chore(release-please--branches--release-please--branches--release-please--branches--release-please--branches--release-please--branches--main): release 0.2.0

[openbao-operator-release-pr]

🤖 I have created a release beep boop

0.2.0 (2026-05-19)

Features

• admission: authorize maintenance through RBAC (#347) (b7c05a7)
• api: add runtime restart controls (#348) (b1efd34)
• openbaocluster: add ingress integration readiness (#409) (945b4a4)
• openbao: improve PKCS#11 runtime ergonomics (#400) (f32a6ec)
• readreplicas: add steady-state read replica topology and status (#361) (9a74c14)
• readreplicas: integrate read replicas with upgrade and restore workflows (#362) (e8bf8b8)

Bug Fixes

• admission: guard hardened security context overrides (#390) (d0a6533)
• backup: record manual triggers and failure time (#407) (ff172c6)
• ci: allow PR label sync to write labels (#307) (51591d8)
• ci: replace dangerous PR labeling workflow (#304) (b3740f8)
• config: align audit device options with OpenBao (#423) (b1ed4a3)
• config: harden generated JWT roles (#420) (546c6db)
• config: use SemVer precedence for OpenBao version checks (#394) (173847d)
• deps: restore dependency update CI coverage (#399) (032e1b7)
• gateway: emit TLSRoute as Gateway API v1 (#429) (05177d3)
• helm: allow global values in chart schema (#378) (5dad02e)
• helm: deduplicate generated RBAC labels (#414) (78f8d73)
• helm: Helm provisioner admission identity (#387) (f781c70)
• infra: delete scaled-down raft PVCs (#341) (f406e90)
• multitenancy: gate cluster reconcile on tenant onboarding (#359) (cfd850f)
• network: Require source-scoped managed Ingress access (#389) (a3cec85)
• openbao: share JWT token cache (#419) (a4a0887)
• openbao: stage safe raft scale-downs (#339) (4da1ec7)
• probe: stabilize openbao workload probes (#371) (260547b)
• provisioner: reduce release reconciliation log noise (#370) (b2f2bca)
• provisioner: support external tenant PSS label ownership (#428) (08462c9)
• rbac: allow verification pull secret reads (#427) (10d40c0)
• restore: harden restore job rendering (#405) (3e52f5a)
• security: fail closed for configured trusted roots (#393) (04cbd64)
• status: mark unsafe admission mode not production-ready (#391) (98022a3)
• storage: retry transient S3 bucket ensure failures (#408) (9796c2c)
• upgrade: complete SSA ownership migration (#345) (eafa931)
• upgrade: harden bluegreen and rolling recovery flakes (#374) (62cf706)
• upgrade: harden rolling upgrade resume (#406) (33fe59d)
• upgrade: set executor job resource requirements (#392) (8efb8da)
• upgrade: treat raft promote already-voter as no-op (#382) (7d25753)
• upgrade: verify default helper images for hardened clusters (#308) (8bfeabb)
• workload: mount OCI plugin directory (#421) (fc95717)

---

This PR was generated with Release Please. See documentation.

[dc-tec]

Closing this recursive release-please PR. It was created because main did not yet exclude release-please--branches--* branches from the Release Please workflow. Keeping #395 as the real main release PR.