$ cat hashicorp/week/2026-09-21.log
the week in review · Sep 21 – Sep 27, 2026
Vault Secrets Operator 1.6.0 removes HVS support
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
The release drops the HCPAuth and HCPVaultSecretsApp CRDs after HCP Vault Secrets hit end-of-life on July 1, 2026.
v1.6.0 hashicorp/vault-secrets-operator
The breaking change follows HVS end-of-life on July 1, 2026. The HCPAuth and HCPVaultSecretsApp CRDs, their controllers, credentials provider, RBAC manifests, Helm chart assets, and the github.com/hashicorp/hcp-sdk-go dependency are all removed, so any cluster still reconciling HVS-backed secrets needs those manifests replaced with Vault-backed ones before the operator is upgraded.
v1.3.0 - Multi-Product Repository Support hashicorp/actions-generate-metadata
The new releaseSubDir input lets one repository build multiple products, with the security-scan.hcl and release-metadata.hcl paths derived from it. Teams that kept per-product metadata at a hardcoded .release/release-metadata.hcl will need their repo layout to match the derived path.
Iptable --> Nftable migration hashicorp/consul
Consul replaces the sdk/iptables package with sdk/nftables and migrates all callers across consul core, since iptables is being deprecated in favor of nftables on modern Linux distributions. Anyone running Consul's transparent proxy on a distro without nftables support now has a compatibility question to answer.
add support to use a pre-configured k8s auth method hashicorp/consul-k8s
Two new Helm values, global.acls.authMethod.name and global.acls.authMethod.create, let multi-dataplane installs point Consul components at a Kubernetes auth method that already exists rather than one the chart creates. Useful where the auth method is managed outside the release.
Add GCP CIS benchmark policies for IAM, network, and compute hashicorp/prewritten-terraform-policy-library
Seventeen GCP CIS benchmark policies land across IAM, networking, and compute, covering areas such as service account admin privileges, primitive project IAM roles, KMS role separation, and default network rules, each with policy tests and documentation. The library is Apache-licensed and deploys as-is; the work now is mapping the findings onto infrastructure you own.
Dns feature gate (#23935) hashicorp/consul
Localized DNS moves behind a feature gate, with the code enabling it by default and skipping the resolver check on the Consul client. Expect the flag to matter if you drive DNS behavior from Consul client configuration.
feat(api-gateway): add annotation-based http2/grpc listener protocol support hashicorp/consul-k8s
The Kubernetes controller can now write grpc and http2 listener protocols into the API Gateway config entry through an annotation. Consul API Gateway already accepted both protocols in the config entry; the controller previously translated every listener to http, so an existing gateway config can now be expressed without hand-editing the entry.
updating dns failure hashicorp/consul-dataplane
Alongside: the dataplane replaces its mutex-protected DNS listener health tracking with atomic deadline fields, packer-plugin-alicloud tagged v1.2.0 with its changelog, the policy library pinned actions/checkout to a commit SHA, and dependency bumps moved the go-getter Go group and the secrets operator's gomod-backward-compatible group.
$ ls hashicorp/week/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.