[dc-tec]

Summary

Prepare the 0.6.1 maintenance release with a current, checked operator-upgrade baseline and reviewed stable documentation. Candidate qualification now rejects stale baseline pins before publication approval; the target version comes from the release manifest.

The upgrade harness preserves legacy Shared-mode coverage by seeding under pinned 0.5.3, then establishes the published 0.6.0 manager and helper images before the candidate handoff. It checks Pod readiness, retained resource identities, and existing data at that boundary. A refresh command updates reviewed chart and image pins from published release provenance. The harness downloads the baseline chart by OCI digest and reads CRDs from the local archive. This keeps Helm 4 OCI progress messages out of the Kubernetes manifest stream. It checks the fixture's expected voter topology and keeps both pin files synchronized. The baseline step remains unconditional and blocking. Historical API migration fixtures remain independent.

The change also classifies actual denial-of-service fixes as security updates while excluding documentation-only discussion, adds the pending 0.6.1 release notes/page, and updates the stable restore, compatibility, configuration, and generated API documentation.

Fresh hosted scans identified CVE-2026-78661 in golang.org/x/net 0.61.0. This PR updates it to the fixed 0.62.0 release and regenerates vendor. Only the HTML parser/rendering package changes are included in the vendored runtime subset; the Go version and transitive module requirements remain unchanged.

Related Issues

• Equivalent main preparation: fix(ci): prepare 0.6.1 release qualification #937

• Release preparation: chore(release-0.6): release 0.6.1 #936

• API-group migration sequencing: OpenBao Operator is moving toward a new project home under KubeBao #785

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor (code improvement/cleanup)
• CI, release, or build tooling
• Other maintenance

Risk and Compatibility

The Kubernetes API remains openbao.org/v1alpha1. The release manifest and chart versions remain unchanged in this preparation PR. The 0.7.0 API-group migration and its fixtures remain separate.

The staged upgrade harness passes hosted CI on the preparation head. Ordinary CI uses the unchanged manifest version, 0.6.0-e2e. Exact 0.6.1 candidate qualification and publication remain pending; the documentation does not claim either has passed. The baseline check retains reviewed digests and fails when the expected predecessor changes.

Verification

• Passed: devenv test; operator:bootstrap; operator:doctor.

• Passed: strict docs build, including all generated stable API pages and site/link validation.

• Passed: release automation regression tests, including the 0.6.1 go-jose metadata case and subsequent non-security release.

• Passed: operator-upgrade harness checks and eight Python regression tests; ShellCheck; published 0.6.0 baseline metadata check for target 0.6.1.

• Passed: serialized API contract and CI-check/routing tests; published-chart rendering by OCI digest for both pinned baseline Deployments. Restore guidance also covers canonical snapshot versions and custom-image pin requirements.

• Passed: regenerated vendor verification, upstream x/net HTML tests, and storage/OpenBao adapter tests after the 0.62.0 security update.

• Local limit: the full core gate stopped after disk exhaustion interrupted Docker; the Docker socket is unavailable. Focused local checks pass. Full hosted CI passes on the preparation head.

• Passed: all seven expected Rolling cases in the focused Nightly run, including the original BlueGreen backup-order case in 74.304 seconds. Runtime source: f41ca87. The workflow failed separately in the staged operator-upgrade harness because Helm 4 OCI messages entered the CRD stream. The archive fix passes local checks and the hosted staged-upgrade rehearsal on the latest preparation head.

• Passed: full hosted CI on f01bbf4a5ac3dcbef216712a6308114c572d7962: all thirteen E2E lanes, five security jobs, and Operator Upgrade E2E. DCO, CI Required, CodeQL Required, and Gate Release PR Merge all pass. The upgrade rehearsal verifies the published 0.6.0 image digests, retained resource identities and data, JWT migration, Autopilot repair, and restore guardrail.

Reviewer Notes

CodeRabbit reviewed the initial preparation commit 23d6cfa; all resulting review threads are resolved. Its review of later commits was blocked by the free-OSS quota. Automatic CodeRabbit review is skipped on the patch PR because it targets a non-default branch. Maintainer review approval is still required.

Nightly run 42195382557 stalled in the replacement backup executor after leader discovery, before the BlueGreen upgrade started. The retained diagnostics cannot identify the blocking HTTP operation. The same case passed in the preceding Nightly and current-main CI, with no relevant source change; this does not establish a flake. The focused dependency-fix-head Nightly rerun passed all seven expected cases; this adds execution evidence but does not establish the cause of the earlier stall.

GitHub also reports existing medium advisory GHSA-g3hv-75wg-m249 in the exact-version release-please wrapper's transitive minimatch dependency. Its available fix requires a major dependency update and a separate compatibility review. This PR does not change that dependency.

Candidate environment approval and the release:candidate label are configured separately in GitHub. No candidate publication approval, tag, draft release, or release publication is part of this PR.

Checklist

• My code follows the project style guide.
• I have performed a self-review of my own code.
• I have added or updated tests, or explained why tests are not needed.
• I have updated documentation, or explained why docs are not needed.
• I have updated generated artifacts, or confirmed none are affected.
• I have checked that this change does not log or expose secrets, tokens, credentials, keys, or raw Secret data.
• I have run the relevant local checks, or documented why they were not run.
• Any dependent changes have been merged, published, or clearly called out.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: kubebao/openbao-operator
• Branch: fix/release-0.6.1-patch-preparation
• File: .coderabbit.yaml
• Commit: f01bbf4
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9752fc66-6071-4f48-a32a-9497d8f74534

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn