chore(release-0.6): release 0.6.1

.release-please-manifest.json

@@ -1,4 +1,4 @@
 {
-  ".": "0.6.0"
+  ".": "0.6.1"
 }
 

CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Release notes are generated and maintained via **release-please** based on **Conventional Commits**.
 
+## [0.6.1](https://github.com/kubebao/openbao-operator/compare/0.6.0...0.6.1) (2026-11-07)
+
+
+### Bug Fixes
+
+* **ci:** prepare 0.6.1 release qualification ([#938](https://github.com/kubebao/openbao-operator/issues/938)) ([ddb4233](https://github.com/kubebao/openbao-operator/commit/ddb4233e1439a90225fce90c8fff3907ee793d58))
+* **ci:** publish and verify qualification registry bundles ([#927](https://github.com/kubebao/openbao-operator/issues/927)) ([36a964f](https://github.com/kubebao/openbao-operator/commit/36a964f6a79e606b3d3c84980b1fec23aeeab3ad))
+* **ci:** tag releases only after manifest changes ([#914](https://github.com/kubebao/openbao-operator/issues/914)) ([e761cfa](https://github.com/kubebao/openbao-operator/commit/e761cfa72cc55dc994589f1af525bb45cc4e7ad5))
+* **ci:** validate root release manifest in qualification ([#926](https://github.com/kubebao/openbao-operator/issues/926)) ([dab15f3](https://github.com/kubebao/openbao-operator/commit/dab15f3ece031ab399c5c1b59d624a82a502632d))
+* **deps:** patch go-jose RSA JWK denial of service ([#920](https://github.com/kubebao/openbao-operator/issues/920)) ([c5d61dc](https://github.com/kubebao/openbao-operator/commit/c5d61dcc48ec053ff5d685aa30fe680b89edb215))
+* **dev:** exclude local artifacts from Go source checks ([#933](https://github.com/kubebao/openbao-operator/issues/933)) ([495fbf3](https://github.com/kubebao/openbao-operator/commit/495fbf3ee75d599da2d403d0a66582aa4bf96c79))
+* **helm:** preserve admission policies through YAML post-rendering ([#934](https://github.com/kubebao/openbao-operator/issues/934)) ([58e2673](https://github.com/kubebao/openbao-operator/commit/58e2673a70fafc4c73b2dbee56613497f191f588))
+* **raft:** apply Autopilot settings on small clusters ([#932](https://github.com/kubebao/openbao-operator/issues/932)) ([4353096](https://github.com/kubebao/openbao-operator/commit/4353096f3e079fabdb279159e87989a568e257da))
+* **restore:** accept stable OpenBao versions from 2.7 ([89abf71](https://github.com/kubebao/openbao-operator/commit/89abf71b307f211c8ec34034744c3905570ac3a7))
+* **restore:** address version policy review findings ([9671c30](https://github.com/kubebao/openbao-operator/commit/9671c30623d609f948cf073e167f376de4ea9a85))
+
 ## [0.6.0](https://github.com/kubebao/openbao-operator/compare/0.5.3...0.6.0) (2026-10-24)
 
 This rollup excludes fixes already published in 0.5.2 and 0.5.3.

charts/openbao-operator/Chart.yaml

@@ -4,8 +4,8 @@ description: >-
   OpenBao Operator installs the OpenBao Kubernetes operator and its required
   cluster-scoped resources.
 type: application
-version: 0.6.0
-appVersion: 0.6.0
+version: 0.6.1
+appVersion: 0.6.1
 icon: >-
   https://raw.githubusercontent.com/kubebao/openbao-operator/main/website/static/img/brand/kubebao-github-avatar.png
 home: https://github.com/kubebao/openbao-operator
@@ -29,129 +29,35 @@ annotations:
   artifacthub.io/prerelease: "false"
   artifacthub.io/containsSecurityUpdates: 'true'
   artifacthub.io/changes: |
-    - kind: changed
-      description: "auth: require Target self-init for new clusters"
-    - kind: added
-      description: "auth: isolate controller JWTs by target"
-    - kind: added
-      description: "backup: run bounded retention with the writer workload identity"
-    - kind: added
-      description: "backup: schedule disposable restore tests"
-    - kind: added
-      description: "certs: use native TLS certificate reload on OpenBao 2.7"
-    - kind: added
-      description: "networking: support IPv6 and dual-stack clusters"
-    - kind: added
-      description: "network: manage Cilium API-server egress"
-    - kind: added
-      description: "policies: reconcile administrator-approved OpenBao policies"
-    - kind: added
-      description: "restore: guard submission and manage administrator recovery"
-    - kind: added
-      description: "restore: provision retained and disposable recovery targets"
-    - kind: added
-      description: "self-init: add Secret inputs for raw bootstrap requests"
-    - kind: added
-      description: "storage: add nested S3 target options"
-    - kind: added
-      description: "tls: configure hybrid post-quantum key exchange"
-    - kind: added
-      description: "unseal: project the Azure Key Vault workload identity token"
-    - kind: added
-      description: "unseal: select the Azure Key Vault authentication method"
     - kind: fixed
-      description: "admission: allow restore foreground finalizer cleanup"
+      description: "ci: prepare 0.6.1 release qualification"
     - kind: fixed
-      description: "admission: allow scoped helper Pod annotation sync"
+      description: "ci: publish and verify qualification registry bundles"
     - kind: fixed
-      description: "admission: require delegation for read-replica cloud identities"
+      description: "ci: tag releases only after manifest changes"
     - kind: fixed
-      description: "admission: resolve policy type-check warnings"
-    - kind: fixed
-      description: "admission: support scoped PVC binding synchronization"
-    - kind: fixed
-      description: "backup: refresh persisted deadlines after schedule changes"
-    - kind: fixed
-      description: "certs: reject malformed CA key PEM without panicking"
-    - kind: fixed
-      description: "ci: accept fork E2E plans during matrix generation"
-    - kind: fixed
-      description: "ci: decouple edge chart versions from releases"
-    - kind: fixed
-      description: "ci: isolate Cilium Kind networking with VXLAN"
-    - kind: fixed
-      description: "ci: separate restore lanes and pin integration tooling"
-    - kind: fixed
-      description: "client: release shared state for deleted cluster lifetimes"
-    - kind: fixed
-      description: "cluster: resume interrupted peer removal safely"
-    - kind: fixed
-      description: "config: enforce OpenBao configuration version contracts"
-    - kind: fixed
-      description: "dev: make contributor runtime checks portable"
-    - kind: fixed
-      description: "docs: compare published site content by checksum"
-    - kind: fixed
-      description: "e2e: allow restore executors to reach Cilium API servers"
-    - kind: fixed
-      description: "ownership: bind resource mutations to observed identity"
-    - kind: fixed
-      description: "perf: follow restore recovery and measure availability in performance scenarios"
-    - kind: fixed
-      description: "provisioner: allow restore templates without unseal credential Secrets"
-    - kind: fixed
-      description: "provisioner: preserve tenant RBAC through namespace teardown"
-    - kind: fixed
-      description: "restore: expose KMS plugin settings in target templates"
-    - kind: fixed
-      description: "restore: separate disposable reader identity from backups"
-    - kind: security
-      description: "security: bind legacy image signatures to requested digests"
-    - kind: security
-      description: "security: correct Scorecard dependency and policy findings"
-    - kind: security
-      description: "security: enforce key strength and TLS transport policy"
-    - kind: security
-      description: "security: harden verification dependencies and CI controls"
-    - kind: security
-      description: "security: resolve Kubernetes registry credentials by scope"
+      description: "ci: validate root release manifest in qualification"
     - kind: security
-      description: "security: verify admission policies against release contracts"
-    - kind: security
-      description: "security: verify tenant onboarding binding identity"
-    - kind: fixed
-      description: "storage: block IPv6 cloud metadata endpoints"
-    - kind: fixed
-      description: "storage: retain custom CA trust in backup and restore executors"
-    - kind: fixed
-      description: "storage: use complete Azure Blob endpoint URLs"
-    - kind: fixed
-      description: "storage: use credential Secret regions for S3 signing"
-    - kind: fixed
-      description: "tls: validate external server certificate chains"
-    - kind: fixed
-      description: "upgrade: prove workload identity before blue-green cleanup"
+      description: "deps: patch go-jose RSA JWK denial of service"
     - kind: fixed
-      description: "upgrade: retry against the current rendered image target"
+      description: "dev: exclude local artifacts from Go source checks"
     - kind: fixed
-      description: "upgrade: scope rolling executor jobs to durable attempts"
+      description: "helm: preserve admission policies through YAML post-rendering"
     - kind: fixed
-      description: "vcluster: unblock Pod annotation sync and complete safe teardown"
+      description: "raft: apply Autopilot settings on small clusters"
     - kind: fixed
-      description: "workload: complete terminal Pod deletion"
+      description: "restore: accept stable OpenBao versions from 2.7"
     - kind: fixed
-      description: "wrapper: wait for graceful child termination before killing"
-    - kind: changed
-      description: "metrics: scope restore state updates to target clusters"
+      description: "restore: address version policy review findings"
   artifacthub.io/images: |
     - name: openbao-operator
-      image: ghcr.io/kubebao/openbao-operator:0.6.0
+      image: ghcr.io/kubebao/openbao-operator:0.6.1
     - name: openbao-init
-      image: ghcr.io/kubebao/openbao-init:0.6.0
+      image: ghcr.io/kubebao/openbao-init:0.6.1
     - name: openbao-backup
-      image: ghcr.io/kubebao/openbao-backup:0.6.0
+      image: ghcr.io/kubebao/openbao-backup:0.6.1
     - name: openbao-upgrade
-      image: ghcr.io/kubebao/openbao-upgrade:0.6.0
+      image: ghcr.io/kubebao/openbao-upgrade:0.6.1
   artifacthub.io/crds: |
     - kind: OpenBaoCluster
       version: v1alpha1

release-notes/0.6.1.md

@@ -4,9 +4,6 @@ OpenBao Operator 0.6.1 fixes Helm admission-policy serialization, small-cluster
 security issues in go-jose and golang.org/x/net. Restore targets accept stable OpenBao versions from 2.7.0 onward, and
 scheduled restore tests can inherit the version recorded with each backup.
 
-**Publication and final candidate qualification are pending.** These notes describe the prepared changes from
-0.6.0. Use the installation commands only after the release is published and its artifacts are verified.
-
 ## Security update
 
 The operator updates go-jose to 4.1.6 to address an RSA JSON Web Key denial-of-service issue. Install the matching
@@ -57,9 +54,10 @@ target. Both upstream releases contain security fixes. Review SSH identity-templ
 OpenBao server: wildcard substitutions are rejected by default. The operator release does not update
 `spec.version` or automatically upgrade the OpenBao server image.
 
-Focused qualification is recorded in the compatibility reference. Final 0.6.1 release-profile qualification and the
-operator upgrade rehearsal from published 0.6.0 to the final 0.6.1 candidate remain pending. These checks do not
-qualify every Kubernetes distribution, network topology, cloud identity, storage driver, or seal provider.
+The [0.6.1 release qualification checks](https://github.com/kubebao/openbao-operator/pull/936/checks) record the full
+release profile and the operator upgrade rehearsal from published 0.6.0 to the candidate. Earlier focused results
+retain the scope recorded in the compatibility reference. These checks do not qualify every Kubernetes
+distribution, network topology, cloud identity, storage driver, or seal provider.
 
 ## Upgrade from 0.6.0
 

website/content/docs/reference/compatibility.md

@@ -12,8 +12,9 @@ verifiedBy:
 ---
 
 The operator requires Kubernetes 1.33 or newer. The tables describe configured validation targets and focused checks.
-OpenBao Operator 0.6.1 release qualification is pending. The results below do not replace qualification of the final
-candidate or validate every cloud authentication method, distribution, seal, storage driver, or topology.
+The [0.6.1 release qualification checks](https://github.com/kubebao/openbao-operator/pull/936/checks) record the exact
+candidate and results. The focused results below retain their stated scope and do not validate every cloud
+authentication method, distribution, seal, storage driver, or topology.
 
 ## Kubernetes versions
 

website/content/releases/0.6.1.md

@@ -1,7 +1,7 @@
 ---
 title: OpenBao Operator 0.6.1
-description: Prepared maintenance release for Helm admission policies, small-cluster Autopilot, and restore versions.
-eyebrow: Release preparation · 0.6.1
+description: Maintenance release for Helm admission policies, small-cluster Autopilot, security fixes, and restore versions.
+eyebrow: Release · 0.6.1
 weight: 1
 verifiedBy:
   - release-notes/0.6.1.md
@@ -14,16 +14,10 @@ verifiedBy:
   - test/fixtures/operator-upgrade/versions.env
 ---
 
-OpenBao Operator 0.6.1 prepares fixes for Helm admission policies, small-cluster
-Raft Autopilot, and denial-of-service issues in go-jose and golang.org/x/net. Restore
-targets accept stable OpenBao versions from 2.7.0 onward, and scheduled tests can
-inherit each backup's recorded version.
-
-{{< callout type="note" title="Release preparation" >}}
-Publication and final candidate qualification are pending. OpenBao Operator
-0.6.0 remains the latest published release. The installation and artifact links
-below apply after 0.6.1 is published and verified.
-{{< /callout >}}
+OpenBao Operator 0.6.1 fixes Helm admission-policy serialization and small-cluster
+Raft Autopilot configuration. It also addresses denial-of-service issues in
+go-jose and golang.org/x/net. Restore targets accept stable OpenBao versions from
+2.7.0 onward, and scheduled tests can inherit each backup's recorded version.
 
 ## Review the fixes
 
@@ -78,9 +72,10 @@ and the chart at `oci://ghcr.io/kubebao/charts/openbao-operator`, version `0.6.1
 
 ## Preserve the qualification boundary
 
-Final release-profile qualification and the operator upgrade rehearsal from
-published 0.6.0 to the final 0.6.1 candidate remain pending. Earlier focused checks retain the scope
-recorded in [compatibility](../../docs/reference/compatibility/). Rehearse the
+The [0.6.1 release qualification checks](https://github.com/kubebao/openbao-operator/pull/936/checks)
+record the full release profile and the operator upgrade rehearsal from published
+0.6.0 to the candidate. Earlier focused checks retain the scope recorded in
+[compatibility](../../docs/reference/compatibility/). Rehearse the
 production combination in staging. Routine operator and OpenBao downgrades
 remain unsupported.
 

website/content/releases/_index.md

@@ -11,19 +11,15 @@ The current manual stays focused on the current contract. Release pages preserve
 ## Latest published release
 
 <div class="link-grid">
-  <a href="0.6.0/"><strong>0.6.0</strong><p>Target-specific controller authentication, guarded restore recovery, and scheduled restore tests.</p></a>
+  <a href="0.6.1/"><strong>0.6.1</strong><p>Helm admission-policy, small-cluster Autopilot, security, and restore-version fixes.</p></a>
   <a href="https://github.com/kubebao/openbao-operator/releases"><strong>GitHub Releases</strong><p>Published assets, signatures, provenance, tags, and the full archive.</p></a>
 </div>
 
-## Release in preparation
-
-[OpenBao Operator 0.6.1](0.6.1/) prepares Helm admission-policy, small-cluster Autopilot, security, and restore-version
-updates. Publication and final candidate qualification are pending. The latest published release remains 0.6.0.
-
 ## Archive
 
 | Release | Published | Context |
 | --- | --- | --- |
+| [0.6.1](0.6.1/) | [GitHub Release](https://github.com/kubebao/openbao-operator/releases/tag/0.6.1) | Helm admission policies, small-cluster Autopilot, security, and restore versions |
 | [0.6.0](0.6.0/) | 2026-10-24 | Target JWT authentication, restore recovery, and networking changes |
 | [0.5.3](0.5.3/) | 2026-10-20 | Security update for compromised intermediate CA keys |
 | [0.5.2](0.5.2/) | 2026-10-14 | Backup scheduling and compatible fixes |

website/data/version_lines.yaml

@@ -1,14 +1,14 @@
 "0.6.x":
   label: "0.6.x"
   release: "0.6.1"
-  state: "Release preparation"
-  showNotice: true
+  state: "Current stable"
+  showNotice: false
   sourceRef: "0.6.1"
-  fallbackSourceRef: "ced35e7ea5e2a5ab0b95cd7adc25082a19d5146e"
+  fallbackSourceRef: "ddb4233e1439a90225fce90c8fff3907ee793d58"
   editRef: "main"
   contentRoot: "website/content"
   editable: true
-  notice: "Prepared 0.6.x documentation for OpenBao Operator 0.6.1. Publication and final candidate qualification are pending; 0.6.0 remains the latest published release."
+  notice: "Documentation for the 0.6 minor line through OpenBao Operator 0.6.1."
 "0.5.x":
   label: "0.5.x"
   release: "0.5.3"