OpenBao Operator 0.5.1

Published 24 September 2026.

OpenBao Operator 0.5.1 updates the default validation target to OpenBao 2.6.3 and adds OpenBao 2.7.0 compatibility. It also fixes backup retention, partial uploads, restore status, and upgrade execution.

Review the main changes

• OpenBao 2.7 workloads and upgrades require matching external plugins for seals removed from the server. The operator checks plugin declarations before preparing workloads or starting an upgrade.
• Plugin version, binaryName, and sha256sum fields become optional in the CRD. Runtime validation still requires them when the selected OpenBao version needs them.
• Backup retention keeps the newest snapshot and only prunes scheduled backup keys. Failed snapshot streams abort partial uploads.
• Rolling upgrades retry transient partition conflicts. BlueGreen upgrades preserve active inputs and enforce rollback and abort boundaries around promotion.
• Restore status survives the final admin operation patch. Readiness checks require synchronized caches and fresh admission checks.

Upgrade from 0.5.0

Finish active OpenBao upgrades, backups, and restores. Take and verify a current backup before updating the operator. Apply the release CRDs before upgrading the Helm release; Helm does not update installed CRDs.

kubectl apply -f \
  https://github.com/dc-tec/openbao-operator/releases/download/0.5.1/crds.yaml

helm upgrade openbao-operator \
  oci://ghcr.io/dc-tec/charts/openbao-operator \
  --version 0.5.1 \
  --namespace openbao-operator-system \
  --reuse-values

For older operator installations, follow the 0.5.0 migration requirements first.

Prepare OpenBao 2.7 separately

Upgrade the operator before changing an OpenBao cluster to 2.7.0. Prepare external KMS plugins for AWS KMS, Azure Key Vault, Google Cloud KMS, OCI KMS, and PKCS#11 seals. Inventory authentication and secrets mounts for removed built-in plugins. Follow the OpenBao 2.7 migration procedure before changing the server version.

The release E2E matrix validates OpenBao 2.6.3 on Kubernetes 1.34.3, 1.35.1, and 1.36.1. OpenBao 2.7.0 has focused local lifecycle, rolling and BlueGreen upgrade, S3 backup and restore, and PKCS#11 qualification on Kubernetes 1.34.3 with Linux ARM64. The PKCS#11 fixture uses plugin 0.1.0 with SoftHSM; it does not qualify vendor HSMs, cloud KMS access, or the PKCS#11 0.2.0 root-key rewrap transition. Review the compatibility matrix and validate the exact deployment in staging.

Open the published GitHub release for the complete change list, artifacts, signatures, and provenance. The release pipeline and post-release verification passed.