sean/openbao-operator
Watch
1
0
Fork
You've already forked openbao-operator
 0
Code Issues Pull requests Projects Releases 30 Packages Wiki Activity
30 releases 74 tags
  • v0.12.26 dcd35649f5

    v0.12.26 Stable

    pipeline-bot released this 2026-07-23 15:12:00 +00:00 | 34 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.12.25 -> v0.12.26)

    • 3d26cac68858 fix(secrets): reclaim stale ownerless destinations
    • 51ae3c63fd60 fix(secrets): validate auth reference contracts
    Downloads
  • v0.12.25 fa578a484e

    v0.12.25 Stable

    pipeline-bot released this 2026-07-23 14:50:02 +00:00 | 39 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.12.24 -> v0.12.25)

    • 4c9c616b204a feat(secrets): make destination adoption explicit
    Downloads
  • v0.12.24 ce3ca23051

    v0.12.24 Stable

    pipeline-bot released this 2026-07-23 14:16:27 +00:00 | 43 commits to trunk since this release

    Fixed

    • Bring the legacy secret-sync CRDs onto the same Kubernetes status contract as
      the native controllers: OpenBaoAuth, OpenBaoConnection, and
      OpenBaoDynamicSecret now publish current-generation Ready conditions and
      observedGeneration, while retaining their legacy status fields. Status
      writes retry conflicts, recovered auth resources clear stale errors, failed
      DynamicSecret syncs remain retryable, and public conditions redact OpenBao
      response bodies.
    • Replace the shared, concurrency-unsafe math/rand.Rand used for lease jitter
      with bounded crypto/rand sampling and overflow-safe duration arithmetic.
    • Regenerate dist/install.yaml from the current manifests and v0.12.23 image,
      repairing the stale v0.12.3 pin and missing released CRD fields.

    Included changes (v0.12.23 -> v0.12.24)

    • 4cf45281d5c6 fix(secrets): standardize status and lease jitter
    Downloads
  • v0.12.23 c27556c4af

    v0.12.23 Stable

    pipeline-bot released this 2026-07-23 13:19:38 +00:00 | 47 commits to trunk since this release

    Fixed

    • Preserve the typed OpenBao API error chain for database-connection and GCP
      secrets-engine writes while keeping request/response secrets redacted. Safe
      status-code classification, retry policy, auth-cache eviction, metrics, and
      operation hooks now work on these sensitive endpoints without exposing bodies
      or URLs in conditions and logs.

    Changed

    • Bump libseanfarm-operator v0.4.12 → v0.4.13 so best-effort progress and
      failure conditions survive routine Kubernetes status-update conflicts.

    Included changes (v0.12.22 -> v0.12.23)

    • 419e82c821b7 chore(deps): bump libseanfarm-operator to v0.4.13
    • ac99b46388ae fix(client): preserve safe API error classification
    Downloads
  • v0.12.22 997eca8e47

    v0.12.22 Stable

    pipeline-bot released this 2026-07-21 09:47:22 +00:00 | 52 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.12.21 -> v0.12.22)

    • baeb6b734ae2 chore: remove confirmed-dead code (dead-code hunt)
    Downloads
  • v0.12.21 5b206bcc30

    v0.12.21 Stable

    pipeline-bot released this 2026-07-17 11:16:36 +00:00 | 56 commits to trunk since this release

    Changed

    • Bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt the lib's canonical operator.mk scaffolding: vendor it and shrink the Makefile to project vars + repo-specific targets (build/docker/sign/installer/e2e/deploy) — the shared dev-loop targets and tool pins (manifests/generate/fmt/vet/test/lint*, Dependencies) now come from the include, re-synced by the lib-bump autoland on every lib release. make test picks up the shared defaults (adds -covermode=atomic).

    Included changes (v0.12.20 -> v0.12.21)

    • ca01c76980a5 chore(scaffolding): adopt operator.mk (lib v0.4.12)
    • 3321eb4ad91a chore(deps): bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump)
    Downloads
  • v0.12.20 34c19bb2ac

    v0.12.20 Stable

    pipeline-bot released this 2026-07-16 16:26:35 +00:00 | 62 commits to trunk since this release

    Changed

    • Bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt v0.4.11's shared reconcile.Metrics kit + Config.IsRemoteGone: deleted the ~300-line
      hand-rolled generic metrics kit (internal/metrics middleware, the 13 AsReconciler wrappers,
      and openbaoclient's per-call recording). The lib harness now records
      openbao_operator_reconcile_total{controller,result} / _reconcile_duration_seconds{controller}
      (same names/labels; result is now success|error — requeue passes count as success) plus the
      NEW openbao_operator_status_update_total{controller,result}. METRIC RENAME:
      openbao_operator_openbao_requests_total{operation,status} ->
      openbao_operator_api_calls_total{controller="openbaoclient",operation,status} and
      openbao_operator_openbao_request_duration_seconds{operation} ->
      openbao_operator_api_call_duration_seconds{controller,operation} (operation + status label
      VALUES unchanged); openbao_operator_openbao_errors_total{error_type} is dropped with the
      hand-rolled classifier. Domain families (certificate expiry/renewals/issued, resources_total)
      stay operator-side in internal/metrics/domain.go. The delete not-found fold moved from the
      harness adapter's inline check onto Config.IsRemoteGone — behavior identical (already-gone
      remotes still release the finalizer), now proven by a dedicated harness test injecting a raw 404.

    Included changes (v0.12.19 -> v0.12.20)

    • bbe9f4ca7891 chore(metrics): adopt libseanfarm reconcile.Metrics + IsRemoteGone (delete ~300-line hand-rolled kit)
    • 03e25d04064c chore(deps): bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump)
    Downloads
  • v0.12.19 a7185d5a8a

    v0.12.19 Stable

    pipeline-bot released this 2026-07-15 18:37:23 +00:00 | 68 commits to trunk since this release

    Changed

    • Bump libseanfarm-operator v0.4.9 -> v0.4.10 and dedup onto reconcile/testkit:
      deleted the dead StatusUpdateWithRetry (zero production callers since the harness
      migration) + its 3 pure-helper tests and local conflict double; deleted the finalizer/
      StatusUpdateBestEffort delegation tests and 2 generic harness lifecycle tests (now lib
      coverage at the source); shrank the 6-test timestamp suite to the one openbao-specific
      drift-skip wiring test; scheme/client/getter helpers + envtest bootstrap now ride the
      shared testkit. Net ~-700 lines of duplicated test scaffolding.

    Included changes (v0.12.18 -> v0.12.19)

    • f8fea04c61c8 chore(deps): bump libseanfarm-operator v0.4.9 -> v0.4.10 + dedup tests onto reconcile/testkit
    Downloads
  • v0.12.18 f516659b34

    v0.12.18 Stable

    pipeline-bot released this 2026-07-15 16:05:03 +00:00 | 72 commits to trunk since this release

    Changed

    • Bump libseanfarm-operator v0.4.7 -> v0.4.9: picks up the six shared-harness fixes from
      the R5 bug-hunt (dry-run delete no longer touches the remote, Degraded message truncation,
      Progressing cleared on failure, dry-run clears stale Degraded/Progressing, empty
      Ready=False reason defaults to NotReady instead of a silently-swallowed 422,
      dry-run converge now runs MirrorStatus).

    Included changes (v0.12.17 -> v0.12.18)

    • 0a88ce07976b fix(deps): bump libseanfarm-operator v0.4.7 -> v0.4.9
    Downloads
  • v0.12.17 c8cede1e29

    v0.12.17 Stable

    pipeline-bot released this 2026-07-15 14:21:20 +00:00 | 76 commits to trunk since this release

    Fixed

    • PKI roles no longer re-Put (and re-emit an "Updated" event) on every reconcile. OpenBao returns
      a role's ttl/max_ttl on read as integer seconds, not the duration string it was written with, so
      the drift-skip's string compare was never equal and thrashed. Both sides are now normalized to a
      duration before comparing — which kills the thrash while still repairing genuine out-of-band ttl/
      max_ttl drift on these security-spine roles (an unset spec TTL no longer loops against OpenBao's
      default).
    • A GCP secrets backend spec edit no longer permanently parks the engine. The mount-existence check
      was gated behind ObservedGeneration == Generation, so a spec edit (new generation) fell through to
      an unconditional MountGCPSecrets on an already-mounted path → OpenBao 400 "path is already in use" →
      terminal error that never cleared (blocking every roleset that waits on the backend). The reconcile
      now always looks up the mount first and branches mount-if-absent / tune-on-drift (mirroring the PKI
      backend).
    • Transit backend deletion no longer wedges Terminating on an already-gone backend. Delete
      wrapped its errors through classifyOpenBaoError, which stripped the *ResponseError so the harness's
      404-idempotency short-circuit could never fire; under HoldUntilSuccess a 404 held the finalizer
      forever. It now returns the raw error, like the PKI backend.
    • The shared root CA no longer flaps Ready=False "not found" on a transient read. The
      post-rotation re-fetch now runs only when a rotation actually occurred, and a re-fetch error is
      surfaced (requeue, status preserved) instead of being treated as the certificate being absent (which
      wiped SerialNumber/Expiration).
    • A dynamic secret no longer orphans its freshly-minted lease when a status write fails. The new
      lease id is now persisted before the prior lease is revoked, so a failed status update leaves the old
      lease valid (the next reconcile re-mints from a known-good state) rather than losing the new credential
      and breaking the secret.
    • A PKI certificate self-heals a lost Secret payload. If the managed TLS Secret exists but its
      tls.crt/tls.key was emptied out of band, the certificate now re-issues instead of reporting Ready
      with an unusable Secret.

    Included changes (v0.12.16 -> v0.12.17)

    • cbeab048b3d1 fix(openbao): r5 cluster — drift/mount/delete-wedge/refetch/lease/self-heal (6 fixes)
    Downloads