sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 30 Packages Wiki Activity
30 releases 74 tags
  • v0.12.30 e203793533

    v0.12.30 Stable

    pipeline-bot released this 2026-07-27 23:40:47 +00:00 | 14 commits to trunk since this release

    Security

    • Require positive ownership evidence before adopting a destination Secret.
      0.12.2x let destination.overwrite adopt a Secret carrying a complete set of
      operator ownership labels but a different vso-ownerRefUID, treating a
      missing ownerReference as proof the previous resource was gone. It is not —
      ownerReferences are routinely absent after a --cascade=orphan delete, a
      restore, or a write by a version that never set them — and the operator never
      resolves the UID, so it cannot distinguish a replaced resource from a live
      one. One OpenBaoDynamicSecret could therefore take a live destination away
      from another, leaving the loser permanently Degraded with no path back. Any
      operator ownership label that is not ours is now a refusal.

    Fixed

    • Adoption no longer erases a Secret's existing labels and annotations.
      Taking over a destination's data was replacing its metadata wholesale,
      discarding Helm release metadata, ArgoCD tracking annotations, and
      last-applied-configuration, which silently detaches the object from whatever
      manages it. Adoption now merges the configured labels/annotations over what is
      already present. Secrets the resource already owns keep the previous
      replace-from-empty behavior, so removing a label from
      destination.labels still removes it from the Secret.
    • Adopting a pre-existing Secret is logged at Info rather than passing
      silently, since adoption installs an ownerReference that enrolls someone
      else's object in this resource's garbage collection.

    Fixed

    • Bind the response-text error heuristics to the status code that can carry
      them.       normalizeOpenBaoAPIError matched no default issuer, is sealed,
      and standby anywhere in a server-supplied response body, at any status code.
      These sentinels are not cosmetic: ErrNoDefaultIssuer makes GetRootCert and
      GetIntermediateCA report the certificate absent, which makes the controller
      generate a new CA and invalidate every chain issued from the old one — so a
      403 permission denied: no default issuer currently configured was enough to
      trigger a CA regeneration. Likewise a 4xx body containing standby classified
      as server-not-ready and was retried as a dependency blip instead of surfacing
      as the auth failure it was. Each heuristic is now paired with the status code
      OpenBao actually uses (400 / 503 / 429-473); anything else keeps the generic
      API kind.
    • Stop restarting workloads for a credential that did not change. The
      ReReadOnRefresh refresh horizon fed the rollout-restart decision directly, so
      a allowStaticCreds secret whose password was unchanged rolling-restarted every
      target on every refresh interval — the destination Secret is not even rewritten
      in that case (the HMAC short-circuits), so a restarted pod re-read exactly what
      it already had. Restarts are now driven by the credential actually changing, or
      by a spec change that moves the destination or path. Where a re-mint does yield
      new material the sync reports it and the restart still happens.

    Included changes (v0.12.29 -> v0.12.30)

    • 98db99e429bb fix(client): pair response-text heuristics with their status codes
    • 300bfd723c2b fix(secrets): require positive ownership evidence to adopt a destination
    Downloads