Consul k8s - v1.4.0


1.4.0 (February 29, 2024)

NOTE: Consul K8s 1.4.x is compatible with Consul 1.18.x and Consul Dataplane 1.4.x. Refer to our compatibility matrix for more info.


  • server: set autopilot.min_quorum to the correct quorum value to ensure autopilot doesn't prune servers needed for quorum. Also set autopilot. disable_upgrade_migration to true as that setting is meant for blue/green deploys, not rolling deploys.

This setting makes sense for most use-cases, however if you had a specific reason to use the old settings you can use the following config to keep them:

  extraConfig: |
    {"autopilot": {"min_quorum": 0, "disable_upgrade_migration": false}} [[GH-3000](]
  • server: set leave_on_terminate to true and set the server pod disruption budget maxUnavailable to 1.

This change makes server rollouts faster and more reliable. However, there is now a potential for reduced reliability if users accidentally
scale the statefulset down. Now servers will leave the raft pool when they are stopped gracefully which reduces the fault
tolerance. For example, with 5 servers, you can tolerate a loss of 2 servers' data as raft guarantees data is replicated to
a majority of nodes (3). However, if you accidentally scale the statefulset down to 3, then the raft quorum will now be 2, and
if you lose 2 servers, you may lose data. Before this change, the quorum would have remained at 3.

During a regular rollout, the number of servers will be reduced by 1 at a time, which doesn't affect quorum when running
an odd number of servers, e.g. quorum for 5 servers is 3, and quorum for 4 servers is also 3. That's why the pod disruption
budget is being set to 1 now.

If a server is stopped ungracefully, e.g. due to a node loss, it will not leave the raft pool, and so fault tolerance won't be affected.

For the vast majority of users, this change will be beneficial, however if you wish to remain with the old settings you
can set:

  extraConfig: |
    {"leave_on_terminate": false}
    maxUnavailable: <previous setting> [[GH-3000](]



  • control-plane: publish consul-k8s-control-plane and consul-k8s-control-plane-fips images to official HashiCorp AWS ECR. [GH-3668]
  • helm: Kubernetes v1.29 is now supported. Minimum tested version of Kubernetes is now v1.26. [GH-3675]
  • cni: When CNI is enabled, set ReadOnlyRootFilesystem=true and AllowPrivilegeEscalation=false for mesh pod init containers and AllowPrivilegeEscalation=false for consul-dataplane containers (ReadOnlyRootFilesystem was already true for consul-dataplane containers). [GH-3498]
  • control-plane: Add CaseInsensitive flag to service-routers that allows paths and path prefixes to ignore URL upper and lower casing. [GH-3502]


  • consul-telemetry-collector: fix args to consul-dataplane when global.acls.manageSystemACLs [GH-3184]


  • build: Releases will now also be available as Debian and RPM packages for the arm64 architecture, refer to the
    Official Packaging Guide for more information. [GH-3428]


Feb. 29, 2024, 9:36 p.m.
Register or login to:
  • 🔍View and search all Consul k8s releases.
  • 🛠️Create and share lists to track your tools.
  • 🚨Setup notifications for major, security, feature or patch updates.
  • 🚀Much more coming soon!
Continue with GitHub
Continue with Google