Skip to content

Commit 033eda5

Browse files
dc-tecdc-tec
committed
docs(release): add 0.2.0 release artifacts
Signed-off-by: Roel de Cort <roel.decort@adfinis.com>
1 parent df1770a commit 033eda5

137 files changed

Lines changed: 26445 additions & 12 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎release-notes/0.2.0.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
0.2.0 is the next stable pre-GA release line for OpenBao Operator. This
2+
release focuses on horizontal read scaling, safer day-2 maintenance workflows,
3+
and tighter production safety checks for hardened deployments.
4+
5+
### Highlights
6+
7+
* Added steady-state OpenBao read replicas through `spec.readReplicas`,
8+
including separate read-replica status, optional dedicated read Service
9+
support, and dashboard/metrics visibility.
10+
* Integrated read replicas with disruptive workflows: rolling upgrades,
11+
blue/green upgrades, restores, restart ordering, and storage-resize ordering
12+
now handle the read pool deliberately.
13+
* Added `spec.runtime.restartAt` as the primary API for explicit rolling
14+
restart requests. The older `spec.maintenance.restartAt` path remains
15+
temporarily for compatibility.
16+
* Reworked planned maintenance authorization so direct managed-resource
17+
maintenance depends on Kubernetes RBAC for the custom `maintenance` verb on
18+
the owning `OpenBaoCluster`.
19+
* Hardened production safety checks for managed Ingress exposure, Hardened pod
20+
security context overrides, unsafe admission mode, and configured Sigstore
21+
trusted roots.
22+
* Improved upgrade reliability across SSA ownership, rolling retry state,
23+
blue/green recovery, Raft promote handling, and executor Job resource
24+
defaults.
25+
26+
### Breaking and Migration Notes
27+
28+
* Managed Ingress now requires explicit source scoping. Clusters with
29+
`spec.ingress.enabled=true` must configure at least one
30+
`spec.network.trustedIngressPeers` entry before creating or updating the
31+
`OpenBaoCluster` under admission enforcement.
32+
* Hardened clusters can no longer create or update pod-level
33+
`spec.securityContext` overrides that weaken the runtime baseline. Remove
34+
settings such as `runAsNonRoot=false`, root UID/GID values, root supplemental
35+
groups, `Unconfined` seccomp, pod sysctls, or Windows pod security options
36+
before upgrading with admission enforcement.
37+
* Existing Hardened clusters with weakening security context overrides are
38+
reported as `ProductionReady=False` until corrected.
39+
40+
### Operational Notes
41+
42+
* Apply the `0.2.0` CRDs before upgrading the controller or Helm chart.
43+
* Existing initialized clusters may need an OpenBao policy update for
44+
read-replica Autopilot health reporting. The operator policy needs `read` on
45+
`sys/storage/raft/autopilot/state`; the operator does not mutate OpenBao
46+
policies after bootstrap.
47+
* In multi-tenant mode, cluster reconciliation now waits until tenant onboarding
48+
RBAC exists in the target namespace. GitOps flows that apply `OpenBaoTenant`
49+
and `OpenBaoCluster` together may see the cluster pause and requeue until
50+
onboarding completes.
51+
* Raft scale-downs are now staged one replica at a time, and PVCs for
52+
scaled-down ordinals are deleted while StatefulSet deletion still retains
53+
PVCs. Review replica-reduction procedures before scaling production clusters
54+
down.
55+
* Unsafe admission mode now reports explicit degraded production posture instead
56+
of looking equivalent to enforced admission policies.
57+
* If a configured trusted-root ConfigMap is missing, malformed, incomplete, or
58+
unreadable, image verification now fails closed instead of falling back
59+
silently to the embedded trusted root.
60+
61+
### Upgrade from 0.1.x
62+
63+
Before upgrading an existing `0.1.x` installation:
64+
65+
1. Review every existing `OpenBaoCluster` before applying the new controller.
66+
2. For clusters with `spec.ingress.enabled=true`, configure at least one
67+
`spec.network.trustedIngressPeers` entry.
68+
3. For `Hardened` clusters, remove pod-level `spec.securityContext` overrides
69+
that weaken the default runtime baseline.
70+
4. For initialized clusters that will use read replicas, update the OpenBao
71+
operator policy to allow `read` on
72+
`sys/storage/raft/autopilot/state`.
73+
5. Apply the `0.2.0` CRDs first:
74+
75+
```sh
76+
kubectl apply -f https://github.com/dc-tec/openbao-operator/releases/download/0.2.0/crds.yaml
77+
```
78+
79+
6. Upgrade the Helm release:
80+
81+
```sh
82+
helm upgrade openbao-operator oci://ghcr.io/dc-tec/charts/openbao-operator \
83+
--version 0.2.0 \
84+
--namespace openbao-operator-system \
85+
--reuse-values
86+
```
87+
88+
7. Verify the operator rollout, CRD presence, managed cluster conditions, and
89+
recent events before continuing with OpenBao workload changes.
90+
91+
Kubernetes `v1.34` and `v1.35` are the 0.2.0 release-gated versions. Kubernetes
92+
`v1.33` may work but is not release-gated for this line. Kubernetes `v1.36` is
93+
tracked as the next candidate once controller-runtime, Kind, and release-gate
94+
coverage are available.
95+
96+
### Compatibility
97+
98+
OpenBao Operator requires Kubernetes `v1.33+`. The current release validation
99+
baseline is Kubernetes `v1.34`-`v1.35` and OpenBao `2.5.3`, with config
100+
compatibility coverage for OpenBao `2.4.4`.

‎releases/0.1.0.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ slug: /0.1.0
99
Published 2026-03-30.
1010

1111
<CardGrid>
12-
<LinkCard title="Matching docs" to="/docs">
12+
<LinkCard title="Matching docs" to="/docs/0.1.0">
1313
Open the docs experience aligned to this release line.
1414
</LinkCard>
1515
<LinkCard title="GitHub release" to="https://github.com/dc-tec/openbao-operator/releases/tag/0.1.0">

‎releases/0.1.1.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ slug: /0.1.1
99
Published 2026-03-31.
1010

1111
<CardGrid>
12-
<LinkCard title="Matching docs" to="/docs">
12+
<LinkCard title="Matching docs" to="/docs/0.1.0">
1313
Open the docs experience aligned to this release line.
1414
</LinkCard>
1515
<LinkCard title="GitHub release" to="https://github.com/dc-tec/openbao-operator/releases/tag/0.1.1">

‎releases/0.2.0.mdx‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
title: 0.2.0
3+
description: Release notes for OpenBao Operator 0.2.0.
4+
slug: /0.2.0
5+
---
6+
7+
<StatusPill>0.2.0</StatusPill>
8+
9+
Published 2026-05-01.
10+
11+
<CardGrid>
12+
<LinkCard title="Matching docs" to="/docs">
13+
Open the docs experience aligned to this release line.
14+
</LinkCard>
15+
<LinkCard title="GitHub release" to="https://github.com/dc-tec/openbao-operator/releases/tag/0.2.0">
16+
View release assets, tag metadata, and the GitHub release entry.
17+
</LinkCard>
18+
</CardGrid>
19+
20+
0.2.0 is the next stable pre-GA release line for OpenBao Operator. This
21+
release focuses on horizontal read scaling, safer day-2 maintenance workflows,
22+
and tighter production safety checks for hardened deployments.
23+
24+
### Highlights
25+
26+
* Added steady-state OpenBao read replicas through `spec.readReplicas`,
27+
including separate read-replica status, optional dedicated read Service
28+
support, and dashboard/metrics visibility.
29+
* Integrated read replicas with disruptive workflows: rolling upgrades,
30+
blue/green upgrades, restores, restart ordering, and storage-resize ordering
31+
now handle the read pool deliberately.
32+
* Added `spec.runtime.restartAt` as the primary API for explicit rolling
33+
restart requests. The older `spec.maintenance.restartAt` path remains
34+
temporarily for compatibility.
35+
* Reworked planned maintenance authorization so direct managed-resource
36+
maintenance depends on Kubernetes RBAC for the custom `maintenance` verb on
37+
the owning `OpenBaoCluster`.
38+
* Hardened production safety checks for managed Ingress exposure, Hardened pod
39+
security context overrides, unsafe admission mode, and configured Sigstore
40+
trusted roots.
41+
* Improved upgrade reliability across SSA ownership, rolling retry state,
42+
blue/green recovery, Raft promote handling, and executor Job resource
43+
defaults.
44+
45+
### Breaking and Migration Notes
46+
47+
* Managed Ingress now requires explicit source scoping. Clusters with
48+
`spec.ingress.enabled=true` must configure at least one
49+
`spec.network.trustedIngressPeers` entry before creating or updating the
50+
`OpenBaoCluster` under admission enforcement.
51+
* Hardened clusters can no longer create or update pod-level
52+
`spec.securityContext` overrides that weaken the runtime baseline. Remove
53+
settings such as `runAsNonRoot=false`, root UID/GID values, root supplemental
54+
groups, `Unconfined` seccomp, pod sysctls, or Windows pod security options
55+
before upgrading with admission enforcement.
56+
* Existing Hardened clusters with weakening security context overrides are
57+
reported as `ProductionReady=False` until corrected.
58+
59+
### Operational Notes
60+
61+
* Apply the `0.2.0` CRDs before upgrading the controller or Helm chart.
62+
* Existing initialized clusters may need an OpenBao policy update for
63+
read-replica Autopilot health reporting. The operator policy needs `read` on
64+
`sys/storage/raft/autopilot/state`; the operator does not mutate OpenBao
65+
policies after bootstrap.
66+
* In multi-tenant mode, cluster reconciliation now waits until tenant onboarding
67+
RBAC exists in the target namespace. GitOps flows that apply `OpenBaoTenant`
68+
and `OpenBaoCluster` together may see the cluster pause and requeue until
69+
onboarding completes.
70+
* Raft scale-downs are now staged one replica at a time, and PVCs for
71+
scaled-down ordinals are deleted while StatefulSet deletion still retains
72+
PVCs. Review replica-reduction procedures before scaling production clusters
73+
down.
74+
* Unsafe admission mode now reports explicit degraded production posture instead
75+
of looking equivalent to enforced admission policies.
76+
* If a configured trusted-root ConfigMap is missing, malformed, incomplete, or
77+
unreadable, image verification now fails closed instead of falling back
78+
silently to the embedded trusted root.
79+
80+
### Upgrade from 0.1.x
81+
82+
Before upgrading an existing `0.1.x` installation:
83+
84+
1. Review every existing `OpenBaoCluster` before applying the new controller.
85+
2. For clusters with `spec.ingress.enabled=true`, configure at least one
86+
`spec.network.trustedIngressPeers` entry.
87+
3. For `Hardened` clusters, remove pod-level `spec.securityContext` overrides
88+
that weaken the default runtime baseline.
89+
4. For initialized clusters that will use read replicas, update the OpenBao
90+
operator policy to allow `read` on
91+
`sys/storage/raft/autopilot/state`.
92+
5. Apply the `0.2.0` CRDs first:
93+
94+
```sh
95+
kubectl apply -f https://github.com/dc-tec/openbao-operator/releases/download/0.2.0/crds.yaml
96+
```
97+
98+
6. Upgrade the Helm release:
99+
100+
```sh
101+
helm upgrade openbao-operator oci://ghcr.io/dc-tec/charts/openbao-operator \
102+
--version 0.2.0 \
103+
--namespace openbao-operator-system \
104+
--reuse-values
105+
```
106+
107+
7. Verify the operator rollout, CRD presence, managed cluster conditions, and
108+
recent events before continuing with OpenBao workload changes.
109+
110+
Kubernetes `v1.34` and `v1.35` are the 0.2.0 release-gated versions. Kubernetes
111+
`v1.33` may work but is not release-gated for this line. Kubernetes `v1.36` is
112+
tracked as the next candidate once controller-runtime, Kind, and release-gate
113+
coverage are available.
114+
115+
### Compatibility
116+
117+
OpenBao Operator requires Kubernetes `v1.33+`. The current release validation
118+
baseline is Kubernetes `v1.34`-`v1.35` and OpenBao `2.5.3`, with config
119+
compatibility coverage for OpenBao `2.4.4`.
120+
121+
### Features
122+
123+
* **admission:** authorize maintenance through RBAC ([#347](https://github.com/dc-tec/openbao-operator/issues/347)) ([b7c05a7](https://github.com/dc-tec/openbao-operator/commit/b7c05a770bcc97ea1931caf0a3c05919540c38ab))
124+
* **api:** add runtime restart controls ([#348](https://github.com/dc-tec/openbao-operator/issues/348)) ([b1efd34](https://github.com/dc-tec/openbao-operator/commit/b1efd3442c2c5cd0a58c654b749103ab7cf5ac81))
125+
* **readreplicas:** add steady-state read replica topology and status ([#361](https://github.com/dc-tec/openbao-operator/issues/361)) ([9a74c14](https://github.com/dc-tec/openbao-operator/commit/9a74c143e9061f42f5c7557af7a7e9b767252926))
126+
* **readreplicas:** integrate read replicas with upgrade and restore workflows ([#362](https://github.com/dc-tec/openbao-operator/issues/362)) ([e8bf8b8](https://github.com/dc-tec/openbao-operator/commit/e8bf8b820c06ccab1fb81a9df25223dfbf4e0666))
127+
128+
129+
### Bug Fixes
130+
131+
* **admission:** guard hardened security context overrides ([#390](https://github.com/dc-tec/openbao-operator/issues/390)) ([d0a6533](https://github.com/dc-tec/openbao-operator/commit/d0a6533a4c5dbb7b23e4c0c83abf6ee07a5b491e))
132+
* **helm:** allow global values in chart schema ([#378](https://github.com/dc-tec/openbao-operator/issues/378)) ([5dad02e](https://github.com/dc-tec/openbao-operator/commit/5dad02ebc4253ddb366f636e3aea60ffce5f4ffa))
133+
* **helm:** Helm provisioner admission identity ([#387](https://github.com/dc-tec/openbao-operator/issues/387)) ([f781c70](https://github.com/dc-tec/openbao-operator/commit/f781c70b885973b0d682cc102607d3e0b41f36dd))
134+
* **infra:** delete scaled-down raft PVCs ([#341](https://github.com/dc-tec/openbao-operator/issues/341)) ([f406e90](https://github.com/dc-tec/openbao-operator/commit/f406e9029d94c8e7984d77b66cf02b8a97f3c339))
135+
* **multitenancy:** gate cluster reconcile on tenant onboarding ([#359](https://github.com/dc-tec/openbao-operator/issues/359)) ([cfd850f](https://github.com/dc-tec/openbao-operator/commit/cfd850fcf819c4d1562644cc9495143cfee69b27))
136+
* **network:** Require source-scoped managed Ingress access ([#389](https://github.com/dc-tec/openbao-operator/issues/389)) ([a3cec85](https://github.com/dc-tec/openbao-operator/commit/a3cec85a56230560be8196ac02666ad38b7e136d))
137+
* **openbao:** stage safe raft scale-downs ([#339](https://github.com/dc-tec/openbao-operator/issues/339)) ([4da1ec7](https://github.com/dc-tec/openbao-operator/commit/4da1ec74f8e4e45e710a0fae51f86bbf44c257c8))
138+
* **probe:** stabilize openbao workload probes ([#371](https://github.com/dc-tec/openbao-operator/issues/371)) ([260547b](https://github.com/dc-tec/openbao-operator/commit/260547b71d3e12e2ec97ae500f9ed63ab1619804))
139+
* **provisioner:** reduce release reconciliation log noise ([#370](https://github.com/dc-tec/openbao-operator/issues/370)) ([b2f2bca](https://github.com/dc-tec/openbao-operator/commit/b2f2bcaf18dfef15348aa02b9f3de224c02e38ab))
140+
* **security:** fail closed for configured trusted roots ([#393](https://github.com/dc-tec/openbao-operator/issues/393)) ([04cbd64](https://github.com/dc-tec/openbao-operator/commit/04cbd64cf0356f111f0e3c0450b859008e6c5b69))
141+
* **status:** mark unsafe admission mode not production-ready ([#391](https://github.com/dc-tec/openbao-operator/issues/391)) ([98022a3](https://github.com/dc-tec/openbao-operator/commit/98022a3925742e011dbb8ce1fb55c2c79c5a1496))
142+
* **upgrade:** complete SSA ownership migration ([#345](https://github.com/dc-tec/openbao-operator/issues/345)) ([eafa931](https://github.com/dc-tec/openbao-operator/commit/eafa9317acf33155cc7863924b5cb4a8725f97bc))
143+
* **upgrade:** harden bluegreen and rolling recovery flakes ([#374](https://github.com/dc-tec/openbao-operator/issues/374)) ([62cf706](https://github.com/dc-tec/openbao-operator/commit/62cf706df50b8ff462e5893166fc61b83749b298))
144+
* **upgrade:** set executor job resource requirements ([#392](https://github.com/dc-tec/openbao-operator/issues/392)) ([8efb8da](https://github.com/dc-tec/openbao-operator/commit/8efb8da900d378139e35bd32c54489bcc74bec15))
145+
* **upgrade:** treat raft promote already-voter as no-op ([#382](https://github.com/dc-tec/openbao-operator/issues/382)) ([7d25753](https://github.com/dc-tec/openbao-operator/commit/7d25753b9c5c780e174e8adb5487f48c67128267))

‎releases/index.mdx‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@ slug: /
66

77
# Release Notes
88

9-
<StatusPill>0.1.1</StatusPill>
9+
<StatusPill>0.2.0</StatusPill>
1010

11-
Release notes are generated from [CHANGELOG.md](https://github.com/dc-tec/openbao-operator/blob/main/CHANGELOG.md) and tied to the published docs experience.
11+
Release pages combine hand-written notes from [release-notes/](https://github.com/dc-tec/openbao-operator/tree/main/release-notes) with generated entries from [CHANGELOG.md](https://github.com/dc-tec/openbao-operator/blob/main/CHANGELOG.md).
1212

1313
## Latest highlighted release
1414

1515
<CardGrid>
16-
<LinkCard title="0.1.1" to="/releases/0.1.1">
17-
Published 2026-03-31. Open the full notes, compare changes, and jump into the matching docs version.
16+
<LinkCard title="0.2.0" to="/releases/0.2.0">
17+
Published 2026-05-01. Open the full notes, compare changes, and jump into the matching docs version.
1818
</LinkCard>
1919
<LinkCard title="GitHub Releases" to="https://github.com/dc-tec/openbao-operator/releases">
2020
Browse published release assets, tags, and signed artifacts in GitHub.
@@ -23,6 +23,7 @@ Release notes are generated from [CHANGELOG.md](https://github.com/dc-tec/openba
2323

2424
## Archive
2525

26+
- [0.2.0](/releases/0.2.0) — 2026-05-01
2627
- [0.1.1](/releases/0.1.1) — 2026-03-31
2728
- [0.1.0](/releases/0.1.0) — 2026-03-30
2829
- [0.1.0-rc.7](/releases/0.1.0-rc.7) — 2026-03-30

‎website/tests/behavior.spec.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ test('docs navbar dropdown routes to validated deployments', async ({page}) => {
3030
await expect(page).toHaveURL(/\/openbao-operator\/docs\/validated-deployments$/);
3131
await expect(
3232
page.getByRole('heading', {
33-
name: 'Choose a tested baseline by lane, then adapt it without forgetting what was actually proven.',
33+
name: 'Validated deployment baselines',
3434
}),
3535
).toBeVisible();
3636
});
@@ -42,15 +42,15 @@ test('version dropdown switches from next docs to the stable release line', asyn
4242
await versionDropdown.hover();
4343

4444
const archivedRelease = page.locator('.dropdown__menu').getByRole('link', {
45-
name: '0.1.0',
45+
name: '0.2.0',
4646
exact: true,
4747
});
4848
await expect(archivedRelease).toBeVisible();
4949
await archivedRelease.click();
5050

5151
await expect(page).toHaveURL(/\/openbao-operator\/docs\/get-started\/deployment-decision-guide$/);
5252
await expect(page.getByText('Published release documentation')).toBeVisible();
53-
await expect(page.getByText('Version: 0.1.0')).toBeVisible();
53+
await expect(page.getByText('Version: 0.2.0')).toBeVisible();
5454
});
5555

5656
test.describe('curated legacy redirects stay alive', () => {

‎website/tests/smoke.spec.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ test('legacy latest user-guide route redirects into the new IA', async ({page})
2424
await page.goto('latest/user-guide');
2525
await expect(page).toHaveURL(/\/openbao-operator\/docs\/get-started$/);
2626
await expect(
27-
page.getByRole('heading', {name: 'Deploy OpenBao Operator with a clear first path.'}),
27+
page.getByRole('heading', {name: 'Get started with OpenBao Operator'}),
2828
).toBeVisible();
2929
});
3030

@@ -44,9 +44,9 @@ test('next docs expose the version banner and feedback controls', async ({page})
4444
test('stable docs expose the current release banner', async ({page}) => {
4545
await page.goto('docs');
4646

47-
await expect(page.getByRole('heading', {name: 'Choose the route that matches the work.'})).toBeVisible();
47+
await expect(page.getByRole('heading', {name: 'OpenBao Operator documentation'})).toBeVisible();
4848
await expect(page.getByText('Published release documentation')).toBeVisible();
49-
await expect(page.getByText('Version: 0.1.0')).toBeVisible();
49+
await expect(page.getByText('Version: 0.2.0')).toBeVisible();
5050
});
5151

5252
test('architecture section exposes grouped local navigation', async ({page}) => {

0 commit comments

Comments
 (0)