sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 23 Packages Wiki Activity
23 releases 67 tags
  • v0.12.16 a52400b13d

    v0.12.16 Stable

    pipeline-bot released this 2026-07-14 22:03:50 +00:00 | 61 commits to main since this release

    Fixed

    • Root-CA and transit-key rotation failures no longer report Ready. A root
      certificate (OpenBaoPKIRootCert) or transit key (OpenBaoTransitBackend)
      whose rotation was due and failed was previously only logged, then the CR
      reported Ready — the key/CA silently aged toward expiry while monitoring saw
      green (for a root CA, its expiry breaks every certificate it issued). Both now
      surface the failure: the root cert returns Progressing/Degraded, and a transit
      key whose due rotation fails is no longer counted KeysReady, dropping the
      backend to not-Ready (visible + requeued to retry). Failures are still isolated
      per key; a non-due or disabled rotation is unaffected.
    • PKI certificates with RenewBefore >= lifetime no longer re-mint every
      reconcile.       When RenewBefore (default 7d) was larger than the certificate's
      actual lifetime — a role that caps TTL below 7d, or an explicit
      RenewBefore >= TTL — the computed renewal time landed at or before issuance,
      so certNeedsRenewal fired on every pass and the cert was re-issued every ~5m
      (OpenBao issuance spam + Secret churn + downstream restarts). RenewBefore is
      now clamped below the cert's lifetime so renewal happens once near end-of-life.
    • GCP rolesets no longer re-Put (and re-emit an "Updated" event) on every
      reconcile.       OpenBao returns a roleset's bindings on read as a normalized
      resource→roles map, not the source HCL, so the drift-skip's raw string compare
      (current.Bindings == spec.Bindings) never matched and forced a redundant write
      each reconcile. Bindings are dropped from the drift compare; a genuine bindings
      edit still applies via the metadata.generation bump that bypasses the
      drift-skip entirely.

    Included changes (v0.12.15 -> v0.12.16)

    • ee41bfb54b54 fix(pki,transit,gcp): surface swallowed rotation failures + stop reconcile thrash
    Downloads