OpenBao Operator 0.5.2

Published 14 October 2026.

OpenBao Operator 0.5.2 persists the first scheduled backup deadline. It also fixes AKS and CSI PVC admission, excludes helper Jobs from OpenBao Service endpoints, bounds restore staging, and updates security and release tooling.

Upgrade from 0.5.1

Finish active backups, restores, and OpenBao upgrades. Apply the release CRDs and admission policies before upgrading the Helm release. Helm does not update installed CRDs.

kubectl apply -f \
  https://github.com/kubebao/openbao-operator/releases/download/0.5.2/crds.yaml

helm upgrade openbao-operator \
  oci://ghcr.io/kubebao/charts/openbao-operator \
  --version 0.5.2 \
  --namespace openbao-operator-system \
  --reuse-values \
  --set-string image.repository=ghcr.io/kubebao/openbao-operator \
  --set-string image.tag=0.5.2 \
  --set-string image.digest= \
  --set-string operatorVersion=0.5.2 \
  --wait

The command selects the official 0.5.2 manager image and clears an older digest pin. If you use a private registry, replace the repository and tag with your verified mirror. Update any helperImages, helper repository environment variables, and cluster-level helper image overrides to the matching 0.5.2 images before upgrading.

Replace proxyProtocolBehavior: allow_any with allow_authorized and a nonempty spec.configuration.listener.proxyProtocolAuthorizedAddrs list. deny_unauthorized also requires this list. Include operator client and health probe source addresses when using that mode. Read the PROXY protocol configuration procedure.

Restore snapshots have an 8 GiB staging limit. Restore Jobs require 9140 MiB of ephemeral storage and do not restart failed executors. Check node capacity before submitting a restore. Finish any existing restore before changing the operator or helper image version.

Check status.backup.nextScheduledBackup after upgrading. Verify a completed scheduled snapshot through status.backup.lastBackupTime and status.backup.lastBackupName.

For installations on 0.5.0, follow the 0.5.1 migration guidance first. Historical 0.5.1 artifacts retain their dc-tec publisher identity; new 0.5.2 artifacts use KubeBao coordinates.

Open the GitHub release for the change list, artifacts, signatures, and provenance.

The release pipeline, post-release verification, and reproducibility report passed.

New contributors

Thank you to our new contributors:

• @robertdebock for fixing AKS PVC binding admission in #791.
• @pennycoders for fixing admission of CSI leak-protection finalizers in #804.