Last required release: v202406-1 (776)

Flexible Deployment Options terraform-enterprise container digest: amd64/linux sha256:b27c789bf92e1ee835a5fba9eba26705d71783df0eb73fbd08275ad761fbcbaa

Terraform Enterprise v202410-1

Known Issues

1. Updated October 28, 2024. A minor issue with Azure Kubernetes Service (AKS) workload identity authentication may prevent Terraform Enterprise from using the service consistently. To work around this issue, you must set TFE_OBJECT_STORAGE_AZURE_ACCOUNT_KEY in your overrides.yaml file to a non empty string. You must also set the TFE_OBJECT_STORAGE_AZURE_USE_MSI setting to false:

   TFE_OBJECT_STORAGE_AZURE_ACCOUNT_KEY: a25vd25faXNzdWUK  # Set to any non empty string.
   TFE_OBJECT_STORAGE_AZURE_USE_MSI: false

Features

1. Extends Azure's object storage configuration with workload identity fields by providing workload identity credentials authentication for the Azure backend.
2. TFE now supports AKS workload identity authentication and authorization.

Improvements

1. You can now use a SHA3 certificate for SAML signing validation.
2. Teams with admin access on the default project no longer need to specify a project ID when creating a new workspace via the API. If a project relationship is not specified in the request, the workspace will be created in the default project as long as the caller has appropriate permission.
3. A small but constant memory leak has been discovered in the API serialization layer and fixed, which should reduce the overall memory consumption of Puma processes over time.

Bug Fixes

1. Fixed a bug where some variable sets weren't visible in the projects/:project_id/varsets API endpoint for projects that contain no workspaces.
2. Fixed a bug where attempted eager loading of a user's teams negatively affected performance.
3. When using tfectl app config --format docker to generate Docker compose configurations, the output has been enhanced to heighten clarity around generated values and formatting has been corrected of some environment variables.
4. Fixed unhandled exceptions when malformed filter parameters are used in /api/v2 endpoints.
5. Workspaces API unlock action will now return a 400 status instead of 503 when the latest state version is still pending, but only for Terraform CLI 1.10+ clients.
6. Users had reported the workspace-variables page returning 404/429 responses and/or rate limiting errors when the workspace is scoped to many projects/variables. This bug has been resolved and the performance of that page has improved.
7. Services no longer fail to read the CA bundle when PostgreSQL settings are configured to either verify-ca or verify-full
8. Fixes a known issue with the execution of tfectl node drain, where the task worker would not receive a signal from the command, and the node drain would not work.

Security

1. We have resolved a vulnerability in which users were able to copy their session cookie from the browser and continue to use it with the API, even after logging out, when API rate limiting was disabled in their admin settings. Terraform Enterprise always requires the cookie session to be active when making an API request authenticated with a cookie.
2. Container and binary updates address reported vulnerabilities (CVEs) in underlying base images, packages, and dependencies.