HashiCorp

Vault 2.2.0 landed with container and PostgreSQL storage changes that break existing setups, and Vault 2.1 reached HCP Vault Dedicated.

Vault 2.2 breaks container and PostgreSQL storage setups.

• Container images no longer carry cap_ipc_lock; set disable_mlock = true and disable swap on the host
• UBI images drop gnupg, openssl, and procps
• PostgreSQL storage now prefers Azure Workload Identity over Managed Identity — existing Managed Identity configs may stop working until migrated

Terraform Policy is generally available.

• -policies on plan, apply, and query no longer requires an experimental build or -allow-experimental-features
• Provider requirements now accept variables and locals; -minimal-refresh refreshes only resources with proposed changes
• 1.16.6 patched an HTTP/2 resource exhaustion issue (CVE-2026-78669), exploitable only via a compromised registry

Consul's transparent proxy setup moved to nftables (breaking). consul connect redirect-traffic applies IPv4 and IPv6 rules atomically through the nftables inet family, and validates exclusions up front — numeric user IDs, IP or CIDR outbound exclusions. It does not remove iptables/ip6tables rules left by earlier versions, so strip those before upgrading a host in place. Tokens need mesh:write to attach builtin Lua or WASM EnvoyExtensions or set xDS escape-hatch keys.

Nomad and HCP wrap-up. Nomad 2.0.7 allows wildcard namespace queries for native services. Vault 2.1 is rolling out to HCP Vault Dedicated clusters on AWS and Azure.