0.1.0-preview.3

Evaluation preview

0.1.0-preview.3 is for labs, staging, and evaluation. Do not use it to protect
production control planes. Support remains best effort, with no production
service-level objective or long-term support window.

Fresh installation required

Use a fresh disposable installation with a new Transit key and provider
identity. In-place upgrades from earlier previews are unsupported. Registry
schema v1alpha2 binds the configuration identity, including the Transit key
name and mount path. The provider rejects older unbound state without rewriting
its registry or checkpoint. Preserve the old installation and its matching
artifacts; do not delete state, checkpoints, or key material to bypass this check.

Checkpoint validation accepts only the same registry state or its immediate
hash-linked successor. Back up and restore the registry and its checkpoint
together. Keep compatible etcd and OpenBao backups with every Transit key
version that retained ciphertext can need. A recreated Transit key with the
same name cannot decrypt data encrypted with the original key.

KMS key ID derivation, annotations, and additional authenticated data (AAD)
bytes are unchanged. That wire-format continuity does not make old registry
state compatible with this release.

Security updates

Builds use Go 1.27.3. The module, development environment, CI, and container
builders use the pinned toolchain. Rebuild provider binaries and images to
include these fixes.

Go 1.27.3 rejects certificate chains containing any of the eight compromised
eMudhra intermediate CA public keys. OpenBao connections use the configured CA
bundle. OAuth token requests use system roots when
auth.jwt.oauth2.caCertFile is omitted; setting that field replaces system
roots with the configured bundle. Replace affected certificates before using
the updated provider. Keep TLS verification enabled.

This release also includes the Go 1.27.2 security fixes and updates
golang.org/x/net to v0.60.0 for the October HTTP/2 fixes. These updates do
not change the separate OpenBao or Kubernetes API server binaries. See the
Go security fix,
Go release history, and
HTTP/2 advisory.

Authentication

The provider can obtain signed JWT access tokens through native OAuth 2.0
client credentials and exchange them for OpenBao tokens. Select
auth.jwt.source: oauth2 and configure either client_secret_basic or
client_secret_post. The issuer, its storage, DNS, routing, TLS trust, and
client-secret provisioning must work while the protected API server is down.
Opaque access tokens and interactive flows are outside this integration.

Existing file JWT configurations can omit auth.jwt.source only when
jwtFile is set and no oauth2 section is present. Empty source values and
mixed file/OAuth settings fail validation. OAuth authentication never falls
back to a JWT file or another authentication method.

OAuth and OpenBao tokens remain in memory. OpenBao token renewal does not
request another OAuth token; an issuer outage can leave an existing OpenBao
token usable. New logins require the issuer. Disabling an OAuth client does
not revoke OpenBao tokens already issued to it. The client-secret file is
reread before each grant, so atomic replacement supports credential rotation.

Installation and artifacts

init generates matching provider configuration, policy, OpenBao setup,
installation records, and per-node node-setup.sh scripts. Review generated
files before applying them. Stage the new KMS reader on every API server
before enabling KMS writes. Importing an existing encryption configuration or
retiring its previous readers remains outside this onboarding procedure.

Architecture-specific systemd and static-pod kits include the matching host
binary. The static-pod kit records the provider image digest. Linux control-plane
nodes can use systemd or kubelet static pods. A DaemonSet inside the protected
cluster remains unsupported.

The release includes macOS amd64 and arm64 binaries for workstation CLI
commands such as init and policy. They do not run the provider service;
serve refuses to start outside Linux.

New file-JWT static-pod scaffolds mount a dedicated credential directory
read-only so atomic JWT replacement remains visible. Existing file mounts are
not changed automatically. The file-mount correction does not provide a
migration from an earlier preview's registry state.

Rotation and recovery

Pending versions can decrypt but cannot encrypt before promotion. A restart or
recovery from an unconfirmed observation save restarts the full activation
delay. Local elapsed time bounds token leases, cached status, and retry
cooldowns; a backward clock correction cannot restore an observed expired lease
or status result.

retire-versions removes reviewed historical identities from local decryption.
restore-versions can restore selected removed records while the matching
Transit versions remain decryptable. Applying either plan requires the
provider to be stopped and the exact reviewed --expected-state-hash.
Apply retirement consistently on every node before raising OpenBao minimum
versions. Retained etcd backups can still need those versions.

Removed identities stay in hashed state and do not reappear during normal
rotation. Older binaries that do not understand these records reject the state.
Do not downgrade or erase the records to bypass that rejection. State mutation
and serve share a writer lock, and the state directory must be owned by the
provider's OS user.

Configuration and CLI changes

Configuration validation rejects implicit scalar coercion, invalid Transit key
names, a probe interval at or above the status staleness window, a renewal
increment at or below the refresh lead time, and duplicate fixed health and
metrics endpoints. Preserve identity-bearing values rather than renaming them
to bypass validation.

Invalid command usage returns exit code 2. Unreadable or malformed
configuration returns 3; diagnostic failures remain 4, and runtime
failures remain 5. Update scripts that previously matched the unclassified
exit code 1 for usage or configuration errors.

Qualification scope

The candidate qualification targets the eight digest-pinned combinations of
OpenBao 2.7.0 and 2.6.3 with Kubernetes 1.34.11, 1.35.8, 1.36.4, and
1.37.0. The tagged release workflow runs OpenBao integration suites against
both OpenBao versions and the four Kubernetes lanes using the primary OpenBao
version. These are separate checks; the tagged workflow does not repeat every
cross-pair. The Transit profile is aes256-gcm96. KMS v1, other Transit key
types, external Transit keys, unlisted versions, production availability, and
performance guarantees are outside this scope.

Tagged installation checks validate the selected archives and native packages,
including init, node-setup.sh, file ownership, and reinstallation. The
separate Provider Qualification workflow checks live generated-kit acceptance
with three API servers.

The exact tagged artifacts must pass the required integration, installation,
recovery, reproducibility, vulnerability scanning, signature, SBOM, and
provenance checks before publication. A passing build or earlier candidate
qualification does not qualify different release artifacts or an adopter's
platform.

0.1.0-preview.3 (2026-10-20)

Features

• auth: add native OAuth client credentials (185a53b)
• cli: add init to generate matching deployment files (#82) (8410475)
• cli: verify running provider sockets under the caller identity (#120) (94b5e2b)
• distribution: add pinned release downloads and offline transfer guidance (#118) (a8e69c6)
• init: generate a per-node node-setup.sh (#145) (cbefdcc)
• init: record installation inputs and stage KMS readers (#115) (e472b98)
• lab: add OAuth client credentials dev environment (#154) (9b25687)
• metrics: expose runtime and process health signals (#104) (19d1a45)
• packaging: ship complete architecture-specific installation kits (#117) (06b94df)

Bug Fixes

• auth: bound PKCS#11 session pool waits (#84) ([dbb2739](dbb27...

0.1.0-preview.2

Evaluation preview

0.1.0-preview.2 is for labs, staging, and evaluation. It is not approved for production control planes and does not introduce an LTS or production support commitment.

Security and reliability changes

• Reject all OpenBao HTTP redirects. Earlier previews could forward OpenBao tokens, login JWTs, or Transit encryption material when an HTTPS endpoint redirected a request. Redirects now fail with a redacted unavailable error before the destination receives a request.
• Update the Go toolchain to 1.26.6, gRPC to 1.83.2, and other dependencies to include security fixes accumulated since 0.1.0-preview.1.
• Bound OpenBao HTTP response bodies and concurrent KMS requests.
• Enforce Transit disable_upsert=true during startup and metadata probes.
• Correct metadata/deep-probe health handling and token use, and stabilize the OpenBao HA test fixtures.
• Download the pinned CI security scanner directly from its release with bounded retries and a repository-pinned archive checksum.

Before upgrading

1. Ensure openbao.address serves requests without HTTP redirects. For HA, use OpenBao server-side request forwarding or an endpoint routed to the active node. HTTPS and same-origin redirects are also rejected.
2. Configure the dedicated Transit mount with disable_upsert=true. Grant the provider policy read on <transit-mount>/config/keys, in addition to the documented key metadata, encrypt, and decrypt permissions.
3. Preserve provider registry state, its checkpoint, and identity-bearing configuration. Retain compatible OpenBao and etcd backups.
4. Run the new provider's doctor command before upgrading one control-plane node at a time.

KMS v2, key ID derivation, annotations, and AAD formats are unchanged from 0.1.0-preview.1. The stricter transport and Transit checks can reject deployments that previously started with unsafe or unsupported settings.

Evaluation scope

The release gate targets OpenBao 2.6.0 and the digest-pinned Kubernetes 1.34 and 1.35 Kind lanes. Public binary and container artifacts use JWT authentication. Other Kubernetes/OpenBao versions and production capacity or availability guarantees are outside this preview's scope.

The release workflow validates OpenBao and Kind integration, failure handling, HA, rotation, restore, upgrade/rollback, and bounded load scenarios. It also checks source/image vulnerabilities, reproducibility, signatures, SBOMs, and provenance. This release does not constitute an independent security audit or renewed qualification of the local kubeadm VM harness.

0.1.0-preview.2 (2026-09-21)

Features

• tooling: add pinned devenv environment (#57) (07d6fa7)

Bug Fixes

• ci: update Go toolchain to 1.26.4 (#24) (aa82b2d)
• ci: update Go toolchain to 1.26.6 (#56) (0ed6c91)
• deps: update gRPC to 1.83.2 for GO-2026-6443 (#68) (25948aa)
• deps: update x/mod to v0.40.0 (#61) (208a27e)
• kmsv2: bound concurrent requests (#53) (1f20f10)
• openbao: bound HTTP response bodies (#52) (82854c2)
• openbao: reject redirects before forwarding credentials (228f0a2)
• status: correct probe health and token use (#50) (7c59a38)
• status: enforce Transit disable_upsert at runtime (#51) (1582938)
• test: stabilize nightly OpenBao E2E fixtures (60e149d)

0.1.0-preview.1

0.1.0-preview.1 (2026-05-14)

Features

• auth: add certificate login source (24b7e26)
• auth: add JWT token lifecycle (58dca68)
• auth: add pkcs11 and spiffe cert providers (f28c51a)
• auth: validate certificate identity material (2259ca9)
• build: add cert auth artifact targets (6f9a97e)
• cli: add OpenBao policy generator (cbd4b3b)
• cli: add operational command suite (87167bb)
• cli: include capabilities self policy (9cf2867)
• cli: initialize provider command scaffold (26e51b0)
• cli: support configured auth in diagnostics (332a095)
• config: add auth clock skew leeway (0e83cbe)
• config: add nested auth method configuration (f6cf421)
• config: implement strict validation and schema export (62d97a0)
• deploy: add Grafana observability dashboard (4387c86)
• deploy: add linux release packages (0c9318e)
• deploy: add WS10 packaging artifacts (72b7e2b)
• keys: add key registry and AAD metadata primitives (224eb7d)
• keys: complete decrypt preflight and registry state (90813c4)
• kmsv2: add KMS v2 protocol server (89a34e4)
• metrics: expose cert auth certificate ttl (da083dd)
• observability: add metrics logging and debug correlation (d9fbbfe)
• openbao: add certificate auth login client (daaf431)
• openbao: add transit client (149f9e0)
• provider: harden release contract (dfea900)
• runtime: add socket and health lifecycle (e053f69)
• status: add diagnostics and circuit breaker (30f349c)
• status: add status cache and rotation watcher (7e4edc4)

Bug Fixes

• aad: use fqdn kms annotation keys (6a71875)
• auth: complete local cert auth diagnostics (3ce210b)
• auth: fail closed on JWT identity drift (62014e5)
• auth: harden pkcs11 certificate inputs (ca52d15)
• auth: propagate cert provider handshake context (9cd0a92)
• auth: satisfy cert auth lint checks (2ce196d)
• ci: clear core quality lint failures (938dbdb)
• ci: make deployment verification portable (7afe405)
• config: gate spiffe cert auth source (0d39006)
• config: restrict environment overrides (bddbe56)
• deploy: align OpenBao policy samples (c39c145)
• deploy: scope OpenTofu module to OpenBao setup (d517d19)
• deps: update go-jose security patch (1a32965)
• docs: publish mermaid vendor asset (#11) (8ba9197)
• docs: repair pages rendering (#10) (0c7f539)
• e2e: allow HA client sample writes in CI (f53e65c)
• e2e: isolate OpenBao release gate lanes (5a7faac)
• e2e: make OpenBao startup portable in CI (27a9a3b)
• e2e: stabilize OpenBao soak lanes (5c2d1df)
• e2e: wait for node-local kind apiserver restarts (82469b8)
• keyregistry: harden registry state persistence (559da1a)
• kmsv2: enforce protocol boundary limits (01f92e8)
• kmsv2: preserve OpenBao availability classes (8d8ea11)
• kmsv2: preserve transit error semantics (c574a23)
• openbao: enforce supported transit key type (0746798)
• rotation: reject unsafe CLI state rebuilds (459698d)
• rotation: retain skipped transit versions (6bbde35)
• runtime: harden diagnostics and OpenBao transport (fd5bc3c)
• runtime: harden transit identity validation (c41d358)
• security: harden provider socket and auth lifecycle (ac69018)
• state: explain bootstrap denial reasons (8b0b5a0)
• state: surface checkpoint rollback posture (3901959)
• status: fail closed on unsafe registry recovery (89ceb41)

Miscellaneous Chores

• release: prepare 0.1.0-preview.1 (#14) (642485b)