ENVOY_VERSIONS on release/1.21.x and release/1.22.x rejects Envoy 1.38.4, the version shipped in consul-dataplane 1.8.x/1.9.x and the only FIPS 140-3 Envoy image

Overview of the Issue

consul connect envoy exits 1 with "Envoy version 1.38.4 is not supported" on Consul 1.21.x and 1.22.x, even though HashiCorp's own artifacts for those lines ship Envoy 1.38.4:

• consul-dataplane v1.8.17 and v1.9.12 both pin ARG ENVOY_VERSION=1.38.4 and ARG ENVOY_FIPS_SUFFIX=fips1403 in their Dockerfile.
• hashicorp/envoy-fips:1.38.4-fips1403 (pushed 2026-08-31) is the only FIPS 140-3 Envoy image published. There is no 1.34.x or 1.35.x fips1403 tag.

But ENVOY_VERSIONS on the release branches has not kept up:

#23664 was backported only into release/2.0.x (#23667, still open).

The practical result is that a FIPS 140-3 deployment on a currently supported Consul release has no compliant option: the only 140-3 Envoy build is outside the supported range, and every in-range Envoy has no 140-3 build. The only workaround is -ignore-envoy-compatibility, which is not something we want to standardise on for a compliance-driven deployment.

Reproduction Steps

1. Run a Consul 1.21.x or 1.22.x client agent.
2. Install Envoy 1.38.4 (e.g. hashicorp/envoy-fips:1.38.4-fips1403).
3. Run consul connect envoy -sidecar-for <service>.
4. The command exits 1:

Envoy version 1.38.4 is not supported. If there is a reason you need to use this version of envoy use the ignore-envoy-compatibility flag. Using an unsupported version of Envoy is not recommended and your experience may vary. For more information on compatibility see https://developer.hashicorp.com/consul/docs/connect/proxies/envoy#envoy-and-consul-client-agent

Note on scope

This is the CLI bootstrap path only. checkEnvoyVersionCompatibility in command/connect/envoy/envoy.go derives its upper bound from xdscommon.GetMaxEnvoyMajorVersion() plus one minor, so it rejects anything above the newest listed minor. The xDS path (determineSupportedProxyFeaturesFromVersion in envoyextensions/xdscommon/envoy_versioning.go) enforces only a lower bound and has an empty specificUnsupportedVersions, so 1.38.4 sidecars do serve traffic against these servers.

Because the CLI bound is minor-granular, backporting main's list verbatim is sufficient — 1.38.2 in the list already admits 1.38.4.

Suggested fix

1. Backport #23664 to release/1.22.x and release/1.21.x (and land #23667).
2. Longer term, add a CI check that the ENVOY_VERSION pinned by the consul-dataplane branch paired with a Consul release line is inside that line's ENVOY_VERSIONS. This drift has recurred — see #23130.

Operating system and Environment details

Linux/amd64 VM clients and EKS, FIPS 140-3 required.