Case Study: Workday achieves multi-cloud network connectivity with HashiCorp Consul and Vault

How Workday built a global service mesh of multiple customer datacenters using HashiCorp Consul and Vault

Workday, a global provider of enterprise applications for finance and HR, needed a way to securely connect applications across a mix of on-premises datacenters and public clouds. As its environment grew more complex, Workday faced multi-cloud networking challenges around fragmented IP space, inconsistent cloud networking technologies, and the difficulty of supporting both modern and legacy applications without requiring major changes from service teams. To solve this, Workday turned to HashiCorp Consul and Vault.

Using HashiCorp Consul as the foundation for a multi-datacenter service mesh and custom ingress gateways, Workday built a “network fabric” that lets services send traffic without needing to understand the underlying network. HashiCorp Vault was used to manage certificate authorities, issue stronger workload identities, and authenticate workloads, Kubernetes tasks, and humans to Workday’s network APIs. The solution moved from proof of concept to hundreds of services within weeks and is now rolling out to production workloads, with encrypted, stable connections and reduced operational burden for application teams.

Workday

Daniele Vazzola

Principal Infrastructure Engineer