OpenBao Operator 0.5.3 · OpenBao Operator

Published 20 October 2026.

OpenBao Operator 0.5.3 rebuilds the manager and helper images with Go 1.27.3 to address CVE-2026-111943. Go rejects certificate chains containing any of the eight compromised eMudhra intermediate CA public keys. This protects clients that trust public certificate authorities, including object storage clients and OpenBao clients configured for public ACME.

The release does not change the API, CRDs, admission policies, or RBAC. It does not update the separate OpenBao server image, which requires its own security assessment and patched build.

Upgrade from 0.5.2

Finish active backups, restores, and OpenBao upgrades before updating the operator.

upgrade

Upgrade the operator to 0.5.3

helm upgrade openbao-operator \
  oci://ghcr.io/kubebao/charts/openbao-operator \
  --version 0.5.3 \
  --namespace openbao-operator-system \
  --reuse-values \
  --set-string image.repository=ghcr.io/kubebao/openbao-operator \
  --set-string image.tag=0.5.3 \
  --set-string image.digest= \
  --set-string operatorVersion=0.5.3 \
  --wait

The command selects the official 0.5.3 manager image and clears an older digest pin. If you use a private registry, replace the repository and tag with your verified mirror. Update any helperImages, helper repository environment variables, and cluster-level helper image overrides to the matching 0.5.3 images before upgrading.

Preserve Raft quorum during Pod replacement

Verify the init image of every managed OpenBao Pod after upgrading the manager. Existing Pods retain helper binaries installed by their old init container until those Pods are replaced. A successful Helm --wait does not prove that this replacement is complete. BlueGreen voter StatefulSets use OnDelete, so a template update or spec.runtime.restartAt change alone does not replace them.

If any Pod retains an old init image, use the planned maintenance authorization procedure to replace those Pods one at a time. Preserve Raft quorum. Wait for each replacement to become Ready and verify cluster health before replacing the next Pod. Disable maintenance mode when the replacements are complete. New backup and upgrade Jobs must also use the matching helper images.

The 0.5.3 release qualification verified runtime upgrades from 0.5.2 to the 0.5.3 candidate and retained the historical 0.5.0 API migration fixture. The tagged fixture records these release inputs.

For installations on 0.5.1 or 0.5.0, follow the 0.5.2 upgrade guidance and any earlier migration procedures it references before applying the 0.5.3 CRDs and admission policies.

Read the Go security advisory and Mozilla incident report. Open the GitHub release for artifacts, signatures, and provenance.