Distribution

Current distribution model

OpenBao Operator uses an Artifact Hub-first distribution model. OCI Helm chart releases are published to GHCR, indexed in Artifact Hub for discovery, and OLM bundle assets remain in-repo and CI-validated rather than being part of the current supported publication surface.

Decision matrix

Distribution surfaces

Distribution surfaces.

Surface	Published now	Current role
GHCR OCI Helm chart	Yes	Canonical chart publication target for released versions.
Artifact Hub package entry	Yes	Discovery and installation entry point for the published chart.
GitHub Release assets	Yes	Installer manifests, CRDs, checksums, SBOMs, and provenance metadata.
OLM bundle assets	Kept in-repo and CI-validated	Preparation surface only; not yet a public distribution contract.
Public OperatorHub submission	No	Explicitly deferred until post-pre-GA maturity and support posture are ready.

Artifact Hub first

The project currently treats Artifact Hub plus GHCR Helm OCI publication as the supported public discovery model. Do not add new public distribution expectations without updating this policy and the release flow that backs it.

Installer manifests are channel artifacts

dist/install.yaml and dist/crds.yaml are local build outputs, not source-controlled distribution assets. Release, edge, and nightly workflows generate fresh manifests from config/ with the target image and operator version, then publish those generated files through the relevant channel.

Decision matrix

Artifact Hub metadata expectations

Artifact Hub metadata expectations.

Metadata area	What must be present
Chart annotations	artifacthub.io/category, license, operator, operatorCapabilities, release changes, image metadata, CRD cards/examples, maintainers, and useful links.
Prerelease and security state	artifacthub.io/prerelease for prereleases, artifacthub.io/changes from the release-please changelog, and artifacthub.io/containsSecurityUpdates when applicable for the release.
Verified ownership	artifacthub-repo.yml with repository ID or ownership information published to the chart OCI path under the artifacthub.io tag.

Apply

Push Artifact Hub repository metadata for the OCI chart

bash

oras push \
ghcr.io/dc-tec/charts/openbao-operator:artifacthub.io \
--config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml

Use this only when artifacthub-repo.yml changes or ownership metadata must be refreshed for the chart repository.

After distribution review

Release managementGo back to the release workflow when you are publishing a version rather than changing distribution policy.Supply chain securityOpen the policy side when distribution changes affect provenance, signing, or verification expectations.Dependency license policyUse the governance policy if the published artifact surface changes what licenses are considered shipped.