0.3.0

0.3.0

Published 2026-06-01.

Matching docs

Open the docs experience aligned to this release line.

OpenGitHub release

View release assets, tag metadata, and the GitHub release entry.

Open

0.3.0 is the next stable pre-GA release line for OpenBao Operator. This release focuses on production operations hardening across operator authentication, observability, audit logging, Gateway and Ingress integration, runtime configuration, and backup and restore safety.

Highlights

• Defaulted supported operator JWT flows to inline authentication, reducing repeated login overhead while keeping controller, backup, restore, and upgrade roles scoped separately.
• Added workload metrics scraping support, including declarative metrics configuration, managed ServiceMonitor reconciliation, active-node and all-node scrape profiles, and optional metrics-only listener support.
• Added audit file storage support for OpenBaoCluster, including managed PVC wiring, pod-specific audit file paths, status reporting, and OpenBao-aligned audit device options.
• Improved Gateway and Ingress integration readiness with Gateway API v1 TLSRoute emission, explicit Gateway/Ingress readiness conditions, and tolerance for GatewayClass implementations that omit the SupportedVersion condition.
• Improved PKCS#11 runtime ergonomics for HSM-backed deployments, including runtime environment and file-based configuration wiring for vendor libraries.
• Hardened backup, restore, storage endpoint, transit unseal, JWT role, and helper input handling so unsafe or ambiguous configuration fails earlier and more consistently.

Breaking and Migration Notes

• Apply the 0.3.0 CRDs before upgrading the controller or Helm chart. This release adds and tightens several openbao.org/v1alpha1 fields and admission checks.
• Inline authentication is now the default supported JWT flow. Environments with proxies or intermediaries between the operator and OpenBao must preserve the X-Vault-Inline-Auth-* headers. Use the login compatibility strategy only when inline auth headers cannot be passed reliably.
• Audit file storage changes the OpenBao workload pod template. Enabling it on an existing cluster can require StatefulSet recreation because Kubernetes locks some volume and volume mount fields after creation. Preserve data PVCs and plan the rollout before enabling audit file storage on production clusters.
• Static restore token Secrets are now validated more strictly. A restore token Secret must be in the target namespace and carry the expected identity labels for the target cluster and restore-token purpose before the operator launches the restore job.
• Backup, restore, and object storage endpoints are validated more strictly and guarded at request time. Review custom S3-compatible endpoints, private endpoints, and restore source configuration before upgrading.
• Metrics-only listener and all-node metrics configurations can expose OpenBao metrics without normal client authentication. Restrict access with NetworkPolicy or equivalent cluster controls before enabling unauthenticated scraping.
• Gateway passthrough exposure requires a Gateway API implementation with the needed Standard resources and listener behavior. ACME and OpenBao-managed TLS flows should use passthrough rather than Gateway-side termination.

Operational Notes

• The audit file storage PVC contains sensitive audit material. Treat it as security-sensitive storage, include it in backup and retention planning, and do not treat the operator-managed PVC as an immutable compliance archive.
• File audit device paths must stay under the configured audit file storage mount path.
• Backup, restore, and upgrade jobs now rely on narrower auth roles. Existing initialized clusters may need OpenBao policy or role updates before using those workflows because the operator does not mutate OpenBao auth configuration after initial bootstrap.
• spec.upgrade.tokenSecretRef is not supported for upgrade jobs. Upgrade jobs authenticate through the configured JWT auth role. For already-initialized clusters, create or update the required OpenBao auth role and policy before requesting an upgrade; selfInit only bootstraps auth during initial cluster initialization and does not retrofit running clusters.
• PKCS#11 deployments still require an OpenBao image with HSM support and the vendor PKCS#11 module available at the configured library path. The operator now wires the runtime more explicitly, but it does not provide vendor HSM libraries.
• OCI plugin downloads use OpenBao runtime configuration and the mounted plugin cache directory. Kubernetes image pull secrets do not automatically authorize OpenBao runtime plugin downloads, so private or disconnected environments should mirror plugin images and configure registry access deliberately.
• Tenants and platform teams that own Pod Security Standards labels outside the operator can now keep that ownership model while using the operator provisioner.
• Users already running 0.2.1 have the duplicate Helm RBAC label and OCI plugin directory fixes from the patch line; they remain included in 0.3.0.

Upgrade from 0.2.x

Before upgrading an existing 0.2.x installation:

1. Review every existing OpenBaoCluster, OpenBaoRestore, backup, Gateway, Ingress, metrics, audit, and unseal configuration against the stricter validation described above.

2. For clusters using intermediary proxies between the operator and OpenBao, confirm inline auth headers are preserved or plan to use the login compatibility strategy.

3. For clusters that will enable audit file storage, plan the StatefulSet rollout and confirm data PVC retention before applying the change.

4. For restore workflows using static token Secrets, add the required target namespace and restore-token identity labels before creating new restores.

5. For backup and restore workflows using S3-compatible storage, validate the endpoint URLs and credentials in staging.

6. Apply the 0.3.0 CRDs first:

   kubectl apply -f https://github.com/dc-tec/openbao-operator/releases/download/0.3.0/crds.yaml

7. Upgrade the Helm release:

   helm upgrade openbao-operator oci://ghcr.io/dc-tec/charts/openbao-operator \
     --version 0.3.0 \
     --namespace openbao-operator-system \
     --reuse-values

8. Verify the operator rollout, CRD presence, managed cluster conditions, Gateway/Ingress readiness conditions, backup/restore events, and recent controller logs before continuing with OpenBao workload changes.

Kubernetes v1.34 and v1.35 are the 0.3.0 release-gated versions. Kubernetes v1.33 may work but is not release-gated for this line. Kubernetes v1.36 is tracked as the next candidate once controller-runtime, Kind, and release-gate coverage are available.

Compatibility

OpenBao Operator requires Kubernetes v1.33+. The current release validation baseline is Kubernetes v1.34-v1.35 and OpenBao 2.5.4, with config compatibility coverage for OpenBao 2.4.4.

Features

• auth: default JWT flows to inline auth (#470) (445090a)
• observability: add workload metrics scraping support (#476) (d799277)
• openbaocluster: add audit file storage (#483) (f603869)
• openbaocluster: add ingress integration readiness (#409) (945b4a4)
• openbao: improve PKCS#11 runtime ergonomics (#400) (f32a6ec)
• perfcheck: harden v2 weekly performance harness (#487) (9552584)

Bug Fixes

• backup: record manual triggers and failure time (#407) (ff172c6)
• config: align audit device options with OpenBao (#423) (b1ed4a3)
• config: harden generated JWT roles (#420) (546c6db)
• config: use SemVer precedence for OpenBao version checks (#394) (173847d)
• deps: restore dependency update CI coverage (#399) (032e1b7)
• deps: update x/crypto for vulncheck (#468) (b7f48f1)
• deps: update x/net for vulncheck (#471) (8f3f554)
• gateway: emit TLSRoute as Gateway API v1 (#429) (05177d3)
• gateway: tolerate missing SupportedVersion condition (#486) (a695068)
• helm: deduplicate generated RBAC labels (#414) (78f8d73)
• openbao: guard metrics-only listener configuration (#481) (8da708b)
• openbao: share JWT token cache (#419) (a4a0887)
• provisioner: support external tenant PSS label ownership (#428) (08462c9)
• rbac: allow verification pull secret reads (#427) (10d40c0)
• rbac: permit managed ServiceMonitor reconciliation (#479) (693a43c)
• restore: harden restore job rendering (#405) (3e52f5a)
• restore: validate static token secret identity (#466) (0508606)
• security: harden backup and restore helper inputs (#474) (01ae81d)
• security: harden backup restore endpoint validation (#475) (98ef673)
• security: harden transit unseal credential handling (#473) (2e4e6c1)
• storage: enforce request-time endpoint guard (#477) (98f727d)
• storage: retry transient S3 bucket ensure failures (#408) (9796c2c)
• upgrade: harden rolling upgrade resume (#406) (33fe59d)
• workload: mount OCI plugin directory (#421) (fc95717)