$ the-wire · showcase
Consul serializes ACL-vetted catalog writes; Vault Secrets Operator preps v1.6.2
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
Consul moved ACL authorization and Raft apply into a single locked critical section for node and register writes, while its leaf-cert path gained per-request authorization, and the Vault Secrets Operator cut a v1.6.2 release prep.
Implement node write locks for serialized catalog writes hashicorp/consul
Consul introduced `nodeWriteLocks` on the leader to serialize ACL-vetted catalog writes, with the PR stating the goal is "atomicity between authorization and Raft apply" for node and register requests. The same change also caps HTTP request body sizes so oversized writes are rejected rather than buffered, and makes Envoy escape hatch key handling case-insensitive.
feat: authorize every leaf cert request to prevent unauthenticated cached requests hashicorp/consul
Consul now authorizes every leaf certificate request, which closes the path where a cached response could be served to an unauthenticated caller. Anyone running a client cache against the Connect cert endpoint should expect the authorization check on each call instead of a shared cached answer.
Prepare for release v1.6.2 hashicorp/vault-secrets-operator
A release-prep PR sets up vault-secrets-operator v1.6.2; it carries only the standard PCI review checklist, with no behavior changes described.
Vault - added: api.releases.hashicorp.com - to domains needing whitelising / HTTPS access. hashicorp/web-unified-docs
The Vault docs now name `api.releases.hashicorp.com` on both the API and docs pages for v1.20, v1.21, and v2.x, so air-gapped and proxied deployments have the domain recorded for whitelisting and HTTPS access. A companion PR swaps "ceiling policy" for "OBO ceiling policy" in the Agentic IAM pages and adds a Verify configuration diagram plus a second OIDC application to avoid a client ID error.
