Skip to content

0.5.1

Choose a tag to compare

View all tags
@openbao-operator-release-tag openbao-operator-release-tag released this 24 Sep 05:58
· 91 commits to main since this release
Immutable release. Only release title and notes can be modified.
0.5.1
This tag was signed with the committer’s verified signature.
dc-tec Roel de Cort
GPG key ID: A5ABD477540DEB59
Verified
Learn about vigilant mode.
b481303
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenBao Operator 0.5.1 adds OpenBao 2.7.0 compatibility, updates the default
validation target to OpenBao 2.6.3, and includes lifecycle fixes and dependency
updates since 0.5.0.

What 0.5.1 changes

OpenBao 2.6.3 becomes the default validation target. OpenBao 2.7.0 adds external
KMS plugins for seals that earlier OpenBao versions included in the server. The
operator checks for a matching plugin before preparing a 2.7 workload or starting
an upgrade. It also accepts plugin metadata that OpenBao 2.7 can infer, while
retaining the required metadata for earlier versions.

The candidate includes the backup retention and partial-upload fixes, rolling
upgrade conflict retries, BlueGreen rollback and abort guards, restore status
preservation, readiness checks, and dependency updates merged since 0.5.0.

Upgrade from 0.5.0

Finish active OpenBao upgrades, backups, and restores before updating the
operator. Take and verify a current backup. Review the generated CRD comparison
and qualification results for the final candidate commit.

The candidate retains the 0.5.0 API wire format. The plugin version,
binaryName, and sha256sum fields become optional in the CRD. Runtime
validation still requires them when the selected OpenBao version needs them.

Upgrade the operator before changing an OpenBao cluster to 2.7.0. For AWS KMS,
Azure Key Vault, Google Cloud KMS, OCI KMS, and PKCS#11 seals, declare the matching
external KMS plugin and provide its runtime dependencies before changing the
server version. Verify access to the existing seal key and qualify the exact
plugin version against a restored copy of the cluster data.

OpenBao 2.7 also removes some built-in authentication and secrets plugins.
Inventory enabled plugins before the server upgrade. Follow the
OpenBao 2.7 migration procedure
for the operator configuration and upstream migration references.

The SoftHSM fixture uses PKCS#11 plugin 0.1.0. Qualification does not cover vendor
HSMs, cloud KMS access, or the PKCS#11 0.2.0 root-key rewrap transition. The guard
against pre-2.6 to 2.6-or-newer BlueGreen transitions remains in place.

0.5.1 (2026-09-23)

Features

  • compat: qualify OpenBao 2.7 external seal plugins (#762) (94b18f2)

Bug Fixes

  • api: clarify missing TLS rotation period validation (#751) (017a5bd)
  • backup: abort partial uploads when the snapshot stream fails (#759) (6d02c45)
  • backup: keep the newest snapshot when applying retention (#757) (6668b31)
  • backup: limit retention to scheduled backup keys (#758) (7a86183)
  • backup: preserve trigger before job creation (#703) (ee44f8e)
  • metrics: clear finalized reconciliation series (#721) (fc15f5e)
  • metrics: keep cluster phase gauges one-hot (#716) (f4c2e1a)
  • readiness: require synchronized caches and fresh admission checks (#720) (4764ab9)
  • startup: validate platform discovery and return errors (#717) (4197f3c)
  • status: preserve restore state in final adminops patch (#710) (e362877)
  • upgrade: correct peer identity, rollback retries, and rollout verification (2b1f646)
  • upgrade: guard blue/green rollback and preserve active inputs (#755) (ac197df)
  • upgrade: limit blue/green abort to phases before promotion (#754) (6518d2b)
  • upgrade: retry transient rolling partition conflicts (#753) (b029ff6)

Performance Improvements

  • kube: reuse apply responses for ownership verification (#739) (a64fd38)
  • raft: avoid redundant Autopilot configuration writes (#737) (4b80116)
Assets 14
Loading