●Change8

Migrating to Consul Connect ent-changelog-1.15.0

Version ent-changelog-1.15.0 introduces 8 breaking changes. This guide details how to update your code.

Released: 12/2/2025

8
Breaking Changes
7
Migration Steps
16
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

Delete Token/Policy/AuthMethod/Role/BindingRule endpointsRead Token/Policy/Role endpointsLogout endpointToken Self endpointacl migration functionalitylegacy acl policies-join-join-wanstart_joinstart_join_wanretry-joinretry-join-wanservice-defaults upstream overridesconsul connect envoyconnect.enable_serverless_pluginLambda integration

Breaking Changes

●Issue #1

Delete and get requests for ACL resources now return descriptive 404 errors when the resource cannot be found (e.g., "Requested * does not exist: ACL not found"). Read Token/Policy/Role endpoints now return 404 when the resource cannot be found with format: "Cannot find * to delete". Logout returns 401 if token is missing, format: "Supplied token does not exist". Token Self endpoint returns 404 if token is missing, format: "Supplied token does not exist".

●Issue #2

All functionality and references to the legacy ACL system have been removed.

●Issue #3

All functionality and references for legacy ACL policies have been removed.

●Issue #4

The configuration options `-join`, `-join-wan`, `start_join`, and `start_join_wan` are deprecated and now act as aliases for `-retry-join`, `-retry-join-wan`, `retry_join`, and `retry_join_wan`, respectively.

●Issue #5

The `peer` field has been added to service-defaults upstream overrides. Overrides will now only apply to peer services if the `peer` field matches the destination peer name; previously, overrides were applied based only on matching `namespace` and `name` fields.

●Issue #6

The `consul connect envoy` command will now error and exit if the Envoy version is incompatible. Use the `--ignore-envoy-compatibility` flag to bypass this check.

●Issue #7

The `connect.enable_serverless_plugin` agent configuration option has been removed; Lambda integration is now enabled by default.

●Issue #8

The Lambda integration configuration has been refactored to use the Envoy extensions field on service-defaults configuration entries.

Migration Steps

  1. 1
    If you rely on the specific error formats for ACL resource not found, update your error handling to accommodate the new formats (e.g., "Requested * does not exist: ACL not found").
  2. 2
    Remove any configuration or code referencing legacy ACL migration functionality or legacy ACL policies.
  3. 3
    If using `-join`, `-join-wan`, `start_join`, or `start_join_wan`, consider migrating to `-retry-join`, `-retry-join-wan`, `retry_join`, or `retry_join_wan` respectively.
  4. 4
    Review service-defaults upstream overrides if you configure overrides for both local and peer services; the addition of the `peer` field changes matching logic.
  5. 5
    If using `consul connect envoy`, ensure your Envoy version is compatible or use the `--ignore-envoy-compatibility` flag if necessary.
  6. 6
    Remove the `connect.enable_serverless_plugin` agent configuration option as Lambda integration is now enabled by default.
  7. 7
    If configuring Lambda integration, ensure configuration is done via the Envoy extensions field on service-defaults configuration entries.

Release Summary

This release introduces API Gateway (Beta) support, new troubleshooting CLI commands, and significant breaking changes related to ACL error formats and the removal of legacy ACL functionality. It also upgrades the underlying Go version to 1.20.1 to resolve security vulnerabilities.

Need More Details?

View the full release notes and all changes for Consul Connect ent-changelog-1.15.0.

View Full Changelog