sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 23 Packages Wiki Activity
23 releases 67 tags
  • v0.12.19 a7185d5a8a

    v0.12.19 Stable

    pipeline-bot released this 2026-07-15 18:37:23 +00:00 | 49 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.9 -> v0.4.10 and dedup onto reconcile/testkit:
      deleted the dead StatusUpdateWithRetry (zero production callers since the harness
      migration) + its 3 pure-helper tests and local conflict double; deleted the finalizer/
      StatusUpdateBestEffort delegation tests and 2 generic harness lifecycle tests (now lib
      coverage at the source); shrank the 6-test timestamp suite to the one openbao-specific
      drift-skip wiring test; scheme/client/getter helpers + envtest bootstrap now ride the
      shared testkit. Net ~-700 lines of duplicated test scaffolding.

    Included changes (v0.12.18 -> v0.12.19)

    • f8fea04c61c8 chore(deps): bump libseanfarm-operator v0.4.9 -> v0.4.10 + dedup tests onto reconcile/testkit
    Downloads
  • v0.12.18 f516659b34

    v0.12.18 Stable

    pipeline-bot released this 2026-07-15 16:05:03 +00:00 | 53 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.7 -> v0.4.9: picks up the six shared-harness fixes from
      the R5 bug-hunt (dry-run delete no longer touches the remote, Degraded message truncation,
      Progressing cleared on failure, dry-run clears stale Degraded/Progressing, empty
      Ready=False reason defaults to NotReady instead of a silently-swallowed 422,
      dry-run converge now runs MirrorStatus).

    Included changes (v0.12.17 -> v0.12.18)

    • 0a88ce07976b fix(deps): bump libseanfarm-operator v0.4.7 -> v0.4.9
    Downloads
  • v0.12.17 c8cede1e29

    v0.12.17 Stable

    pipeline-bot released this 2026-07-15 14:21:20 +00:00 | 57 commits to main since this release

    Fixed

    • PKI roles no longer re-Put (and re-emit an "Updated" event) on every reconcile. OpenBao returns
      a role's ttl/max_ttl on read as integer seconds, not the duration string it was written with, so
      the drift-skip's string compare was never equal and thrashed. Both sides are now normalized to a
      duration before comparing — which kills the thrash while still repairing genuine out-of-band ttl/
      max_ttl drift on these security-spine roles (an unset spec TTL no longer loops against OpenBao's
      default).
    • A GCP secrets backend spec edit no longer permanently parks the engine. The mount-existence check
      was gated behind ObservedGeneration == Generation, so a spec edit (new generation) fell through to
      an unconditional MountGCPSecrets on an already-mounted path → OpenBao 400 "path is already in use" →
      terminal error that never cleared (blocking every roleset that waits on the backend). The reconcile
      now always looks up the mount first and branches mount-if-absent / tune-on-drift (mirroring the PKI
      backend).
    • Transit backend deletion no longer wedges Terminating on an already-gone backend. Delete
      wrapped its errors through classifyOpenBaoError, which stripped the *ResponseError so the harness's
      404-idempotency short-circuit could never fire; under HoldUntilSuccess a 404 held the finalizer
      forever. It now returns the raw error, like the PKI backend.
    • The shared root CA no longer flaps Ready=False "not found" on a transient read. The
      post-rotation re-fetch now runs only when a rotation actually occurred, and a re-fetch error is
      surfaced (requeue, status preserved) instead of being treated as the certificate being absent (which
      wiped SerialNumber/Expiration).
    • A dynamic secret no longer orphans its freshly-minted lease when a status write fails. The new
      lease id is now persisted before the prior lease is revoked, so a failed status update leaves the old
      lease valid (the next reconcile re-mints from a known-good state) rather than losing the new credential
      and breaking the secret.
    • A PKI certificate self-heals a lost Secret payload. If the managed TLS Secret exists but its
      tls.crt/tls.key was emptied out of band, the certificate now re-issues instead of reporting Ready
      with an unusable Secret.

    Included changes (v0.12.16 -> v0.12.17)

    • cbeab048b3d1 fix(openbao): r5 cluster — drift/mount/delete-wedge/refetch/lease/self-heal (6 fixes)
    Downloads
  • v0.12.16 a52400b13d

    v0.12.16 Stable

    pipeline-bot released this 2026-07-14 22:03:50 +00:00 | 61 commits to main since this release

    Fixed

    • Root-CA and transit-key rotation failures no longer report Ready. A root
      certificate (OpenBaoPKIRootCert) or transit key (OpenBaoTransitBackend)
      whose rotation was due and failed was previously only logged, then the CR
      reported Ready — the key/CA silently aged toward expiry while monitoring saw
      green (for a root CA, its expiry breaks every certificate it issued). Both now
      surface the failure: the root cert returns Progressing/Degraded, and a transit
      key whose due rotation fails is no longer counted KeysReady, dropping the
      backend to not-Ready (visible + requeued to retry). Failures are still isolated
      per key; a non-due or disabled rotation is unaffected.
    • PKI certificates with RenewBefore >= lifetime no longer re-mint every
      reconcile.       When RenewBefore (default 7d) was larger than the certificate's
      actual lifetime — a role that caps TTL below 7d, or an explicit
      RenewBefore >= TTL — the computed renewal time landed at or before issuance,
      so certNeedsRenewal fired on every pass and the cert was re-issued every ~5m
      (OpenBao issuance spam + Secret churn + downstream restarts). RenewBefore is
      now clamped below the cert's lifetime so renewal happens once near end-of-life.
    • GCP rolesets no longer re-Put (and re-emit an "Updated" event) on every
      reconcile.       OpenBao returns a roleset's bindings on read as a normalized
      resource→roles map, not the source HCL, so the drift-skip's raw string compare
      (current.Bindings == spec.Bindings) never matched and forced a redundant write
      each reconcile. Bindings are dropped from the drift compare; a genuine bindings
      edit still applies via the metadata.generation bump that bypasses the
      drift-skip entirely.

    Included changes (v0.12.15 -> v0.12.16)

    • ee41bfb54b54 fix(pki,transit,gcp): surface swallowed rotation failures + stop reconcile thrash
    Downloads
  • v0.12.15 d0cba13132

    v0.12.15 Stable

    pipeline-bot released this 2026-07-14 18:18:00 +00:00 | 65 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.12.14 -> v0.12.15)

    • 06531152c49e fix(openbao): PKI cert spec-drift re-issue + VDS revoke-toggle finalizer wedge
    Downloads
  • v0.12.14 e9ec096846

    v0.12.14 Stable

    pipeline-bot released this 2026-07-14 16:16:40 +00:00 | 69 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.12.13 -> v0.12.14)

    • 06978bc48baf fix(secrets): admit the delete event so finalizer cleanup runs (was leaking on delete)
    Downloads
  • v0.12.13 c4ba54fee8

    v0.12.13 Stable

    pipeline-bot released this 2026-07-13 21:53:50 +00:00 | 73 commits to main since this release

    Fixed

    • Deflake TestReReadOnRefresh_ReMintsAndRevokes. The test set no RenewalPercent, so the
      re-mint horizon was computeDynamicHorizonWithJitter(32d-lease, 0) = 76.8h − jitter (jitter
      uniform in [0, 76.8h)) — i.e. uniform in [0, 76.8h), which lands below the 24h refreshAfter
      cap ~31% of the time, so the "requeue ~24h" assertion failed intermittently (it flaked the
      in-cluster envtest release gate). Set RenewalPercent = 50 so the pre-cap horizon deterministically
      exceeds refreshAfter and the cap is what the test exercises. (Separately worth noting: a real
      ReReadOnRefresh secret with RenewalPercent unset requeues in [0, refreshAfter], occasionally
      near-zero — a re-mint-churn edge worth a follow-up in the controller.)

    Included changes (v0.12.12 -> v0.12.13)

    • bc568eb38ee1 test(secrets): deflake TestReReadOnRefresh_ReMintsAndRevokes
    Downloads
  • v0.12.12 6c38fe3ae7

    v0.12.12 Stable

    pipeline-bot released this 2026-07-13 19:16:51 +00:00 | 77 commits to main since this release

    Fixed

    • Bump libseanfarm-operator v0.4.1 → v0.4.7. Picks up six releases of shared reconcile-
      harness fixes + test coverage the operator was missing, notably the v0.4.4 fix that stops the
      harness stamping ObservedGeneration on a Converge error under ObservedGenOnConvergedOnly.
      Build + full envtest suite green on v0.4.7.

    Included changes (v0.12.11 -> v0.12.12)

    • 10f0022aab8a fix(deps): bump libseanfarm-operator v0.4.1 -> v0.4.7
    • 21d744a1e0ca fix(cicd): auto-resolve CHANGELOG land conflicts via .gitattributes merge=union
    • a46b0d1d8f9f fix(ci): pin golang:1.25 builder base by digest
    • 8f51639c1811 docs(openbaoclient): fix 'a OpenBao' -> 'an OpenBao' grammar in doc comments
    • f1d64a7e63c4 chore(staging): open v0.12.12-dev dev cycle
    Downloads
  • v0.12.11 0097b514b6

    v0.12.11 Stable

    gitea_admin released this 2026-07-01 16:35:04 +00:00 | 87 commits to main since this release

    Changed

    • Release cut through the hardened CI/CD signing path. The multi-arch image is
      cosign-EC signed by a pod whose ServiceAccount is the only one holding the
      signing capability, and dist/install.yaml is now rendered in a separate
      credential-free pod — no project-controlled build step (make) ever shares a
      pod with the signing key or the Forgejo admin token. No functional change to
      the operator.
    Downloads
  • v0.12.10 4e2bedc660

    v0.12.10 Stable

    gitea_admin released this 2026-07-01 13:54:26 +00:00 | 89 commits to main since this release

    Fixed

    • GetCurrentNamespace: bytes.Trim(b, " ") only stripped ASCII spaces, so the
      trailing newline in /var/run/secrets/kubernetes.io/serviceaccount/namespace
      survived and produced a corrupt namespace (e.g. "openbao-platform\n") that
      broke every downstream lookup. Switched to bytes.TrimSpace, which strips all
      leading/trailing whitespace (spaces, tabs, and newlines), plus a regression
      test asserting a trailing-newline input trims clean.
    Downloads