Skip to content

feat: update openbao/openbao to v2.6.1 #minor - #269

Open
public-glueops-renovatebot[bot] wants to merge 1 commit into
mainfrom
renovate/openbao-openbao-2.6.x
Open

feat: update openbao/openbao to v2.6.1 #minor#269
public-glueops-renovatebot[bot] wants to merge 1 commit into
mainfrom
renovate/openbao-openbao-2.6.x

Conversation

@public-glueops-renovatebot

@public-glueops-renovatebot public-glueops-renovatebot Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change Pending
openbao/openbao minor 2.5.5 → 2.6.1 v2.6.2

Release Notes

openbao/openbao (openbao/openbao)

v2.6.1

Compare Source

CHANGES
  • packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504]
IMPROVEMENTS
  • core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555]
  • core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506]
BUG FIXES
  • core/expiration: Ensure leases are not inadvertently cached on standby nodes. [GH-3555]
  • core/policies: Allow removal of expiration from policies on POST/PUT to sys/policies/acl/<name> by eliding the parameter; use PATCH to update policies without modifying unnecessary parameters. [GH-3506]
  • core/policies: Fix limit=0 and negative limits bypassing the pagination_limit ACL option. [GH-3518]
  • core/policies: Fix persistence of new allow_wildcards_in_identity_templates, allow_slashes_in_identity_templates parameters in storage. [GH-3506]
  • auth/approle: Ensure initial salt is created without transaction to avoid deadlocks. [GH-3556]
  • auth/jwt: Fix patch operation of CEL roles losing existing data (bound_audiences not_before_leeway, clock_skew_leeway and expiration_leeway). [GH-3551]
  • auth/token: Ensure salt cache is invalidated properly on standby nodes. [GH-3555]
  • sdk/plugin: Ensure all log messages are visible under plugin.ServeMultiplex(...) by default to align with plugin.Serve(...). [GH-3536]
  • sdk: Better support non-usr-merged distributions in containerized testing. [GH-3554]
  • packaging/container: Ensure that labels on UBI-based images comply with Red Hat's certification requirements. [GH-3504]
What's Changed

Full Changelog: openbao/openbao@v2.6.0...v2.6.1

v2.6.0

Compare Source

FEATURES
  • Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297]
    • Partitions tenant storage with distinct cryptographic key material.
    • Allows tenants to revoke access to their namespace via seal operation without impacting other tenants.
    • Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments.
  • Auto Unseal plugins: Add a new kms plugin type that enables Auto Unseal mechanisms to be distributed as external binary plugins. [GH-2586]
    • Declaratively register KMS plugins via plugin "kms" "name" { } stanzas in the server configuration, making "name" available as an Auto Unseal mechanism via seal "name" { }.
    • KMS plugins automatically restart and recover from crashes, avoiding a full instance restart when a seal reaches a bad state (e.g., via a misbehaving PKCS#11 library).
    • Pre-built plugins for many of the seals currently built into OpenBao are available at https://github.com/openbao/openbao-plugins. A plugin-based seal takes priority over a built-in seal if a matching plugin is installed. Note that several provider-specific built-in seals will be removed from OpenBao in v2.7.0 and remain available as external plugins only. Also see the deprecations section of these release notes.
    • Develop custom Auto Unseal mechanisms tailored to your use case using the SDK.
  • Workflows: This adds new endpoints under sys/workflows to allow operators to create workflows and users to execute them.
    • Workflows allow the creation of simplified or managed interfaces over OpenBao's standard API.
    • Use of the allow_unauthenticated_workflows server configuration value enables unauthenticated execution of workflows; any dispatched requests still require authentication but this can be provided as a request parameter.
    • Workflows are built on the common profile engine powering declarative self-initialization and use the same syntax. [GH-2728]
  • Authenticated root generation: New /sys/generate-root-token endpoints are available as replacements for the deprecated unauthenticated ones. [GH-3041]
  • Distroless container images: This is a new container image variant based on distroless/static, available as openbao-distroless. The only executable contained in these images is OpenBao itself. [GH-2592]
SECURITY
  • command/agent: Ensure previously rendered secrets do not appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  • core/recovery: Use constant-time token comparison in recovery mode. GHSA-34fc-gh42-pj53. [GH-3388]
  • core/policies: Prevent LIST operations bypassing capabilities = ["deny"] from a more specific wildcard ACL grant. GHSA-xp3c-3jw3-4vcr. [GH-3389]
  • core/policies: If the value of a template expression contains a + or * character, it will now be rejected by default. Set allow_wildcards_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
  • core/policies: If the value of a template expression contains a / character, it will now be rejected by default. Set allow_slashes_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
  • secret/pki: If the value of a template expression in allowed_uri_sans_template and allowed_domains contains a * character, it will now be rejected by default. Set allow_globs_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
  • secret/ssh: If the value of a template expression in allowed_users or allowed_domains contains a , character, it will now be rejected by default. Set allow_commas_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
IMPROVEMENTS
  • command: Allow overriding the location of ~/.vault-token via the BAO_TOKEN_PATH environment variable. [GH-2706]
  • command/server: Error when unknown keys are present in the declarative self-initialization configuration. [GH-2883]
  • command/server: Add CEL support to self-initialization, allowing finer control over structuring requests. [GH-2671]
  • command/server: Add text/template support to self-initialization, allowing templating of values from other requests/responses. [GH-2727]
  • command/server: Allow conditional execution of self-initialization requests with when keyword. [GH-2739]
  • command/server: Allow self-initialization stanzas in development server mode. [GH-2463]
  • command/server: Allow setting headers on declarative self-initialization requests. [GH-2737]
  • command/agent: Add uid and gid configuration options for the file sink. [GH-2851]
  • command/agent: SIGHUP now reloads the client TLS configuration. [GH-3038]
  • command/login: Support Kubernetes service account token authentication via -method=kubernetes with both interactive and non-interactive modes. [GH-1891]
  • http: Always include full JSON parse and complexity errors in the response instead of hiding it behind a constant error message. [GH-3240]
  • http: Ensure that passthrough_request_headers can pass the Host header to plugins. [GH-3325]
  • core: The sys/ backend is now a singleton shared across all namespaces, reducing idle memory usage of the OpenBao instance. [GH-3007]
  • core/leases: Lease lookup responses will now include path, namespace_path and revoke_error. [GH-1906]
  • core/listeners: Add a parameter to allow cross-origin requests to include credentials (Access-Control-Allow-Credentials header). [GH-2262]
  • core/profiles: Canonicalize headers before evaluating request. [GH-3465]
  • core/profiles: Parse login MFA from request header information. [GH-3465]
  • seal/azurekeyvault: Support explicitly setting Azure authentication methods and add support for authenticating using Azure managed identities. [GH-2519]
  • seal/pkcs11: When using public/private key encryption, fall back to finding the public key via the private key's CKA_ID if both key halves did not share the same CKA_LABEL. [GH-3231]
  • physical/raft: Detect, log, and rollback transactions that have never been committed or rolled-back. If you see the message "transaction was leaked" in your logs, please open an issue. [GH-2185]
  • physical/raft: Improve snapshot duration while slightly increasing snapshot size. [GH-3061]
  • physical/raft: Support auto_join via DNS SRV records. [GH-3397]
  • auth/cert: Add support for X-Tls-Client-Cert, to allow processing of a leaf certificate forwarded from a TLS-terminating reverse proxy. [GH-2080]
  • auth/jwt: Add new Kubernetes JWT provider that authenticates to the Kubernetes API using a pod's service account token. [GH-2114]
  • auth/kerberos: Add the decode_pac option in order to improve compatibility with Kerberos systems. [GH-2211]
  • auth/userpass: Add password_hash field to allow providing a pre-hashed bcrypt password instead of plaintext. [GH-2702]
  • secrets/pki: Add encode_json and decode_json CEL helpers. [GH-1549]
  • secrets/totp: Add generated, expire_time, and period fields to code generation response. [GH-2585]
  • secrets/ssh: Search for public and private key files if -public-key-path and -private-key-path flags aren't given, respectively. [GH-2419]
  • database/mysql: Add multi-host connection failover support. Connection URLs can now specify multiple hosts (e.g., tcp(host1:3306,host2:3306)) for automatic failover when a host becomes unavailable. [GH-2312]
  • api, sdk: Add additional constants for commonly used headers. [GH-2323]
  • api: Add ClientCertBytes and ClientKeyBytes as possible in-memory cert contents in TLSConfig. [GH-2798]
  • api: Add first-class support for /sys/namespaces APIs via .Sys().CreateNamespace(...) & co. [GH-2955]
  • api: Add methods to list and scan keys to the KVv1 and KVv2 client. [GH-3220]
  • api: Allow disabling automatic configuration from environment variables in the API client via a DisableEnvironment field on Config and a NewConfig constructor to create clean client configurations. [GH-2834]
  • sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB. [GH-2464]
  • ui: Add lang="en" attribute to html tag. [GH-2580]
  • ui: Update EmberJS to v4.12 LTS. [GH-2653]
CHANGES
  • command: Remove buffering and delayed release of logs during startup phase of server, agent, proxy & debug subcommands. This includes the removal of the undocumented and hidden -disable-gated-logs flag. [GH-2620]
  • command: operator generate-root now uses the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
  • core: net/http.ServeMux in Go 1.26 now uses a 307 redirect instead of a 301 redirect when given a bare path which doesn't exist in the multiplexer but which a path with a trailing slash exists for. This causes some POST/PUT operations to fail with a 400 instead of 404, as OpenBao does not allow writes to paths ending in a slash. See also: https://go.dev/doc/go1.26. [GH-3072]
  • core/identity: Remove corrupt namespace identity groups created prior to v2.5.0 during unseal; affected groups must be recreated by an administrator. Check for deleting corrupt group in server startup logs. [GH-2454]
  • sys/init, sys/rekey/init: The stored_shares parameter was removed and will now be ignored. [GH-2662]
  • sys/seal-status: Renamed misleading build_date response field to commit_date. [GH-2678]
  • sys/version-history: Renamed misleading build_date response field to commit_date. [GH-2678]
  • api: Removed the StoredShares field from InitRequest and RotateInitRequest structs. [GH-2662]
  • api: (*Sys).GenerateRoot* methods now use the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
  • packaging: Renamed misleading ldflags definition BuildDate to CommitDate. Build systems need to adjust their pipelines to reflect this change. [GH-2678]
  • packaging/container: Removed name, maintainer, vendor, version, release, revision, summary, and description labels from container images in favor of the already attached OpenContainers labels. If you have tooling that relies on these labels, instruct it to use the OpenContainers labels instead. [GH-2589]
  • packaging/container: The openbao & openbao-hsm container images now run under the openbao user rather than the root user by default, matching the default behavior of openbao-ubi variants:
    • Note that the container entrypoint will always drop down to the openbao user before starting OpenBao even if started as root. The additional capabilities are only used pre-startup to automatically fix up permissions of files accessed by OpenBao. [GH-2589]
    • If you rely on the container initially running as root by default, you can revert to this behavior by manually specifying the user in your container engine.
  • packaging/ui: Switch from yarn to pnpm. [GH-2791]
  • releases: Artifacts on GitHub now follow consistent naming across archives, SBOMs and signatures. Most notably, "x86_64" or "amd64" is now always "amd64", and the operating system is always lowercased. [GH-3209]
  • releases: Checksums are now provided as a single, consolidated checksums.txt artifact as opposed to per-OS checksum files such as checksums-linux.txt. [GH-3209]
BUG FIXES
  • command: Fix bao operator rotate-keys and bao operator rekey warning about new key shares when rotating the barrier root key only. [GH-2648]
  • command/agent: Fix in-memory sink panic when proxying auth/token/lookup-self while unauthenticated. [GH-3462]
  • command/server: Revoke the transient root token after declarative self-initialization, including failure paths. [GH-3346]
  • core: Propagate keyring upgrades of sealable namespaces to read-enabled standby nodes. [GH-3409]
  • core/seal: Fix /sys/rotate/root/update returning a random, unused key share value when rotating the barrier root key using recovery keys. [GH-2648]
  • core/listeners: Close HTTP servers first before closing the underlying listener. [GH-2703]
  • core/namespaces: Fix PATCH on a namespace returning status 500 on missing or nonexistent namespace. [GH-2955]
  • core/audit: Ensure config-driven audit mounts are removed from storage when removed from configuration. [GH-3488]
  • core/audit: Include request.id for path-help audit entries [GH-3440]
  • core/auth: Ensure inline auth does not generate in-memory lease information. [GH-3343]
  • core/mfa: Handle invalidation for login MFA within namespaces, ensuring standby nodes respond appropriately on writes. [GH-3283]
  • core/workflows: Ensure logical.Request.Connection is set to allow certificate auth and login MFA to work. [GH-3465]
  • seal/pkcs11: Fix "invalid key format" error when key_id is provided but key_label is not. [GH-3231]
  • seal/pkcs11: Properly strip hex prefix when setting key_id as hex value. [GH-3231]
  • physical/raft: Forward bootstrap challenge/answer requests to active node, fixing raft join failures via load balancer. [GH-2976]
  • sys/plugin: Fix plugin reload returning success for non-existent plugin. [GH-2398]
  • sys/quotas: Fix unintentional attempts to delete quotas on standby nodes when mount is removed. [GH-3316]
  • sys/raw: Prevent writes to and return distinctive error reading storage associated with sealed namespaces. [GH-3426]
  • secrets/pki: Add missing migration for not_after_bound and not_before_bound role fields. [GH-3031]
  • secrets/pki: /sign-verbatim now preserves the original subject encoding from the CSR. Previously, UTF8String values were re-encoded as PrintableString when the subject contained only ASCII characters. [GH-2861]
  • openapi: Add missing support for reporting SCAN on endpoints. [GH-2902]
  • openapi: Add missing support for reporting PATCH support on endpoints. [GH-3289
DEPRECATIONS
  • core/seal: Following the introduction of pluggable Auto Unseal support in this release, the built-in versions of the alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and remain available as external plugins only. [GH-2586]
  • physical/file: Deprecate file storage backend for removal in v2.7.0. [GH-2849]
  • packaging, seal/pkcs11: Following the introduction of pluginized HSM/PKCS#11 Auto Unseal support in this release, the HSM distribution of OpenBao will be discontinued by v2.7.0. PKCS#11 support remains available via the PKCS#11 plugin which can be used together with the standard distribution of OpenBao. [GH-2586]
  • packaging: Drop builds for 32-bit ARM Windows as part of its removal from Go 1.26. [GH-3191]
  • packaging/container: Architecture-specific container image tags such as openbao/openbao:2.6.0-arm64 will not be published starting with this release. Refer to multi-arch container images instead (simply openbao/openbao:2.6.0). [GH-3209]
  • auth/kerberos: The built-in Kerberos auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
  • auth/ldap: The built-in LDAP auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
  • auth/radius: The built-in RADIUS auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
  • secret/ldap: The built-in LDAP secrets plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
New Contributors

What's Changed

Full Changelog: openbao/openbao@v2.5.5...v2.6.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor feat: update openbao/openbao to v2.6.0 #minor - autoclosed Aug 15, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot deleted the renovate/openbao-openbao-2.6.x branch August 15, 2026 09:41
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor - autoclosed feat: update openbao/openbao to v2.6.0 #minor Aug 15, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from 37eed09 to be9d6ae Compare August 15, 2026 09:54
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor feat: update openbao/openbao to v2.6.0 #minor - autoclosed Aug 15, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor - autoclosed feat: update openbao/openbao to v2.6.0 #minor Aug 15, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from be9d6ae to ad9505e Compare August 15, 2026 14:26
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor feat: update openbao/openbao to v2.6.0 #minor - autoclosed Aug 15, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor - autoclosed feat: update openbao/openbao to v2.6.0 #minor Aug 15, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from ad9505e to 20b7ad5 Compare August 15, 2026 17:39
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor feat: update openbao/openbao to v2.6.0 #minor - autoclosed Aug 15, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor - autoclosed feat: update openbao/openbao to v2.6.0 #minor Aug 15, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 3 times, most recently from 2c2108d to 588f3db Compare August 21, 2026 14:59
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.0 #minor feat: update openbao/openbao to v2.6.1 #minor Aug 21, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch from 588f3db to a134b44 Compare August 22, 2026 15:40
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor feat: update openbao/openbao to v2.6.1 #minor - autoclosed Aug 22, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor - autoclosed feat: update openbao/openbao to v2.6.1 #minor Aug 22, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from a134b44 to 2e5a026 Compare August 22, 2026 17:40
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor feat: update openbao/openbao to v2.6.1 #minor - autoclosed Aug 22, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor - autoclosed feat: update openbao/openbao to v2.6.1 #minor Aug 22, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from 2e5a026 to 00e8e5d Compare August 22, 2026 20:42
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor feat: update openbao/openbao to v2.6.1 #minor - autoclosed Aug 22, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor - autoclosed feat: update openbao/openbao to v2.6.1 #minor Aug 22, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from 00e8e5d to fb572df Compare August 22, 2026 21:53
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor feat: update openbao/openbao to v2.6.1 #minor - autoclosed Aug 23, 2026
@public-glueops-renovatebot public-glueops-renovatebot Bot changed the title feat: update openbao/openbao to v2.6.1 #minor - autoclosed feat: update openbao/openbao to v2.6.1 #minor Aug 23, 2026
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch 2 times, most recently from fb572df to c668af7 Compare August 23, 2026 10:42
@public-glueops-renovatebot
public-glueops-renovatebot Bot force-pushed the renovate/openbao-openbao-2.6.x branch from c668af7 to 9843642 Compare August 23, 2026 13:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

auto-update enhancement New feature or request include-in-release-notes minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants