$ the-wire · showcase
Kubernetes gateways get Vault credential injection, morgan gets its escape fix
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
Consul's Kubernetes story moved on two fronts at once, AI inference CRDs and opt-in credential injection, while consul and nomad closed out dependency and validator gaps that had been letting bad input through.
feat(camp): credential injection for external llm/mcp using Vault hashicorp/consul-k8s
Terminating gateways on Kubernetes can now pull credentials either from a Vault Agent rendered into memory with a projected service-account token or from an existing Kubernetes Secret mounted read-only, with the Secret path deliberately avoiding Vault Agent containers and token volumes entirely. It is opt-in and explicitly unsupported on OpenShift, where enabling credentialInjection is not an o...
Dinesh/ai crd inferencegtw hashicorp/consul-k8s
Adds a batch of CRDs and their operators: inferencePoolConfig, Modelconfig, AgentConfig, MCPConfig, and InferenceGateway, with policy on inferencePoolConfig handled in the gateway controller. The work also moves away from the earlier Aigtw naming toward Inferencegtw, so anyone tracking the earlier CRD should expect the rename.
fix sec vuln for morgan (GHSA-9f6g-j8ch-79g4) hashicorp/consul
morgan before 1.12.1 does not escape the double quote in quoted access-log fields, so an attacker controlling user-agent, referrer, URL, or Basic-auth user can close a field early and append fake fields to combined and common lines. This finishes the incomplete fixes for CVE-2026-5078 and CVE-2026-15603 by raising the existing pnpm override.
Validate the ISO builder configuration in Prepare hashicorp/packer-plugin-kubevirt
The ISO builder now validates in Prepare, so packer validate catches required options, Kubernetes names, instance type and preference kinds, boot_command, and disk_bus before a VM exists; an invalid disk_size used to panic resource.MustParse and crash the plugin, and os_type now actually defaults to linux as documented. installation_wait_timeout becomes required in the cases the builder needs it.
deps: Update all "golang.org/x" dependencies in root and jobspec2. (#28613) hashicorp/nomad
Nomad bumped every golang.org/x dependency in root and jobspec2 and refreshed the UI's brace-expansion, a pair of security-tracked bumps that carry no behavior change for job specs or the CLI.
