OpenBao Operator 0.3.0 · OpenBao Operator

Published 1 June 2026.

0.3.0 hardened production operations across operator authentication, metrics, audit logging, Gateway and Ingress integration, runtime configuration, backup, and restore.

Highlights

default supported JWT workflows to inline authentication;
add active-node and all-node workload metrics with managed ServiceMonitor resources;
add PVC-backed audit-file handoff and readiness status;
emit Gateway API v1 TLSRoute resources and report Gateway and Ingress integration readiness;
improve PKCS#11 runtime wiring; and
validate backup, restore, storage, transit-unseal, JWT, and helper inputs earlier.

Before upgrading from 0.2

Apply the 0.3.0 CRDs first. Verify proxy support for inline-auth headers, static restore-token identity labels, explicit storage endpoints and identity, Gateway listener capabilities, and any planned audit-volume rollout. Existing initialized clusters can require manual OpenBao policy updates because the operator does not retrofit bootstrap auth.

Open the published GitHub release for artifacts and the complete generated change list.