per month to use the Secrets Manager and you can store multiple key/value pairs per secret. If you’re not using the automatic key rotation, you can store a “SecretString” in parameter store for free for low volume usage or for higher volume It’s close to free.

Besides with vault you now need to set up a cluster for HA. But is your time worth nothing?

As far as users and tokens. That’s what Cognito is for for external users or associating your AD with IAM roles for internal users.

Reply on news.ycombinator.com