Known Limitations

Use this page when you need to know whether a behavior is unsupported, unfinished, or intentionally out of scope.

Not every missing feature is an accidental gap. This page captures the current constraints and deliberate non-goals for the pre-GA line so operators and contributors can separate unsupported assumptions from issues the project actually intends to solve.

Reference table

Current constraints

Current constraints.

Area	Current limitation	What to do instead
CRD versioning	The current served and storage API is openbao.org/v1alpha1; multi-version conversion webhooks are out of scope today.	Treat API evolution through the pre-GA contract and review release notes carefully.
Operator downgrade	Downgrades are not treated as a normal rollback path.	Use the recovery and restore guidance when a release cannot move forward safely.
External backup cleanup	DeleteAll removes PVC-backed data but does not delete external object storage backups.	Clean external backup objects explicitly as part of decommission procedures.
etcd encryption verification	The operator cannot directly prove cluster-level etcd encryption at rest and surfaces a warning condition instead.	Validate cluster-level encryption controls outside the operator.
Helm CRD lifecycle	Helm does not automatically upgrade or delete CRDs.	Use release crds.yaml assets for CRD lifecycle operations.
Validation channels	edge and nightly are not production support channels.	Pin explicit stable versions for production environments.

Support window

Support is focused on the latest stable release line. See Support Policy for the current maintenance contract.

Related caveat and support pages

Support policyOpen the maintenance contract behind these constraints and the release lines that remain in scope.Deprecation policyUse the lifecycle policy when a limitation is really part of the pre-GA API evolution story.Decommission a clusterReturn to the operational decommission workflow for the data-path caveats around external backups.