Skip to content

Update module github.com/openbao/openbao/api/v2 to v2.6.0 - #221

Merged
pulumi-renovate[bot] merged 1 commit into
mainfrom
renovate/github.com-openbao-openbao-api-v2-2.x
Aug 3, 2026
Merged

Update module github.com/openbao/openbao/api/v2 to v2.6.0#221
pulumi-renovate[bot] merged 1 commit into
mainfrom
renovate/github.com-openbao-openbao-api-v2-2.x

Conversation

@pulumi-renovate

@pulumi-renovate pulumi-renovate Bot commented Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/openbao/openbao/api/v2 v2.1.0 → v2.6.0 age confidence

Release Notes

openbao/openbao (github.com/openbao/openbao/api/v2)

v2.6.0

Compare Source

FEATURES

  • Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297]
    • Partitions tenant storage with distinct cryptographic key material.
    • Allows tenants to revoke access to their namespace via seal operation without impacting other tenants.
    • Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments.
  • Auto Unseal plugins: Add a new kms plugin type that enables Auto Unseal mechanisms to be distributed as external binary plugins. [GH-2586]
    • Declaratively register KMS plugins via plugin "kms" "name" { } stanzas in the server configuration, making "name" available as an Auto Unseal mechanism via seal "name" { }.
    • KMS plugins automatically restart and recover from crashes, avoiding a full instance restart when a seal reaches a bad state (e.g., via a misbehaving PKCS#11 library).
    • Pre-built plugins for many of the seals currently built into OpenBao are available at https://github.com/openbao/openbao-plugins. A plugin-based seal takes priority over a built-in seal if a matching plugin is installed. Note that several provider-specific built-in seals will be removed from OpenBao in v2.7.0 and remain available as external plugins only. Also see the deprecations section of these release notes.
    • Develop custom Auto Unseal mechanisms tailored to your use case using the SDK.
  • Workflows: This adds new endpoints under sys/workflows to allow operators to create workflows and users to execute them.
    • Workflows allow the creation of simplified or managed interfaces over OpenBao's standard API.
    • Use of the allow_unauthenticated_workflows server configuration value enables unauthenticated execution of workflows; any dispatched requests still require authentication but this can be provided as a request parameter.
    • Workflows are built on the common profile engine powering declarative self-initialization and use the same syntax. [GH-2728]
  • Authenticated root generation: New /sys/generate-root-token endpoints are available as replacements for the deprecated unauthenticated ones. [GH-3041]
  • Distroless container images: This is a new container image variant based on distroless/static, available as openbao-distroless. The only executable contained in these images is OpenBao itself. [GH-2592]

SECURITY

  • command/agent: Ensure previously rendered secrets do not appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  • core/recovery: Use constant-time token comparison in recovery mode. GHSA-34fc-gh42-pj53. [GH-3388]
  • core/policies: Prevent LIST operations bypassing capabilities = ["deny"] from a more specific wildcard ACL grant. GHSA-xp3c-3jw3-4vcr. [GH-3389]
  • core/policies: If the value of a template expression contains a + or * character, it will now be rejected by default. Set allow_wildcards_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
  • core/policies: If the value of a template expression contains a / character, it will now be rejected by default. Set allow_slashes_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
  • secret/pki: If the value of a template expression in allowed_uri_sans_template and allowed_domains contains a * character, it will now be rejected by default. Set allow_globs_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
  • secret/ssh: If the value of a template expression in allowed_users or allowed_domains contains a , character, it will now be rejected by default. Set allow_commas_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]

IMPROVEMENTS

  • command: Allow overriding the location of ~/.vault-token via the BAO_TOKEN_PATH environment variable. [GH-2706]
  • command/server: Error when unknown keys are present in the declarative self-initialization configuration. [GH-2883]
  • command/server: Add CEL support to self-initialization, allowing finer control over structuring requests. [GH-2671]
  • command/server: Add text/template support to self-initialization, allowing templating of values from other requests/responses. [GH-2727]
  • command/server: Allow conditional execution of self-initialization requests with when keyword. [GH-2739]
  • command/server: Allow self-initialization stanzas in development server mode. [GH-2463]
  • command/server: Allow setting headers on declarative self-initialization requests. [GH-2737]
  • command/agent: Add uid and gid configuration options for the file sink. [GH-2851]
  • command/agent: SIGHUP now reloads the client TLS configuration. [GH-3038]
  • command/login: Support Kubernetes service account token authentication via -method=kubernetes with both interactive and non-interactive modes. [GH-1891]
  • http: Always include full JSON parse and complexity errors in the response instead of hiding it behind a constant error message. [GH-3240]
  • http: Ensure that passthrough_request_headers can pass the Host header to plugins. [GH-3325]
  • core: The sys/ backend is now a singleton shared across all namespaces, reducing idle memory usage of the OpenBao instance. [GH-3007]
  • core/leases: Lease lookup responses will now include path, namespace_path and revoke_error. [GH-1906]
  • core/listeners: Add a parameter to allow cross-origin requests to include credentials (Access-Control-Allow-Credentials header). [GH-2262]
  • core/profiles: Canonicalize headers before evaluating request. [GH-3465]
  • core/profiles: Parse login MFA from request header information. [GH-3465]
  • seal/azurekeyvault: Support explicitly setting Azure authentication methods and add support for authenticating using Azure managed identities. [GH-2519]
  • seal/pkcs11: When using public/private key encryption, fall back to finding the public key via the private key's CKA_ID if both key halves did not share the same CKA_LABEL. [GH-3231]
  • physical/raft: Detect, log, and rollback transactions that have never been committed or rolled-back. If you see the message "transaction was leaked" in your logs, please open an issue. [GH-2185]
  • physical/raft: Improve snapshot duration while slightly increasing snapshot size. [GH-3061]
  • physical/raft: Support auto_join via DNS SRV records. [GH-3397]
  • auth/cert: Add support for X-Tls-Client-Cert, to allow processing of a leaf certificate forwarded from a TLS-terminating reverse proxy. [GH-2080]
  • auth/jwt: Add new Kubernetes JWT provider that authenticates to the Kubernetes API using a pod's service account token. [GH-2114]
  • auth/kerberos: Add the decode_pac option in order to improve compatibility with Kerberos systems. [GH-2211]
  • auth/userpass: Add password_hash field to allow providing a pre-hashed bcrypt password instead of plaintext. [GH-2702]
  • secrets/pki: Add encode_json and decode_json CEL helpers. [GH-1549]
  • secrets/totp: Add generated, expire_time, and period fields to code generation response. [GH-2585]
  • secrets/ssh: Search for public and private key files if -public-key-path and -private-key-path flags aren't given, respectively. [GH-2419]
  • database/mysql: Add multi-host connection failover support. Connection URLs can now specify multiple hosts (e.g., tcp(host1:3306,host2:3306)) for automatic failover when a host becomes unavailable. [GH-2312]
  • api, sdk: Add additional constants for commonly used headers. [GH-2323]
  • api: Add ClientCertBytes and ClientKeyBytes as possible in-memory cert contents in TLSConfig. [GH-2798]
  • api: Add first-class support for /sys/namespaces APIs via .Sys().CreateNamespace(...) & co. [GH-2955]
  • api: Add methods to list and scan keys to the KVv1 and KVv2 client. [GH-3220]
  • api: Allow disabling automatic configuration from environment variables in the API client via a DisableEnvironment field on Config and a NewConfig constructor to create clean client configurations. [GH-2834]
  • sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB. [GH-2464]
  • ui: Add lang="en" attribute to html tag. [GH-2580]
  • ui: Update EmberJS to v4.12 LTS. [GH-2653]

CHANGES

  • command: Remove buffering and delayed release of logs during startup phase of server, agent, proxy & debug subcommands. This includes the removal of the undocumented and hidden -disable-gated-logs flag. [GH-2620]
  • command: operator generate-root now uses the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
  • core: net/http.ServeMux in Go 1.26 now uses a 307 redirect instead of a 301 redirect when given a bare path which doesn't exist in the multiplexer but which a path with a trailing slash exists for. This causes some POST/PUT operations to fail with a 400 instead of 404, as OpenBao does not allow writes to paths ending in a slash. See also: https://go.dev/doc/go1.26. [GH-3072]
  • core/identity: Remove corrupt namespace identity groups created prior to v2.5.0 during unseal; affected groups must be recreated by an administrator. Check for deleting corrupt group in server startup logs. [GH-2454]
  • sys/init, sys/rekey/init: The stored_shares parameter was removed and will now be ignored. [GH-2662]
  • sys/seal-status: Renamed misleading build_date response field to commit_date. [GH-2678]
  • sys/version-history: Renamed misleading build_date response field to commit_date. [GH-2678]
  • api: Removed the StoredShares field from InitRequest and RotateInitRequest structs. [GH-2662]
  • api: (*Sys).GenerateRoot* methods now use the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
  • packaging: Renamed misleading ldflags definition BuildDate to CommitDate. Build systems need to adjust their pipelines to reflect this change. [GH-2678]
  • packaging/container: Removed name, maintainer, vendor, version, release, revision, summary, and description labels from container images in favor of the already attached OpenContainers labels. If you have tooling that relies on these labels, instruct it to use the OpenContainers labels instead. [GH-2589]
  • packaging/container: The openbao & openbao-hsm container images now run under the openbao user rather than the root user by default, matching the default behavior of openbao-ubi variants:
    • Note that the container entrypoint will always drop down to the openbao user before starting OpenBao even if started as root. The additional capabilities are only used pre-startup to automatically fix up permissions of files accessed by OpenBao. [GH-2589]
    • If you rely on the container initially running as root by default, you can revert to this behavior by manually specifying the user in your container engine.
  • packaging/ui: Switch from yarn to pnpm. [GH-2791]
  • releases: Artifacts on GitHub now follow consistent naming across archives, SBOMs and signatures. Most notably, "x86_64" or "amd64" is now always "amd64", and the operating system is always lowercased. [GH-3209]
  • releases: Checksums are now provided as a single, consolidated checksums.txt artifact as opposed to per-OS checksum files such as checksums-linux.txt. [GH-3209]

BUG FIXES

  • command: Fix bao operator rotate-keys and bao operator rekey warning about new key shares when rotating the barrier root key only. [GH-2648]
  • command/agent: Fix in-memory sink panic when proxying auth/token/lookup-self while unauthenticated. [GH-3462]
  • command/server: Revoke the transient root token after declarative self-initialization, including failure paths. [GH-3346]
  • core: Propagate keyring upgrades of sealable namespaces to read-enabled standby nodes. [GH-3409]
  • core/seal: Fix /sys/rotate/root/update returning a random, unused key share value when rotating the barrier root key using recovery keys. [GH-2648]
  • core/listeners: Close HTTP servers first before closing the underlying listener. [GH-2703]
  • core/namespaces: Fix PATCH on a namespace returning status 500 on missing or nonexistent namespace. [GH-2955]
  • core/audit: Ensure config-driven audit mounts are removed from storage when removed from configuration. [GH-3488]
  • core/audit: Include request.id for path-help audit entries [GH-3440]
  • core/auth: Ensure inline auth does not generate in-memory lease information. [GH-3343]
  • core/mfa: Handle invalidation for login MFA within namespaces, ensuring standby nodes respond appropriately on writes. [GH-3283]
  • core/workflows: Ensure logical.Request.Connection is set to allow certificate auth and login MFA to work. [GH-3465]
  • seal/pkcs11: Fix "invalid key format" error when key_id is provided but key_label is not. [GH-3231]
  • seal/pkcs11: Properly strip hex prefix when setting key_id as hex value. [GH-3231]
  • physical/raft: Forward bootstrap challenge/answer requests to active node, fixing raft join failures via load balancer. [GH-2976]
  • sys/plugin: Fix plugin reload returning success for non-existent plugin. [GH-2398]
  • sys/quotas: Fix unintentional attempts to delete quotas on standby nodes when mount is removed. [GH-3316]
  • sys/raw: Prevent writes to and return distinctive error reading storage associated with sealed namespaces. [GH-3426]
  • secrets/pki: Add missing migration for not_after_bound and not_before_bound role fields. [GH-3031]
  • secrets/pki: /sign-verbatim now preserves the original subject encoding from the CSR. Previously, UTF8String values were re-encoded as PrintableString when the subject contained only ASCII characters. [GH-2861]
  • openapi: Add missing support for reporting SCAN on endpoints. [GH-2902]
  • openapi: Add missing support for reporting PATCH support on endpoints. [GH-3289

DEPRECATIONS

  • core/seal: Following the introduction of pluggable Auto Unseal support in this release, the built-in versions of the alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and remain available as external plugins only. [GH-2586]
  • physical/file: Deprecate file storage backend for removal in v2.7.0. [GH-2849]
  • packaging, seal/pkcs11: Following the introduction of pluginized HSM/PKCS#11 Auto Unseal support in this release, the HSM distribution of OpenBao will be discontinued by v2.7.0. PKCS#11 support remains available via the PKCS#11 plugin which can be used together with the standard distribution of OpenBao. [GH-2586]
  • packaging: Drop builds for 32-bit ARM Windows as part of its removal from Go 1.26. [GH-3191]
  • packaging/container: Architecture-specific container image tags such as openbao/openbao:2.6.0-arm64 will not be published starting with this release. Refer to multi-arch container images instead (simply openbao/openbao:2.6.0). [GH-3209]
  • auth/kerberos: The built-in Kerberos auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
  • auth/ldap: The built-in LDAP auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
  • auth/radius: The built-in RADIUS auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
  • secret/ldap: The built-in LDAP secrets plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]

New Contributors

What's Changed

Full Changelog: openbao/openbao@v2.5.5...v2.6.0

v2.5.1

Compare Source

SECURITY

BUG FIXES

  • seal: Fix Auto Unseal failing when upgrading to v2.5.0 or downgrading from v2.5.0 to an earlier version. This affected the following providers: AliCloud KMS, AWS KMS, Azure Key Vault, GCP Cloud KMS & OCI KMS. [GH-2505]
  • core/mounts: Don't attempt to upgrade legacy mount tables when in read-only standby mode. [GH-2467]
  • core/expiration: Fix total lease count not being decremented when revoking irrevocable leases. [GH-2414]
  • pki: Fix "context canceled" issue when processing cache invalidation, leading to pki returning 500 until reload. [GH-2472]
  • command: Fix panic when the home directory cannot be trivially deduced via environment variables. [GH-2446]

CHANGES

  • core/identity: Remove pre-v2.5.0 corrupt namespace identity groups during unseal; corrupt groups need to be recreated by an admin. Check for deleting corrupt group in server startup logs. [GH-2454]

What's Changed

Full Changelog: openbao/openbao@v2.5.0...v2.5.1

v2.5.0

Compare Source

[!TIP]
This release adds support for horizontal read scalability!

SECURITY
  • core/sys: BREAKING: default value of disable_unauthed_rekey_endpoints is true, to continue using unauthed rekey endpoints, set disable_unauthed_rekey_endpoints=false in listeners explicitly. [GH-2125]
CHANGES
  • Remove the deprecated creation_statements, revocation_statements, rollback_statements, and renew_statements fields from the dbplugin Statements protobuf message [GH-1962]
  • api: The deprecated api.MountConfigOutput.PluginName field was removed. This was already always empty. [GH-2036]
  • auth/jwt: Return error msg on OIDCDiscoveryURL including .well-known/openid-configuration component. [GH-2066]
  • core/audit: removed jsonx as a output format option for audit mounts [GH-2047]
  • sys/host-info: This endpoint may start reporting slightly higher memory usage than before (On Linux only). See https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for more information. [GH-1887]
FEATURES
  • Add declarative plugin distribution via OCI images: using the plugin configuration keyword.
    • Plugins can be automatically downloaded via the plugin_auto_download=true option.
    • Plugins can be manually downloaded via the bao plugin init command.
    • Plugins can be automatically registered via the plugin_auto_register=true option, regardless if they were manually provisioned or from OCI images. [GH-1824]
  • Support Horizontal Read Scalability: all existing HA standby nodes are automatically upgraded with read support.
    • Requests which only perform storage read operations will be handled locally on the standby node.
    • Requests which perform a storage write operation (or as indicated by plugins) are forwarded to the active leader.
    • Results are eventually consistent: a write may not be immediately visible on the standby.
    • To disable, set disable_standby_reads=true in the config file before startup. [GH-1986]
  • OIDC Provider: Add Client Credentials flow to OIDC Provider. [GH-1732]
  • sdk/framework: add Response.SchemaName to allow custom response schema names in the generated OpenAPI spec. [GH-1714]
IMPROVEMENTS
  • audit: Add http audit device for low-volume, webhook-based audit event reporting. [GH-1709]
  • auth/jwt: Add type checking to role. [GH-1854]
  • command: Add environment variables to provide configuration for Proxy, Agent, and bao operator migrate via BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  • command: Support BAO_CONFIG_PATH in plugin init, just like server &c do. [GH-2164]
  • command: server, operator diagnose and 'operator validate-config` now support the environment variable BAO_CONFIG_FILE for the -config command option. [GH-2115]
  • core/metrics: Support custom path for metrics on metrics-only listeners. [GH-1853]
  • core/namespaces: Use JobManager for namespace deletion, decreasing lock contention. [GH-2226]
  • core/policies: Add endpoint to allow detailed listing of a subset of policies. [GH-1965]
  • core/policies: Use per-namespace write lock, improving parallelism. [GH-2226]
  • core: Added metrics_only and disallow_metrics options to control metrics endpoint exposure on a per-listener basis. [GH-1834]
  • database/valkey: Adds the ability to configure the Valkey database connection using a single connection_url parameter. [GH-1923]
  • database: all database plugins now ignore "not found" errors on revoke by default. See Plugin Author Guide for rationale. [GH-2101]
  • openapi: Add response schemas for token store operations and update operation suffixes. [GH-1840]
  • pki: add allowed_ip_sans_cidr parameter to PKI role system, to provide additional checks for IP SANs. [GH-1833]
  • storage/postgresql: implement physical.FencingHABackend to minimize chances that writes on secondary nodes occur. [GH-1571]
  • transit: Add associated_data parameter to generate data key. [GH-1828]
  • website: Add an example of current role statement from Valkey. [GH-1811]
DEPRECATIONS
  • core/seal: Remove the undocumented "aead" seal mechanism. Consider switching to the static seal instead as a replacement. [GH-1910]
  • core: Removed FeatureFlags parsing and related code. [GH-2045]
  • sdk: Removed sdk/v2/helper/license package. [GH-2045]
  • ui: Removed internal/ui/feature-flags endpoint and all its usage. [GH-2045]
BUG FIXES
  • agent/auth: Fix token reissue error with kerberos method. [GH-2373]
  • auth/jwt: Fix ordering of variable declarations in CEL program roles. [GH-1854]
  • core/identity: Ensure periodic func only operates on a single namespace at a time, decreasing storage contention. [GH-2226]
  • core/identity: fix corrupt data being stored when referencing member_group_ids across namespaces (requires unsafe_cross_namespace_identity=true) [GH-2321]
  • core/namespaces: Ensure namespace creation is interruptable, allowing namespace deletion for cleanup. [GH-2226]
  • core/namespaces: Fix deadlock on namespace creation, deletion due to transaction/lock ordering. [GH-2226]
  • core/namespaces: Fix storage failures in namespace creation leading to a total system deadlock. [GH-2166]
  • core/namespaces: improve recovery from partial deletion of namespaces, preventing server startup failure. [GH-2188]
  • database/valkey: The creation_statements parameter now correctly accepts a standard array of strings for ACL rules (e.g., ["+@​read", "~*"]). Previously, it incorrectly required a stringified JSON array. The old format is still supported for backward compatibility. [GH-1959]
  • helper/jobmanager: Fix queue length metrics to report as gauges. [GH-2226]
  • physical/postgresql: ensure underlying HA lock removal from database causes lock loss, write failures. [GH-2100]
  • raft: return correct raft leader id from read replica nodes when using bao operator raft list-peers. [GH-2331]
  • sdk/logical: Use created transaction for WithTransaction callback. [GH-2226]
  • secrets/pki: Fix ordering of variable declarations in CEL program roles. [GH-1854]

What's Changed over Beta

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@pulumi-renovate pulumi-renovate Bot added dependencies Pull requests that update a dependency file impact/no-changelog-required This issue doesn't require a CHANGELOG update labels Jul 16, 2026
@pulumi-renovate
pulumi-renovate Bot force-pushed the renovate/github.com-openbao-openbao-api-v2-2.x branch 2 times, most recently from 82d7b0d to ef95c95 Compare July 21, 2026 11:25
@pulumi-renovate
pulumi-renovate Bot force-pushed the renovate/github.com-openbao-openbao-api-v2-2.x branch 13 times, most recently from b356736 to 89f55b5 Compare July 31, 2026 12:31
@pulumi-renovate
pulumi-renovate Bot force-pushed the renovate/github.com-openbao-openbao-api-v2-2.x branch from 89f55b5 to 55167a5 Compare August 1, 2026 08:15
@pulumi-renovate
pulumi-renovate Bot merged commit 8a59df8 into main Aug 3, 2026
3 checks passed
@pulumi-renovate
pulumi-renovate Bot deleted the renovate/github.com-openbao-openbao-api-v2-2.x branch August 3, 2026 01:32
@pulumi-bot

pulumi-bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

This PR has been shipped in release v0.0.23.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pulumi-renovate-approve pulumi-renovate-approve[bot] pulumi-renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file impact/no-changelog-required This issue doesn't require a CHANGELOG update

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pulumi-bot