Terraform Kubernetes provider 3.3.0 rejects null namespace labels

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Consul K8s 2.1.0-rc1 patches its API submodule, and Actions workflows move off seven vulnerable x/crypto versions.

68 commits 31 PRs merged 3 releases 5 briefings covered

all hashicorp reviews →

← previous week hashicorp wire → next week →

v3.3.0 hashicorp/terraform-provider-kubernetes

by hc-github-team-es-release-engineering

The 3.3.0 release is a breaking change for anyone whose namespace manifests carry null label or annotation entries: what planned cleanly before now fails at plan time, so omit the entries or give them string values before you upgrade. Entire maps may still be omitted. This is the kind of break that surfaces in CI, not on apply, so plan runs catch it first.

SMRE-1351 [actions-go-build] Severity Vulnerabilities (50203–50209) hashicorp/actions-go-build

by itslakshyaa

The build tooling moves from golang.org/x/crypto v0.37.0 to v0.52.0, closing seven medium-severity issues tracked from SECVULN-50203 to SECVULN-50209. If your pipelines reuse these actions, the fix is in the tool, not your module graph.

v2.1.0-rc1 hashicorp/consul-k8s

by hc-github-team-es-release-engineering

The Kubernetes distribution reaches its 2.1 release candidate, carrying a security update to the api submodule alongside the google dependency upgrade. The compatibility note states that Consul K8s 2.1.x pairs with Consul 2.1.x and Consul Dataplane 2.1.x, so check that matrix before rolling it out.

fix sec vuln for morgan (GHSA-9f6g-j8ch-79g4) hashicorp/consul

by kswap

morgan before 1.12.1 fails to escape the double quote in quoted access-log fields, so an attacker controlling the user-agent, referrer, URL or Basic-auth user can close the field early. GHSA-9f6g-j8ch-79g4 is the advisory to track if you consume Consul's Node dependencies.

feat(camp): credential injection for external llm/mcp using Vault hashicorp/consul-k8s

by krutibaraiya

Terminating gateways on Kubernetes can now pull credentials from Vault Agent, rendered into memory from a projected service-account token, or from a Kubernetes Secret, across both the Helm and config-entry controller paths. It is opt-in, so nothing changes until you enable it.

New List Resource: `azurerm_storage_container` hashicorp/terraform-provider-azurerm

by sreallymatt

The azurerm provider gains a list resource for azurerm_storage_container, letting you enumerate existing containers in state without importing each one by hand.

nft migration hashicorp/consul-dataplane

by Manishakumari-hc

The integration test helper that exposes internal ports now installs nftables rules instead of iptables, one step in the iptables to nftables migration across the Consul service mesh stack. Linux hosts that only run nftables stop being a test-environment blocker.

signals: add aix build constraint and SIGVTALRM hashicorp/consul-template

by mrgupta7

consul-template compiles for GOOS=aix GOARCH=ppc64: aix joins the build constraint and SIGVTALRM joins SignalLookup, fixing a build failure on that platform.

$ ls hashicorp/week/ # the briefings behind this review

Mon Sep 28 consul-template builds on aix, consul-dataplane drops iptables from tests Tue Sep 29 Azurerm lands a storage container list resource and a MySQL diff fix Wed Sep 30 consul-k8s patches CVEs, actions-go-build bumps x/crypto Thu Oct 1 Kubernetes gateways get Vault credential injection, morgan gets its escape fix Fri Oct 2 Vault confines plugin binaries to plugin_directory, Terraform Kubernetes provider tightens namespace labels