The Wire · Showcase
TERRAFORM PROVIDER CLEANUP PUSHES FORWARD; CONSUL HARDENS RELEASE PIPELINE
By RepoJournal · Filed · About HashiCorp
HashiCorp is systematically removing feature flags across the Azure provider while Consul teams move security scanning upstream in their release workflows.
The terraform-provider-azurerm team is executing a coordinated cleanup of 5.0 feature flag gates across multiple service modules [1][2][3][4][5], signaling a major version consolidation that removes technical debt ahead of production deployments. On the Consul side, both dataplane and k8s repositories are embedding CVE scanning directly into release pipelines rather than waiting for downstream verification [7][9], with dataplane now automating release branch preparation and binary scanning in a new .release/release-scripts directory. Consul-dataplane also moved to Go 1.26.5 to patch multiple security vulnerabilities [6][8], while terraform-provider-vault fixed an unintended resource replacement issue in its PKI certificate generation by removing default values that were triggering false diffs [11][12]. The Helm-based CA trust fix in consul-k8s addresses a production gotcha where custom CAs supplied via global.trustedCAs were present but never actually trusted because OpenSSL requires subject-hash symlinks to discover certificates in a directory [10].
One email a day. Unsubscribe in one click.
Keep up with HashiCorp in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Review and merge Azure provider feature flag removals before next release hashicorp/terraform-provider-azurerm [plan]
- → Upgrade to Go 1.26.5 in dataplane and k8s if not already merged hashicorp/consul-dataplane [plan]
- → Validate Terraform Vault PKI changes in test environment to confirm no spurious diffs hashicorp/terraform-provider-vault [monitor]
- → Test CA certificate trust in Consul Helm deployments with latest chart hashicorp/consul-k8s [plan]
References
- [1] remove 5.0 feature flag gates from eventgrid (#32971) hashicorp/terraform-provider-azurerm
- [2] remove 5.0 feature flag gates from datafactory (#32899) hashicorp/terraform-provider-azurerm
- [3] remove 5.0 feature flag gates from analysisservices and applicationinsights (#32896) hashicorp/terraform-provider-azurerm
- [4] remove 5.0 feature flag gates from apimanagement (#32895) hashicorp/terraform-provider-azurerm
- [5] remove 5.0 feature flag gates from bot, cdn, cognitive, communication and containerapps (#32900) hashicorp/terraform-provider-azurerm
- [6] Addition of security permissions to security-scan.yml (#1211) hashicorp/consul-dataplane
- [7] release enhancements ↗ hashicorp/consul-dataplane
- [8] Updating mulitple go packages to fix SECVULN issue ↗ hashicorp/consul-dataplane
- [9] Add a GHA workflow to scan binaries and images (#5512) hashicorp/consul-k8s
- [10] fix(helm): global.trustedCAs certificates are never trusted (missing OpenSSL hash symlinks) ↗ hashicorp/consul-k8s
- [11] Add pkcs12_bundle and jks_bundle format support for PKI cert generation (without defaults) ↗ hashicorp/terraform-provider-vault
- [12] Add pkcs12_bundle and jks_bundle format support for PKI cert generation (without defaults) (#2950) hashicorp/terraform-provider-vault