$ the-wire · showcase
Consul tightens ACL binding, reverts Envoy max to 1.39.1
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
9 people shipped this
YakDriver
@YakDriver
1 cited
OokaToru
@OokaToru
1 cited
HerambLimaye
@HerambLimaye
1 cited
hc-github-team-es-release-engineering
@hc-github-team-es-release-engineering
1 cited
nitin-sachdev-29
@nitin-sachdev-29
1 cited
binilvrgs
@binilvrgs
1 cited
johnsonaj
@johnsonaj
ewbankkit
@ewbankkit
panman90
@panman90
consul-k8s closes a cross-namespace privilege path in server-acl-init while Consul walks its supported Envoy ceiling back from 1.39.4 to 1.39.1, and consul-dataplane ships security bumps in 1.8.18.
fix: scope ACL binding rules to release namespace to prevent cross-na… hashicorp/consul-k8s
Component ACL binding rules from server-acl-init now require serviceaccount.namespace to equal the Consul release namespace, not just a matching serviceaccount.name, so a same-named ServiceAccount in any other namespace can no longer log in. The change also makes -k8s-namespace a required flag, and clusters where the chart was not already passing it will break until it does.
fix(terminating-gateway): parse string annotations and apply vaultNamespace for CRD-managed gateways hashicorp/consul-k8s
Two bugs in how CRD-managed terminating gateways read the helm-values ConfigMap: the chart wrote terminatingGateways.defaults.annotations and global.secretsBackend.vault.agentAnnotations with toJson, turning documented multi-line YAML strings into JSON strings the controller could not parse, which the PR describes as breaking every TerminatingGateway reconcile. The same fix applies vaultNamespa...
connect: revert max supported Envoy from 1.39.4 to 1.39.1 (#24057) hashicorp/consul
Consul reverts the maximum supported Envoy version from 1.39.4 back to 1.39.1, so 1.39.4 proxies are no longer in the supported range. The changelog entry for the original bump is restored alongside the revert entry.
v1.8.18 hashicorp/consul-dataplane
consul-dataplane 1.8.18, dated October 15, 2026, upgrades golang.org/x/net to v0.60.0 and the Go toolchain to 1.26.9 to address security vulnerabilities, with no other changes listed.
r/aws_secretsmanager_secret_version: Tolerate superseded versions whose KMS key is gone hashicorp/terraform-provider-aws
aws_secretsmanager_secret_version now tolerates a superseded version whose KMS key has been disabled or deleted, instead of failing on the decryption error. Decryption failures still surface for AWSCURRENT and AWSPENDING versions, on import, and for any cause other than a missing key, such as a missing kms:Decrypt.
New resource: `aws_bedrock_enforced_guardrail_configuration` hashicorp/terraform-provider-aws
Elsewhere in terraform-provider-aws, a new aws_bedrock_enforced_guardrail_configuration resource lands, followed by a cleanup that removes its bookkeeping attributes.
Action items
- → Upgrade consul-dataplane to 1.8.18 to pick up the golang.org/x/net v0.60.0 and Go 1.26.9 security fixes hashicorp/consul-dataplane [immediate]
- → Cap Envoy at 1.39.1 or downgrade from 1.39.4 after the Consul revert hashicorp/consul [plan]
- → Pass -k8s-namespace to server-acl-init before adopting the namespaced ACL binding rule change hashicorp/consul-k8s [plan]
