$ the-wire · showcase
Consul moves to nftables, Vault Secrets Operator 1.6.0 drops HVS
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
14 people shipped this
bharath-k1999
@bharath-k1999
2 cited
Nagateja2402
@Nagateja2402
1 cited
binil
@binilvrgs
1 cited
vdinesh4738
@vdinesh4738
1 cited
hc-github-team-es-release-engineering
@hc-github-team-es-release-engineering
1 cited
Manishakumari-hc
@Manishakumari-hc
1 cited
DeekshithaTimmareddy
@DeekshithaTimmareddy
pajay-rao
@pajay-rao
Balaji
@Balaji2198
panman90
@panman90
Dan Heath
@Dan-Heath
Jesus-DelRiego
@Jesus-DelRiego
rassakhatsky
@rassakhatsky
trujillo-adam
@trujillo-adam
Two structural changes dominate the day: Consul replaced its iptables package with nftables across the core, and vault-secrets-operator shipped 1.6.0 with HCP Vault Secrets support removed entirely.
Iptable --> Nftable migration hashicorp/consul
The sdk/iptables package is gone, replaced by sdk/nftables with all callers migrated. The inet address family now covers IPv4 and IPv6 in one rule set, so the separate ip6tables pass is no longer needed, and rules apply atomically.
v1.6.0 hashicorp/vault-secrets-operator
v1.6.0 removes HCP Vault Secrets (EOL July 1, 2026) along with the HCPAuth and HCPVaultSecretsApp CRDs, their controllers, credentials provider, RBAC manifests, Helm chart assets, and the hashicorp/hcp-sdk-go dependency. The release notes warn that clusters still holding HCPVaultSecretsApp or HCPAuth resources must delete them before upgrading or those resources will get stuck.
Security: upgrade tornado 6.5.7 -> 6.5.8 to fix GHSA-mpf4-983q-p7j4 (CVE-2026-82397) (#5661) hashicorp/consul-k8s
consul-k8s 6.5.7 to 6.5.8 for tornado fixes GHSA-mpf4-983q-p7j4 (CVE-2026-82397), and the same change bumps mkdocs-material 9.1.12 to 9.7.7 for GHSA-xvg9-69gf-fjrf (CVE-2026-73295).
feat(api-gateway): add annotation-based http2/grpc listener protocol support hashicorp/consul-k8s
Listener protocols now reach the config entry: previously every Kubernetes listener translated to "http" regardless of intent, so gRPC and HTTP/2 workloads got plain-HTTP Envoy config with no http2_protocol_options, no grpc_stats filter, and no grpc_http1_bridge filter. The controller can now write grpc and http2 protocols already supported by the API Gateway config entry.
feat(api-gateway): add header match invert filter hashicorp/consul-k8s
Header match inversion arrives through a new Consul-specific CRD, RouteHeaderMatchInvertFilter, referenced as an ExtensionRef filter on an HTTPRoute rule, since the Kubernetes Gateway API HTTPHeaderMatch struct has no negate field. This brings API Gateway to parity with Ingress Gateway, which already supports Invert on ServiceRouteHTTPMatchHeader.
ci: pin actions/checkout to a commit SHA (#58) hashicorp/prewritten-terraform-policy-library
Quieter but worth noting: the Terraform policy library pinned actions/checkout to a commit SHA, since a mutable tag like v4 can be repointed at arbitrary code that would then run in CI with repository token access, and updated its Azure policies and test mocks for tfpolicy 0.3.0 null semantics and provider schema validation.
Added support to gateway-api package 1.6.0 version and crd update hashicorp/consul-k8s
consul-k8s added gateway-api 1.6.0 support, moving TCPRoute and ReferenceGrant under the stable v1 API, while noting the packaging split across platforms still ranges from 1.2.1 on OCP to 1.4.1 on Alibaba Cloud and GKE Autopilot. Unified docs added the Boundary PAM overview rewrite.
Action items
- → Upgrade consul-k8s to 6.5.8 to pick up the tornado fix for CVE-2026-82397 hashicorp/consul-k8s [immediate]
- → Delete existing HCPVaultSecretsApp and HCPAuth resources before upgrading vault-secrets-operator to v1.6.0 hashicorp/vault-secrets-operator [plan]
