OpenBao Operator 0.4.0

Published 4 July 2026.

0.4.0 focuses on security-boundary hardening, explicit delegation for high-impact controls, safer self-initialization for auto-unseal clusters, and broader lifecycle testing.

Highlights

• require explicit Kubernetes authority for network publication, custom helper images, trust roots, cloud identity references, restore delegation, and other dangerous controls
• reject more ambiguous or unsafe Hardened cluster shapes
• protect operator-managed resources with provenance and admission guardrails
• add initial recovery-key bootstrap for self-initializing auto-unseal clusters
• clean one-shot bootstrap configuration after initialization succeeds
• expand property and model-based tests for lifecycle-critical behavior

Before upgrading

1. Review existing cluster and restore resources against the new delegated authorization and Hardened validation rules.
2. Grant only the delegated roles each human or GitOps identity needs.
3. Apply the 0.4.0 CRDs before upgrading the controller or chart.
4. Validate admission, reconciliation, backup, restore, and human authentication in staging.

helm upgrade openbao-operator \
  oci://ghcr.io/dc-tec/charts/openbao-operator \
  --version 0.4.0 \
  --namespace openbao-operator-system \
  --reuse-values

Open the published GitHub release for artifacts, signatures, provenance, and the complete generated change list.