OpenBao Operator 0.5.0

Published 31 August 2026.

OpenBao Operator 0.5.0 documents the compatibility commitment selected for parts of the openbao.org/v1alpha1 API. The API remains alpha. The release adds Kubernetes 1.36 release coverage, plugin-backed KMS seal configuration, OpenBao 2.6 self-init controls, independent voter resources, and idle upgrade-strategy switching. It also hardens restore, backup, retention, and upgrade execution.

Update restore authorization first

Use a separate force capability only when the identity must support spec.force: true:

path "sys/storage/raft/snapshot" {
  capabilities = ["update"]
}

# Optional break-glass capability for spec.force: true.
path "sys/storage/raft/snapshot-force" {
  capabilities = ["update"]
}

Migrate Hardened unseal credentials before installing 0.5.0

Review the main changes

• The API inventory records the fields selected for the 0.5.0 compatibility commitment, including their omission behavior, mutability, and condition contracts.
• Release gates use Kubernetes 1.36.1 as the primary target and retain Kubernetes 1.34.x and 1.35.x compatibility lanes.
• OpenBao 2.6.2 is the primary target. Configuration checks also cover OpenBao 2.4.4 and 2.5.5.
• Restore execution records durable receipts and does not recreate a missing committed Job. It restarts voters and restores the declared read-replica state before completion.
• BlueGreen validation hooks use an attempt-specific identity and terminal receipt. A prior success cannot satisfy a later upgrade attempt.
• Backup retention preserves unrelated Secret owners. Scheduled backup observation ignores pre-upgrade snapshot Jobs.

Upgrade from 0.4.2

Upgrade a 0.4.0 or 0.4.1 installation to 0.4.2 first. Finish active OpenBao upgrades, backups, and restores, then take and verify a current backup. Keep the 0.4.2 controller and custom resource definitions (CRDs) installed while you update stored manifests, Hardened credentials, and restore authorization. Follow the complete 0.5.0 migration procedure before applying the new CRDs.

kubectl apply -f \
  https://github.com/dc-tec/openbao-operator/releases/download/0.5.0/crds.yaml

helm upgrade openbao-operator \
  oci://ghcr.io/dc-tec/charts/openbao-operator \
  --version 0.5.0 \
  --namespace openbao-operator-system \
  --reuse-values

Open the published GitHub release for the full release notes, artifacts, signatures, software bills of materials, attestations, and provenance.