sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 30 Packages Wiki Activity
30 releases 74 tags
  • v0.12.36 d72d96bbc0

    Release 1 Build Stable

    binjovi-bot released this 2026-09-09 16:27:38 +00:00 | 0 commits to trunk since this release

    Downloads
  • v0.12.35 7f5aeccf67

    Release 1 Build Stable

    binjovi-bot released this 2026-09-06 14:40:28 +00:00 | 1 commits to trunk since this release

    Downloads
  • v0.12.34 35718537b1

    Release 1 Build Stable

    binjovi-bot released this 2026-09-02 05:47:18 +00:00 | 4 commits to trunk since this release

    Downloads
  • v0.12.33 5ec63c6789

    v0.12.33 Stable

    pipeline-bot released this 2026-08-07 18:06:03 +00:00 | 7 commits to trunk since this release

    Changes

    • docs(agents): require ASD-STE100 Simplified Technical English (PR #97) — sean, 29c8d138ada08b9f4573e81b474f51d246eb7597
    • docs: rewrite documentation to ASD-STE100 (PR #98) — sean, 5ec63c6789f3cefd3f0349db14c93a61a8bb24a5
    Downloads
  • v0.12.32 36a0863d42

    v0.12.32 Stable

    pipeline-bot released this 2026-08-06 10:27:40 +00:00 | 9 commits to trunk since this release

    Changes

    • fix(security): constrain auth endpoints and certificate issuance (PR #96) — sean, 36a0863d427e61f7c18fe4b4a01ce91308dee996
    Downloads
  • v0.12.31 7c4ea5045c

    v0.12.31 Stable

    pipeline-bot released this 2026-07-28 14:59:26 +00:00 | 10 commits to trunk since this release

    Fixed

    • Set lastRenewal when restoring a client from the cache storage entry.
      Restore() assigned authSecret but left lastRenewal at zero, and
      checkExpiry() treats it as an absolute timestamp — so the token's expiry
      horizon was measured from the Unix epoch and every restored client was
      declared expired. Client persistence therefore never survived an operator
      restart: each cache hit was discarded and re-logged-in.
    • Pass the error as an argument rather than as the format string in the
      lease-ID-changed Event. A lease ID containing a % verb would otherwise
      corrupt the rendered event.
    • Render the revoke-failure Event through the same sanitizer the status
      conditions use. Events are readable by anyone with get on the namespace
      while the Secret is not, so a raw client error there could surface an OpenBao
      response body.

    Removed

    • ErrEncryptionRequired and RemoveAllFinalizers — both had zero callers
      after the 07-24 static-analysis pass renamed/re-signed them.

    Included changes (v0.12.30 -> v0.12.31)

    • 8063b88634ed fix(secretsync): set lastRenewal on Restore so persisted clients aren't declared expired
    • 7c32d6456cfe chore(hygiene): sanitize two Events, drop two dead exports
    Downloads
  • v0.12.30 e203793533

    v0.12.30 Stable

    pipeline-bot released this 2026-07-27 23:40:47 +00:00 | 14 commits to trunk since this release

    Security

    • Require positive ownership evidence before adopting a destination Secret.
      0.12.2x let destination.overwrite adopt a Secret carrying a complete set of
      operator ownership labels but a different vso-ownerRefUID, treating a
      missing ownerReference as proof the previous resource was gone. It is not —
      ownerReferences are routinely absent after a --cascade=orphan delete, a
      restore, or a write by a version that never set them — and the operator never
      resolves the UID, so it cannot distinguish a replaced resource from a live
      one. One OpenBaoDynamicSecret could therefore take a live destination away
      from another, leaving the loser permanently Degraded with no path back. Any
      operator ownership label that is not ours is now a refusal.

    Fixed

    • Adoption no longer erases a Secret's existing labels and annotations.
      Taking over a destination's data was replacing its metadata wholesale,
      discarding Helm release metadata, ArgoCD tracking annotations, and
      last-applied-configuration, which silently detaches the object from whatever
      manages it. Adoption now merges the configured labels/annotations over what is
      already present. Secrets the resource already owns keep the previous
      replace-from-empty behavior, so removing a label from
      destination.labels still removes it from the Secret.
    • Adopting a pre-existing Secret is logged at Info rather than passing
      silently, since adoption installs an ownerReference that enrolls someone
      else's object in this resource's garbage collection.

    Fixed

    • Bind the response-text error heuristics to the status code that can carry
      them.       normalizeOpenBaoAPIError matched no default issuer, is sealed,
      and standby anywhere in a server-supplied response body, at any status code.
      These sentinels are not cosmetic: ErrNoDefaultIssuer makes GetRootCert and
      GetIntermediateCA report the certificate absent, which makes the controller
      generate a new CA and invalidate every chain issued from the old one — so a
      403 permission denied: no default issuer currently configured was enough to
      trigger a CA regeneration. Likewise a 4xx body containing standby classified
      as server-not-ready and was retried as a dependency blip instead of surfacing
      as the auth failure it was. Each heuristic is now paired with the status code
      OpenBao actually uses (400 / 503 / 429-473); anything else keeps the generic
      API kind.
    • Stop restarting workloads for a credential that did not change. The
      ReReadOnRefresh refresh horizon fed the rollout-restart decision directly, so
      a allowStaticCreds secret whose password was unchanged rolling-restarted every
      target on every refresh interval — the destination Secret is not even rewritten
      in that case (the HMAC short-circuits), so a restarted pod re-read exactly what
      it already had. Restarts are now driven by the credential actually changing, or
      by a spec change that moves the destination or path. Where a re-mint does yield
      new material the sync reports it and the restart still happens.

    Included changes (v0.12.29 -> v0.12.30)

    • 98db99e429bb fix(client): pair response-text heuristics with their status codes
    • 300bfd723c2b fix(secrets): require positive ownership evidence to adopt a destination
    Downloads
  • v0.12.29 faf51b0b2f

    v0.12.29 Stable

    pipeline-bot released this 2026-07-24 09:58:33 +00:00 | 19 commits to trunk since this release

    Changed

    • Make OpenBaoDatabaseStaticRole.spec.backend and .spec.name immutable.
      Moving either identity field could leave two OpenBao static roles
      independently rotating the same database user's password.

    Fixed

    • Normalize OpenBao 404, sealed, standby, and missing-default-issuer responses
      into body-safe typed errors at the client boundary. Reconcile classification
      no longer depends on error-string heuristics, while preserving the upstream
      HTTP response type for status, authentication, and retry decisions.

    Included changes (v0.12.28 -> v0.12.29)

    • ec549f27d793 fix(client): normalize OpenBao API error kinds
    • fe260a77ce7d fix(static-role): make remote identity immutable
    Downloads
  • v0.12.28 6e6b6a5566

    v0.12.28 Stable

    pipeline-bot released this 2026-07-24 05:33:58 +00:00 | 24 commits to trunk since this release

    Changed

    • Clear the static-analysis backlog, including ignored owner-label errors,
      nil logging contexts, deprecated helpers, and unreachable code.

    Fixed

    • Route every typed OpenBao API operation through the shared result recorder,
      ensuring 401/403 responses evict the cached client instead of reusing a
      revoked token for up to the 12-hour cache TTL.

    Security

    • Upgrade golang.org/x/net and golang.org/x/text to fixed versions for
      reachable HTTP/2, IDNA, and Unicode-normalization vulnerabilities.

    Included changes (v0.12.27 -> v0.12.28)

    • 96fbc75b433c chore(quality): clear static analysis backlog
    • a20fa7a1a12e fix(security): upgrade reachable vulnerable dependencies
    • 707808a44ea5 fix(client): evict revoked tokens for every API call
    Downloads
  • v0.12.27 c507931202

    v0.12.27 Stable

    pipeline-bot released this 2026-07-23 15:31:30 +00:00 | 30 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.12.26 -> v0.12.27)

    • ee920f33d0dc fix(auth): validate credential method configuration
    Downloads