sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 23 Packages Wiki Activity
23 releases 67 tags
  • v0.12.29 faf51b0b2f

    v0.12.29 Stable

    pipeline-bot released this 2026-07-24 09:58:33 +00:00 | 0 commits to main since this release

    Changed

    • Make OpenBaoDatabaseStaticRole.spec.backend and .spec.name immutable.
      Moving either identity field could leave two OpenBao static roles
      independently rotating the same database user's password.

    Fixed

    • Normalize OpenBao 404, sealed, standby, and missing-default-issuer responses
      into body-safe typed errors at the client boundary. Reconcile classification
      no longer depends on error-string heuristics, while preserving the upstream
      HTTP response type for status, authentication, and retry decisions.

    Included changes (v0.12.28 -> v0.12.29)

    • ec549f27d793 fix(client): normalize OpenBao API error kinds
    • fe260a77ce7d fix(static-role): make remote identity immutable
    Downloads
  • v0.12.28 6e6b6a5566

    v0.12.28 Stable

    pipeline-bot released this 2026-07-24 05:33:58 +00:00 | 5 commits to main since this release

    Changed

    • Clear the static-analysis backlog, including ignored owner-label errors,
      nil logging contexts, deprecated helpers, and unreachable code.

    Fixed

    • Route every typed OpenBao API operation through the shared result recorder,
      ensuring 401/403 responses evict the cached client instead of reusing a
      revoked token for up to the 12-hour cache TTL.

    Security

    • Upgrade golang.org/x/net and golang.org/x/text to fixed versions for
      reachable HTTP/2, IDNA, and Unicode-normalization vulnerabilities.

    Included changes (v0.12.27 -> v0.12.28)

    • 96fbc75b433c chore(quality): clear static analysis backlog
    • a20fa7a1a12e fix(security): upgrade reachable vulnerable dependencies
    • 707808a44ea5 fix(client): evict revoked tokens for every API call
    Downloads
  • v0.12.27 c507931202

    v0.12.27 Stable

    pipeline-bot released this 2026-07-23 15:31:30 +00:00 | 11 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.12.26 -> v0.12.27)

    • ee920f33d0dc fix(auth): validate credential method configuration
    Downloads
  • v0.12.26 dcd35649f5

    v0.12.26 Stable

    pipeline-bot released this 2026-07-23 15:12:00 +00:00 | 15 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.12.25 -> v0.12.26)

    • 3d26cac68858 fix(secrets): reclaim stale ownerless destinations
    • 51ae3c63fd60 fix(secrets): validate auth reference contracts
    Downloads
  • v0.12.25 fa578a484e

    v0.12.25 Stable

    pipeline-bot released this 2026-07-23 14:50:02 +00:00 | 20 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.12.24 -> v0.12.25)

    • 4c9c616b204a feat(secrets): make destination adoption explicit
    Downloads
  • v0.12.24 ce3ca23051

    v0.12.24 Stable

    pipeline-bot released this 2026-07-23 14:16:27 +00:00 | 24 commits to main since this release

    Fixed

    • Bring the legacy secret-sync CRDs onto the same Kubernetes status contract as
      the native controllers: OpenBaoAuth, OpenBaoConnection, and
      OpenBaoDynamicSecret now publish current-generation Ready conditions and
      observedGeneration, while retaining their legacy status fields. Status
      writes retry conflicts, recovered auth resources clear stale errors, failed
      DynamicSecret syncs remain retryable, and public conditions redact OpenBao
      response bodies.
    • Replace the shared, concurrency-unsafe math/rand.Rand used for lease jitter
      with bounded crypto/rand sampling and overflow-safe duration arithmetic.
    • Regenerate dist/install.yaml from the current manifests and v0.12.23 image,
      repairing the stale v0.12.3 pin and missing released CRD fields.

    Included changes (v0.12.23 -> v0.12.24)

    • 4cf45281d5c6 fix(secrets): standardize status and lease jitter
    Downloads
  • v0.12.23 c27556c4af

    v0.12.23 Stable

    pipeline-bot released this 2026-07-23 13:19:38 +00:00 | 28 commits to main since this release

    Fixed

    • Preserve the typed OpenBao API error chain for database-connection and GCP
      secrets-engine writes while keeping request/response secrets redacted. Safe
      status-code classification, retry policy, auth-cache eviction, metrics, and
      operation hooks now work on these sensitive endpoints without exposing bodies
      or URLs in conditions and logs.

    Changed

    • Bump libseanfarm-operator v0.4.12 → v0.4.13 so best-effort progress and
      failure conditions survive routine Kubernetes status-update conflicts.

    Included changes (v0.12.22 -> v0.12.23)

    • 419e82c821b7 chore(deps): bump libseanfarm-operator to v0.4.13
    • ac99b46388ae fix(client): preserve safe API error classification
    Downloads
  • v0.12.22 997eca8e47

    v0.12.22 Stable

    pipeline-bot released this 2026-07-21 09:47:22 +00:00 | 33 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.12.21 -> v0.12.22)

    • baeb6b734ae2 chore: remove confirmed-dead code (dead-code hunt)
    Downloads
  • v0.12.21 5b206bcc30

    v0.12.21 Stable

    pipeline-bot released this 2026-07-17 11:16:36 +00:00 | 37 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt the lib's canonical operator.mk scaffolding: vendor it and shrink the Makefile to project vars + repo-specific targets (build/docker/sign/installer/e2e/deploy) — the shared dev-loop targets and tool pins (manifests/generate/fmt/vet/test/lint*, Dependencies) now come from the include, re-synced by the lib-bump autoland on every lib release. make test picks up the shared defaults (adds -covermode=atomic).

    Included changes (v0.12.20 -> v0.12.21)

    • ca01c76980a5 chore(scaffolding): adopt operator.mk (lib v0.4.12)
    • 3321eb4ad91a chore(deps): bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump)
    Downloads
  • v0.12.20 34c19bb2ac

    v0.12.20 Stable

    pipeline-bot released this 2026-07-16 16:26:35 +00:00 | 43 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt v0.4.11's shared reconcile.Metrics kit + Config.IsRemoteGone: deleted the ~300-line
      hand-rolled generic metrics kit (internal/metrics middleware, the 13 AsReconciler wrappers,
      and openbaoclient's per-call recording). The lib harness now records
      openbao_operator_reconcile_total{controller,result} / _reconcile_duration_seconds{controller}
      (same names/labels; result is now success|error — requeue passes count as success) plus the
      NEW openbao_operator_status_update_total{controller,result}. METRIC RENAME:
      openbao_operator_openbao_requests_total{operation,status} ->
      openbao_operator_api_calls_total{controller="openbaoclient",operation,status} and
      openbao_operator_openbao_request_duration_seconds{operation} ->
      openbao_operator_api_call_duration_seconds{controller,operation} (operation + status label
      VALUES unchanged); openbao_operator_openbao_errors_total{error_type} is dropped with the
      hand-rolled classifier. Domain families (certificate expiry/renewals/issued, resources_total)
      stay operator-side in internal/metrics/domain.go. The delete not-found fold moved from the
      harness adapter's inline check onto Config.IsRemoteGone — behavior identical (already-gone
      remotes still release the finalizer), now proven by a dedicated harness test injecting a raw 404.

    Included changes (v0.12.19 -> v0.12.20)

    • bbe9f4ca7891 chore(metrics): adopt libseanfarm reconcile.Metrics + IsRemoteGone (delete ~300-line hand-rolled kit)
    • 03e25d04064c chore(deps): bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump)
    Downloads