chore(main): release 0.6.1

.release-please-manifest.json

@@ -1,4 +1,4 @@
 {
-  ".": "0.6.0"
+  ".": "0.6.1"
 }
 

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 Release notes are generated and maintained via **release-please** based on **Conventional Commits**.
 
+## [0.6.1](https://github.com/kubebao/openbao-operator/compare/0.6.0...0.6.1) (2026-11-07)
+
+
+### Bug Fixes
+
+* **ci:** prepare 0.6.1 release qualification ([#937](https://github.com/kubebao/openbao-operator/issues/937)) ([e5e8e4b](https://github.com/kubebao/openbao-operator/commit/e5e8e4ba652b5c1a394fc436fdb425b47c73056f))
+* **ci:** publish and verify qualification registry bundles ([#927](https://github.com/kubebao/openbao-operator/issues/927)) ([36a964f](https://github.com/kubebao/openbao-operator/commit/36a964f6a79e606b3d3c84980b1fec23aeeab3ad))
+* **ci:** tag releases only after manifest changes ([#914](https://github.com/kubebao/openbao-operator/issues/914)) ([e761cfa](https://github.com/kubebao/openbao-operator/commit/e761cfa72cc55dc994589f1af525bb45cc4e7ad5))
+* **ci:** validate root release manifest in qualification ([#926](https://github.com/kubebao/openbao-operator/issues/926)) ([dab15f3](https://github.com/kubebao/openbao-operator/commit/dab15f3ece031ab399c5c1b59d624a82a502632d))
+* **deps:** patch go-jose RSA JWK denial of service ([#920](https://github.com/kubebao/openbao-operator/issues/920)) ([c5d61dc](https://github.com/kubebao/openbao-operator/commit/c5d61dcc48ec053ff5d685aa30fe680b89edb215))
+* **dev:** exclude local artifacts from Go source checks ([#933](https://github.com/kubebao/openbao-operator/issues/933)) ([495fbf3](https://github.com/kubebao/openbao-operator/commit/495fbf3ee75d599da2d403d0a66582aa4bf96c79))
+* **helm:** preserve admission policies through YAML post-rendering ([#934](https://github.com/kubebao/openbao-operator/issues/934)) ([58e2673](https://github.com/kubebao/openbao-operator/commit/58e2673a70fafc4c73b2dbee56613497f191f588))
+* **raft:** apply Autopilot settings on small clusters ([#932](https://github.com/kubebao/openbao-operator/issues/932)) ([4353096](https://github.com/kubebao/openbao-operator/commit/4353096f3e079fabdb279159e87989a568e257da))
+* **restore:** accept stable OpenBao versions from 2.7 ([#935](https://github.com/kubebao/openbao-operator/issues/935)) ([ced35e7](https://github.com/kubebao/openbao-operator/commit/ced35e7ea5e2a5ab0b95cd7adc25082a19d5146e))
+
 ## [0.6.0](https://github.com/kubebao/openbao-operator/compare/0.5.3...0.6.0) (2026-10-24)
 
 This rollup excludes fixes already published in 0.5.2 and 0.5.3.

charts/openbao-operator/Chart.yaml

@@ -4,8 +4,8 @@ description: >-
   OpenBao Operator installs the OpenBao Kubernetes operator and its required
   cluster-scoped resources.
 type: application
-version: 0.6.0
-appVersion: 0.6.0
+version: 0.6.1
+appVersion: 0.6.1
 icon: >-
   https://raw.githubusercontent.com/kubebao/openbao-operator/main/website/static/img/brand/kubebao-github-avatar.png
 home: https://github.com/kubebao/openbao-operator
@@ -29,129 +29,33 @@ annotations:
   artifacthub.io/prerelease: "false"
   artifacthub.io/containsSecurityUpdates: 'true'
   artifacthub.io/changes: |
-    - kind: changed
-      description: "auth: require Target self-init for new clusters"
-    - kind: added
-      description: "auth: isolate controller JWTs by target"
-    - kind: added
-      description: "backup: run bounded retention with the writer workload identity"
-    - kind: added
-      description: "backup: schedule disposable restore tests"
-    - kind: added
-      description: "certs: use native TLS certificate reload on OpenBao 2.7"
-    - kind: added
-      description: "networking: support IPv6 and dual-stack clusters"
-    - kind: added
-      description: "network: manage Cilium API-server egress"
-    - kind: added
-      description: "policies: reconcile administrator-approved OpenBao policies"
-    - kind: added
-      description: "restore: guard submission and manage administrator recovery"
-    - kind: added
-      description: "restore: provision retained and disposable recovery targets"
-    - kind: added
-      description: "self-init: add Secret inputs for raw bootstrap requests"
-    - kind: added
-      description: "storage: add nested S3 target options"
-    - kind: added
-      description: "tls: configure hybrid post-quantum key exchange"
-    - kind: added
-      description: "unseal: project the Azure Key Vault workload identity token"
-    - kind: added
-      description: "unseal: select the Azure Key Vault authentication method"
     - kind: fixed
-      description: "admission: allow restore foreground finalizer cleanup"
+      description: "ci: prepare 0.6.1 release qualification"
     - kind: fixed
-      description: "admission: allow scoped helper Pod annotation sync"
+      description: "ci: publish and verify qualification registry bundles"
     - kind: fixed
-      description: "admission: require delegation for read-replica cloud identities"
+      description: "ci: tag releases only after manifest changes"
     - kind: fixed
-      description: "admission: resolve policy type-check warnings"
-    - kind: fixed
-      description: "admission: support scoped PVC binding synchronization"
-    - kind: fixed
-      description: "backup: refresh persisted deadlines after schedule changes"
-    - kind: fixed
-      description: "certs: reject malformed CA key PEM without panicking"
-    - kind: fixed
-      description: "ci: accept fork E2E plans during matrix generation"
-    - kind: fixed
-      description: "ci: decouple edge chart versions from releases"
-    - kind: fixed
-      description: "ci: isolate Cilium Kind networking with VXLAN"
-    - kind: fixed
-      description: "ci: separate restore lanes and pin integration tooling"
-    - kind: fixed
-      description: "client: release shared state for deleted cluster lifetimes"
-    - kind: fixed
-      description: "cluster: resume interrupted peer removal safely"
-    - kind: fixed
-      description: "config: enforce OpenBao configuration version contracts"
-    - kind: fixed
-      description: "dev: make contributor runtime checks portable"
-    - kind: fixed
-      description: "docs: compare published site content by checksum"
-    - kind: fixed
-      description: "e2e: allow restore executors to reach Cilium API servers"
-    - kind: fixed
-      description: "ownership: bind resource mutations to observed identity"
-    - kind: fixed
-      description: "perf: follow restore recovery and measure availability in performance scenarios"
-    - kind: fixed
-      description: "provisioner: allow restore templates without unseal credential Secrets"
-    - kind: fixed
-      description: "provisioner: preserve tenant RBAC through namespace teardown"
-    - kind: fixed
-      description: "restore: expose KMS plugin settings in target templates"
-    - kind: fixed
-      description: "restore: separate disposable reader identity from backups"
-    - kind: security
-      description: "security: bind legacy image signatures to requested digests"
-    - kind: security
-      description: "security: correct Scorecard dependency and policy findings"
-    - kind: security
-      description: "security: enforce key strength and TLS transport policy"
-    - kind: security
-      description: "security: harden verification dependencies and CI controls"
-    - kind: security
-      description: "security: resolve Kubernetes registry credentials by scope"
+      description: "ci: validate root release manifest in qualification"
     - kind: security
-      description: "security: verify admission policies against release contracts"
-    - kind: security
-      description: "security: verify tenant onboarding binding identity"
-    - kind: fixed
-      description: "storage: block IPv6 cloud metadata endpoints"
-    - kind: fixed
-      description: "storage: retain custom CA trust in backup and restore executors"
-    - kind: fixed
-      description: "storage: use complete Azure Blob endpoint URLs"
-    - kind: fixed
-      description: "storage: use credential Secret regions for S3 signing"
-    - kind: fixed
-      description: "tls: validate external server certificate chains"
-    - kind: fixed
-      description: "upgrade: prove workload identity before blue-green cleanup"
-    - kind: fixed
-      description: "upgrade: retry against the current rendered image target"
+      description: "deps: patch go-jose RSA JWK denial of service"
     - kind: fixed
-      description: "upgrade: scope rolling executor jobs to durable attempts"
+      description: "dev: exclude local artifacts from Go source checks"
     - kind: fixed
-      description: "vcluster: unblock Pod annotation sync and complete safe teardown"
+      description: "helm: preserve admission policies through YAML post-rendering"
     - kind: fixed
-      description: "workload: complete terminal Pod deletion"
+      description: "raft: apply Autopilot settings on small clusters"
     - kind: fixed
-      description: "wrapper: wait for graceful child termination before killing"
-    - kind: changed
-      description: "metrics: scope restore state updates to target clusters"
+      description: "restore: accept stable OpenBao versions from 2.7"
   artifacthub.io/images: |
     - name: openbao-operator
-      image: ghcr.io/kubebao/openbao-operator:0.6.0
+      image: ghcr.io/kubebao/openbao-operator:0.6.1
     - name: openbao-init
-      image: ghcr.io/kubebao/openbao-init:0.6.0
+      image: ghcr.io/kubebao/openbao-init:0.6.1
     - name: openbao-backup
-      image: ghcr.io/kubebao/openbao-backup:0.6.0
+      image: ghcr.io/kubebao/openbao-backup:0.6.1
     - name: openbao-upgrade
-      image: ghcr.io/kubebao/openbao-upgrade:0.6.0
+      image: ghcr.io/kubebao/openbao-upgrade:0.6.1
   artifacthub.io/crds: |
     - kind: OpenBaoCluster
       version: v1alpha1