$ the-wire · showcase
CONSUL K8S CLOSES API-GATEWAY FILTER LOOP, NOMAD PIPELINES RAFT WRITES
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
Consul K8s fixed a silent reconciliation failure where external authorization filter changes weren't reaching Consul, while Nomad cut plan applier bottleneck by overlapping evaluation with application.
The API gateway fix [1] addressed a critical gap in httpRouteRulesEqual(), which compared RetryFilter, TimeoutFilter, and JWT but skipped ExtAuthz entirely. Any reconciler cycle that only changed Filters.ExtAuthz would incorrectly report EntriesEqual as true and skip the Consul write, leaving gateways in a stale state. Nomad's plan applier gains serious throughput [2] by pipelining Raft writes: evaluation of one plan now overlaps with application of the previous one, cutting the bottleneck that historically serialized these stages. The tradeoff is explicit: if a Raft transaction fails, the evaluated plan gets discarded, and there's a known narrow race where node updates can arrive mid-evaluation. Terraform provider Vault bumped 13 dependencies [3] across AWS SDK, Google Cloud IAM, and related packages in a backward-compatible group update. Nomad's scheduler also removed a tautological nil-check [4] and fixed Java driver workdir config decoding [5], both cleanup work that keeps the codebase tight.
Action items
- → Review and test Consul K8s upgrade to pick up ExtAuthz filter propagation fix hashicorp/consul-k8s [plan]
- → Test Nomad plan applier changes in staging before rolling to production hashicorp/nomad [plan]
- → Integrate Terraform provider Vault dependency updates in next release cycle hashicorp/terraform-provider-vault [monitor]
References
- [1] api-gateway: fix ext_authz filter update propagation ↗ hashicorp/consul-k8s
- [2] pipeline raft writes in plan applier ↗ hashicorp/nomad
- [3] build(deps): bump the gomod-backward-compatible group across 1 directory with 13 updates ↗ hashicorp/terraform-provider-vault
- [4] scheduler: Remove system canarying deployment state tautological. ↗ hashicorp/nomad
- [5] drivers/java: Fix decoding of work dir config object. (#28330) ↗ hashicorp/nomad
