sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 23 Packages Wiki Activity
23 releases 67 tags
  • v0.12.17 c8cede1e29

    v0.12.17 Stable

    pipeline-bot released this 2026-07-15 14:21:20 +00:00 | 57 commits to main since this release

    Fixed

    • PKI roles no longer re-Put (and re-emit an "Updated" event) on every reconcile. OpenBao returns
      a role's ttl/max_ttl on read as integer seconds, not the duration string it was written with, so
      the drift-skip's string compare was never equal and thrashed. Both sides are now normalized to a
      duration before comparing — which kills the thrash while still repairing genuine out-of-band ttl/
      max_ttl drift on these security-spine roles (an unset spec TTL no longer loops against OpenBao's
      default).
    • A GCP secrets backend spec edit no longer permanently parks the engine. The mount-existence check
      was gated behind ObservedGeneration == Generation, so a spec edit (new generation) fell through to
      an unconditional MountGCPSecrets on an already-mounted path → OpenBao 400 "path is already in use" →
      terminal error that never cleared (blocking every roleset that waits on the backend). The reconcile
      now always looks up the mount first and branches mount-if-absent / tune-on-drift (mirroring the PKI
      backend).
    • Transit backend deletion no longer wedges Terminating on an already-gone backend. Delete
      wrapped its errors through classifyOpenBaoError, which stripped the *ResponseError so the harness's
      404-idempotency short-circuit could never fire; under HoldUntilSuccess a 404 held the finalizer
      forever. It now returns the raw error, like the PKI backend.
    • The shared root CA no longer flaps Ready=False "not found" on a transient read. The
      post-rotation re-fetch now runs only when a rotation actually occurred, and a re-fetch error is
      surfaced (requeue, status preserved) instead of being treated as the certificate being absent (which
      wiped SerialNumber/Expiration).
    • A dynamic secret no longer orphans its freshly-minted lease when a status write fails. The new
      lease id is now persisted before the prior lease is revoked, so a failed status update leaves the old
      lease valid (the next reconcile re-mints from a known-good state) rather than losing the new credential
      and breaking the secret.
    • A PKI certificate self-heals a lost Secret payload. If the managed TLS Secret exists but its
      tls.crt/tls.key was emptied out of band, the certificate now re-issues instead of reporting Ready
      with an unusable Secret.

    Included changes (v0.12.16 -> v0.12.17)

    • cbeab048b3d1 fix(openbao): r5 cluster — drift/mount/delete-wedge/refetch/lease/self-heal (6 fixes)
    Downloads