There is no single rolling-upgrade sequence that safely covers Nomad, Consul and Vault together. Plan and validate each product’s version path separately, preserve cluster quorum, upgrade servers before clients where the product guide calls for it, and check health before continuing. Before choosing a cross-product order, verify that the exact Nomad, Consul, Vault and Envoy versions you intend to run are compatible.
Plan the upgrade around versions, topology and rollback
“Rolling upgrade” describes an operational goal, not one shared procedure for these products. Before scheduling production changes, record the source and target versions, edition, topology and dependencies for each cluster. Review the official upgrade notes for every version hop: a general compatibility promise does not replace release-specific prerequisites or warnings.
As an Amazon Associate I earn from qualifying purchases.
- Nomad: check the Nomad upgrade guide and the notes for the target release. The guide describes compatibility across at least two point releases—for example, it says v1.7.x works with v1.5.x—but that general policy is not a guarantee that every intervening feature or migration is safe for a particular deployment.
- Consul: check the target release’s notes and the upgrade instructions. Without dedicated instructions, the general guidance limits a hop to two major versions; its example routes a 1.12-to-1.15 move through 1.14. For LTS-to-LTS upgrades, the stated maximum is three major versions. Recheck the living documentation for the actual releases.
- Vault: review the change tracker, release notes, deprecations and prerequisites for every intervening version. Vault can support large version jumps, but its replicated deployment upgrade guidance still directs operators to review each version’s notes.
Use a production-like rehearsal to verify the upgrade steps and application behavior. For Vault, rehearse a snapshot restore and upgrade outside production, including data access, authentication methods, secrets engines and critical workflows. Do not assume the order of the three products is universal: select it only after checking compatibility and the effect of each change on the integrations and workloads in your own topology.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose an upgrade method that matches the cluster
In-place upgrades and replacement-host migrations have different operational costs. There is no universally preferred method in the product guidance; use the trade-offs below to make the choice for each component.
#1 Best Overall
| Approach | Operational effect | Key decision |
|---|---|---|
| In-place Nomad upgrade | Nomad says allocations can remain running while the binary is upgraded. Upgrade servers incrementally, check cluster health, then upgrade clients. | Confirm server health after each change and account for client restart behavior. See the Nomad upgrade guide. |
| Replacement Nomad hosts | New hosts are introduced and old nodes are removed; old client nodes must be drained so allocations can move. | Check allocation capacity and drain constraints before replacing clients. Nomad Enterprise documents automated server migration separately; see Nomad Enterprise. |
| Consul rolling server restart | Install the target binary, then restart one server at a time, followers before the Raft leader. Roll clients after the servers. | Preserve quorum and verify each server has rejoined and synchronized before proceeding. See the Consul general upgrade process. |
| Vault HA migration | The correct manual or automated procedure depends on Vault version, storage backend and Enterprise Autopilot configuration. | Confirm eligibility and the snapshot-based rollback path before selecting a migration. See Vault replicated deployment upgrades. |
Enterprise automation is not a general substitute for planning. Nomad Enterprise’s server migration shifts voter status after enough new-version servers have joined to match the existing voter count. Vault Enterprise automated upgrades require an eligible license and integrated storage; do not assume either feature exists in a Community deployment.
Upgrade Nomad servers and clients
1. Upgrade servers incrementally
Nomad supports an in-place binary upgrade or a replacement-host approach. For an in-place procedure, add the target version, check cluster health, remove the old version and check health again; then move on to clients. Upgrade one server at a time and verify server membership and client status before continuing. Nomad recommends servers first because clients may not be able to use new features until the servers have been upgraded. Follow the exact procedure and release notes in the Nomad upgrade guide.
2. Upgrade clients with allocation behavior in mind
A client restart that exceeds heartbeat_grace can cause allocations to be rescheduled. The guide gives 10 seconds as the default for this setting; verify the configured value in your cluster rather than treating that default as universal. For replacement hosts, drain the old clients so their allocations can move, and ensure the cluster has capacity for them.
3. Check federation and version-specific changes
In federated deployments, features may remain unavailable until agents in a region and servers in the authoritative region have been upgraded. Check the target release’s specific notes, not only the general upgrade page. For example, Nomad 1.10 removes the previously deprecated token-based Vault and Consul authentication workflow. Migrate integrations and workloads to workload identity before upgrading to that release; the change is documented in the Nomad version-specific upgrade notes.
Nomad’s documented downgrade options are limited: client downgrade requires draining allocations and removing the client data directory, while a safe server downgrade requires re-provisioning the cluster. Treat the change as forward-only unless you have planned and tested the appropriate recovery path.
Upgrade Consul servers, clients and proxies
1. Install the target binary and upgrade servers one at a time
Install the target binary across the Consul servers, then restart them incrementally. Restart followers before the Raft leader and leave the leader until last. After each restart, wait for the server to rejoin and synchronize before touching the next one. Use consul members to inspect membership and build or protocol versions; the general procedure also calls for comparing commit and log indexes after restart. See the Consul upgrade guide and its general upgrade process.
2. Roll clients after servers
Once the servers are upgraded and healthy, roll the Consul clients. If clients run Envoy sidecars or gateways, coordinate their upgrades and restarts as well: the Envoy version must be compatible with the target Consul release. Check the release-specific guidance for the relevant Consul and Envoy versions rather than assuming that an agent upgrade alone completes the rollout.
Recommended Free Tools
3. Handle WAN federation by datacenter
For WAN-federated Consul, upgrade servers and then clients in the primary datacenter; then repeat that order in each secondary datacenter. Within every server group, upgrade followers before the leader, one server at a time. Follow the WAN-federated upgrade guide.
Consul’s documented protocol compatibility promise covers at least one prior version. Newer agents can speak an earlier protocol for compatibility, but features may be unavailable while they do so. This is a protocol compatibility statement, not permission to skip the target release’s upgrade instructions; see the Consul Protocol Compatibility Promise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Upgrade Vault without treating a binary rollback as recovery
1. Back up data and configuration before changing versions
Vault’s upgrade guidance calls for backing up both data and configuration. It makes no backward-compatibility guarantees for the data store, so a pre-upgrade snapshot is essential to a rollback plan. A binary-only downgrade is not a safe recovery: restoring means returning to the prior data snapshot and configuration as well as the previous Vault version. Follow the Vault upgrade guide and Vault rollback guide.
2. Select the HA procedure for the backend and version
The HA method depends on Vault version, storage backend and Enterprise Autopilot configuration. Vault 1.11 and later with integrated storage and Autopilot enabled can use automated upgrade migration. Deployments before 1.11, those using external storage, or those that have opted out should use the manual HA process documented for their configuration.
For an eligible Vault Enterprise automated migration with integrated storage, new-version nodes are added; when their number equals or exceeds the old-version nodes, the new nodes are promoted to voters and old nodes demoted. Leadership transfers, after which the operator waits for and removes the old nodes. Check Autopilot status and account for dead-server cleanup settings. See Vault automated upgrades and Autopilot concepts.
3. Use controlled replacement behavior on Kubernetes
For Vault on Kubernetes, configure the StatefulSet with OnDelete, not RollingUpdate, so standbys are updated before the active primary. Avoid failing over to an older Vault version. Pin both the Helm chart and Vault image versions instead of relying on whichever chart is latest in the repository, and rehearse the upgrade and restore outside production. The Vault Kubernetes deployment guide covers the procedure.
4. Verify Vault is usable after the upgrade
After upgrading and unsealing, verify the behavior that matters to your deployment: data access, authentication methods, secrets engines and critical workflows. A successful process restart alone does not establish that applications can use Vault correctly.
Check Nomad, Consul and Vault integration compatibility
Before changing any one product, verify the exact target-version pairings in Nomad’s live compatibility tables for Consul and Vault. The documentation accessed on October 4, 2026 lists Nomad 1.10+, 1.11+ and 2.0+ against recent Consul 1.19–1.22 and Vault 1.18–1.20; these are living tables, not a durable compatibility guarantee for every target combination.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Each Nomad client should use a local Consul agent. Nomad’s guidance says clients should not share one Consul agent or connect directly to Consul servers.
- Plan Envoy sidecar and gateway versions and restart timing alongside Consul clients.
- Vault Agent and Vault server versions do not have to match, but a mismatch can limit available features. Vault Agent logs an informational note when it detects a version mismatch; check the Vault Agent/server version guidance for target-version exceptions.
- For Nomad 1.10, migrate the deprecated token-based Consul and Vault authentication workflow to workload identity before the upgrade, following the version-specific notes.
Use a go/no-go check before each production step
- Version path: source and target versions, every required intermediate hop, and release-specific prerequisites are documented.
- Quorum and health: the cluster can tolerate the next server restart, and the preceding server has rejoined and passed its health checks.
- Workload impact: allocation drains, client restart timing, capacity and application dependencies have been accounted for.
- Integration fit: Nomad, Consul, Vault and Envoy target versions are compatible, and authentication changes are completed before the relevant upgrade.
- Recovery: rollback steps reflect the product’s actual data behavior, including restoring Vault’s pre-upgrade snapshot rather than merely reinstalling an older binary.
- Edition and topology: any automated migration is supported by the installed edition, license, storage backend and cluster configuration.
Do not promise zero downtime based only on the word “rolling.” The documented procedures are designed to manage upgrades without unnecessary disruption, but the result depends on topology, workload behavior, release-specific changes and successful validation at every step.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
