Consul 2.0.x

We are pleased to announce the following Consul updates.

Version number update

Beginning with the v2.0.0 release, HashiCorp Consul's existing semantic versioning format (X.Y.Z) changes to IBM's Version-Modification-Fix (V.M.F) model. This versioning change is intended to make lifecycle timing more consistent across our products.

• V: April Version milestone starts a new support lifecycle for the version.
• M: October Modification milestone adds new features, but does not start a new support lifecycle.
• F: Monthly fixes patch the existing release without adding new features.

Consul v2.0.0 has extended Enterprise support options for longer contract periods. Previous Consul Enterprise releases will be maintained according to existing Long Term Support contracts.

IBM Extended Support and IBM Ongoing Extended Support are optional paid packages available to Enterprise customers.

For more information about product versioning and support changes, refer to the following resources:

• IBM HashiCorp Self-Managed Product Support Lifecycle Addendum
• Changes to HashiCorp Self-Managed Enterprise Product Release Cadence and Support
• HashiCorp Long-Term Support (LTS) releases for products released prior to March 2025. Consul v1.21.x is the last LTS release.
• IBM Software Support Lifecycle Policies

Release highlights

• Multi-port routing for service mesh: Consul now supports service mesh traffic for services with multiple named ports. Sidecar proxies can advertise the local service's named ports with proxy.local_service_ports, and upstreams can target a specific named port with proxy.upstreams[].destination_port. In direct mode, applications continue to send traffic to the upstream listener on localhost:<bind-port>. In transparent proxy mode, applications can dial named virtual addresses in the format <port-name>.<service>.virtual.consul. For configuration details, refer to the Connect proxy configuration reference.
• Global rate limiting for Consul RPC: A new rate-limit configuration entry allows you to configure rate limits for the entire cluster's RPC communications. Previously, RPC rate limits required configuring each individual server. Global rate limiting allows you to implement emergency throttling procedures and exempt critical endpoints. For more information, refer to Rate limit configuration entry reference.
• CyberArk Workload Identity Manager (Venafi Firefly) support: This release introducers support for CyberArk Workload Identity Manager as Consul's service mesh Certificate Authority (CA) provider. This feature enables Consul servers to request and manage mesh TLS certificates while delegating signing operations to CyberArk APIs. For more information, refer to Use CyberArk Workload Identity Manager as a service mesh certificate authority.
• Increased API Gateway scaling limit on Kubernetes: The Consul API Gateway is now scalable beyond its previous limit of 8 replicas. The API Gateway also supports Kubernetes Horizontal Pod Autoscaling (HPA), which you can enable with annotations on the Gateway CRD.
• New Resource types for OpenShift clusters: New Kubernetes Resource types in the consul.hashicorp.com group provide additional support for Consul on OpenShift Container Platform (OCP). Previous Consul releases used v1alpha resources in the Kubernetes Gateway API, which is incompatible with OCP versions 4.19 and above. For guidance upgrading existing v1/alpha resources, refer to Upgrade Gateway resource types.
• Opt-in telemetry reporting: Consul now includes an opt-in telemetry reporting feature that is disabled by default. After you opt-in to telemetry reporting, we collect anonymized data about your cluster's operations and aggregate it for analysis. This data helps us understand how you use Consul so that we can improve the software with each subsequent release. For a complete list of telemetry data we collect, refer to Consul agent telemetry reporting reference. To enable reporting on your cluster, refer to Opt-in to telemetry data reporting.
• Certificate expiration telemetry: This release adds certificate expiration and renewal telemetry for Consul service mesh and agent TLS certificates. Consul emits certificate-related metrics through the existing /agent/metrics endpoint, including Prometheus-formatted metrics for active root and signing CAs, agent TLS certificates, and leaf certificate renewal health. Certificate telemetry is configurable in the Consul agent's telemetry block. For instructions on monitoring certificate expiration, including CA root NotAfter timestamps, agent logs, and Prometheus alerts, refer to Monitor certificate expiration.
• Support of IBM Passport Advantage Online (PAO) licenses: Consul’s existing licensing and reporting functionality is extended to support parsing and reporting with the IBM PAO license
  Enterprise
  .

Upgrading

For more detailed information, please refer to the upgrade details page and the changelogs.

Known issues

There are no known issues at this time. These release notes are updated as issues are discovered.

Report issues on Github.

Changelogs

The changelogs for this major release version and any maintenance versions are listed below.

• 2.0.0