$ the-wire · showcase
Consul k8s keeps gateways up through Vault Agent restarts
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
A credential-injecting terminating gateway no longer drags every downstream service offline when its Vault Agent container blips, and consul-ecs closes out a batch of reachable Go CVEs.
fix(connect-inject/ camp): keep credential gateway healthy while Vault Agent restarts hashicorp/consul-k8s
Kubernetes marks a pod NotReady when any single container is not ready, and the endpoints controller copies that readiness straight into the gateway's Consul Kubernetes Readiness Check, so a Vault Agent crash, OOM kill, or plain restart flipped the whole gateway to critical and cut egress for every service behind it even though camp-auth-processor still held valid credentials. The fix keeps the...
chore(deps): upgrade Go, x/crypto, x/text, grpc, mongo-driver and go-discover to fix CVEs (#386) hashicorp/consul-ecs
Go moves 1.26.4 to 1.26.8 for CVE-2026-39822 and other stdlib CVEs, with golang.org/x/crypto at v0.57.0 (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662), x/text at v0.42.0, grpc at v1.83.2, mongo-driver at v1.17.10, and go-discover at v1.5.0. If you build consul-ecs from main or ship an image derived from it, the vulnerabilities are reachable in the affected dependencies rather than incidental.
fix(api-gateway): four correctness bugs in DNS, routing, and upstream limits hashicorp/consul
Four pre-existing defects in DNS, routing, and upstream limits, reproduced end to end on live Kubernetes/agentless and VM/agentful clusters: SRV lookups returned port 0 because CheckAPIGatewayServiceNodes answered with the gateway's own catalog registration, whose ServicePort describes the gateway service rather than the listener fronting the requested service. Both deployment models ruled out ...
feat(connect-inject): one MCP+OBO AI sidecar (consul-mcp-sc) on ai-crd base (#5687) hashicorp/consul-k8s
The three-sidecar OBO inject from an earlier change collapses into a single consul-mcp-sc container running consul-mcp-sc --mode=agent, sharing consul-dataplane's UID so the Local Credential Broker FetchKey accepts the peer over SO_PEERCRED; Envoy still dials 127.0.0.1:21101, :21102, and :21103. The separate ai.obo.* Helm image keys are dropped, so deployments wiring those values need to move t...
update go version to 1.27.1 (#111) hashicorp/nomad-driver-exec2
Smaller items: nomad-driver-exec2 moved to Go 1.27.1, and consul-ecs bumped actions/setup-go from 5.0.1 to 7.0.0, an ESM migration of the Action.
Action items
- → Upgrade consul-ecs to the release carrying Go 1.26.8 and golang.org/x/crypto v0.57.0 to clear the reachable stdlib an... hashicorp/consul-ecs [plan]
- → Replace ai.obo.* Helm image keys with the single consul-mcp-sc sidecar before upgrading consul-k8s hashicorp/consul-k8s [plan]
