HashiCorp Consul v2.1.0: Nftables Migration, Stricter ACLs, and Security Patches
Consul v2.1.0 replaces iptables with nftables for transparent proxy, tightens Enterprise API/ACL checks, and patches several CVEs. Upgrade notes inside.
Infrastructure as Code
Terraform Datadog provider v4.27.0 adds RUM operation resources, makes dashboard v2 default, and fixes list_stream and sync bugs.
DataDog has released v4.27.0 of the terraform-provider-datadog provider. This release introduces two new resources for RUM (Real User Monitoring) operations, switches datadog_dashboard to use the v2 implementation by default, and ships two bugfixes affecting dashboard state reads and Synthetics private location imports. This article covers what changed and how to upgrade safely.
datadog_dashboard now uses the v2 implementation by default (PR #4246). No HCL changes are required to adopt this, but because it changes how the resource is implemented under the hood, review your Terraform plan carefully after upgrading before applying.
New resource: datadog_rum_operation for managing RUM operations (PR #4380). The release notes do not include a full schema, so consult the provider documentation for the exact attributes. Example skeleton usage:
resource "datadog_rum_operation" "example" {
# see provider docs for required/optional attributes
name = "checkout-flow"
}New resource: datadog_rum_operation_journey_link for linking RUM operations to journeys (PR #4381):
resource "datadog_rum_operation_journey_link" "example" {
# see provider docs for required/optional attributes
operation_id = datadog_rum_operation.example.id
}Both resources are brand new in this release; the release notes do not specify full attribute lists, so verify the schema in the registry docs or via terraform providers schema -json before writing production configuration.
datadog_dashboard: list_stream widget's clustering_pattern_field_path and group_by attributes were not being read into state correctly; this is now fixed (PR #4183). If you use list_stream widgets, run a plan after upgrading — you may see a one-time diff as state catches up to the actual configuration.datadog_synthetics_private_location: configuration was not preserved across Update for imported resources. This is now fixed (PR #3748), which matters if you manage Synthetics private locations via terraform import.Pin the provider version in your configuration:
terraform {
required_providers {
datadog = {
source = "DataDog/datadog"
version = "~> 4.27.0"
}
}
}Then re-initialize:
terraform init -upgradeBefore applying, run a plan to catch any drift introduced by the list_stream fix or the dashboard v2 default switch:
terraform plan -out=tfplanReview the plan output closely for any datadog_dashboard or datadog_synthetics_private_location resources. If the plan shows only attribute corrections (no destructive replace), it's safe to apply:
terraform apply tfplanConfirm the provider version in use:
terraform providersCheck that the version matches 4.27.0 in the output for provider[registry.terraform.io/datadog/datadog]. If you used new datadog_rum_operation or datadog_rum_operation_journey_link resources, inspect their state after apply:
terraform state show datadog_rum_operation.examplev4.27.0 brings RUM operation management to Terraform and quietly switches datadog_dashboard to its v2 implementation. No required HCL migrations are documented, but the list_stream and dashboard v2 changes warrant a careful terraform plan review before applying. Full details: release notes on GitHub.
Consul v2.1.0 replaces iptables with nftables for transparent proxy, tightens Enterprise API/ACL checks, and patches several CVEs. Upgrade notes inside.
TFLint v0.65.0 ships a Go 1.26.10 security bump, deterministic file iteration, unique JUnit testcase names, and drops the auto install script.
Terraform 1.17.0 brings Policy GA, -minimal-refresh planning, variables/locals in provider requirements, and key bug fixes. Upgrade notes inside.
Terragrunt v1.2.1 patches a Go CVE, speeds up discovery and shared config parsing, and dedupes run_cmd calls. Upgrade notes inside.