github.com/hashicorp/vault-k8s

1.7.4 (April 30, 2026)

Changes:

• Building with Go 1.26.2
• Default Vault version updated to 2.0.0
• Dependency updates:
  • container image alpine 3.23.3 => 3.23.4
  • container image ubi8/ubi-minimal 8.10-1772599255 => 8.10-1777392407
  • github.com/hashicorp/vault/sdk v0.23.0 => v0.25.1
  • sigs.k8s.io/controller-runtime v0.23.1 => v0.23.3

1.7.3 (March 5, 2026)

Changes:

• Tested with Kubernetes versions 1.35-1.31
• Test with Kind v0.31.0
• Building with Go 1.25.7
• Default Vault version updated to 1.21.4
• Dependency updates:
  • container image alpine 3.23.2 => 3.23.3
  • container image ubi8/ubi-minimal 8.10-1765178706 => 8.10-1772599255
  • github.com/hashicorp/vault/sdk v0.20.0 => v0.23.0
  • k8s.io/api v0.34.3 => v0.35.2
  • k8s.io/apimachinery v0.34.3 => v0.35.2
  • k8s.io/client-go v0.34.3 => v0.35.2
  • k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 => v0.0.0-20251002143259-bc988d571ff4
  • sigs.k8s.io/controller-runtime v0.22.4 => v0.23.1

1.7.2 (December 18, 2025)

Changes:

• Building with Go 1.25.5
• Dependency updates:
  • container image alpine 3.22.2 => 3.23.2
  • container image ubi8/ubi-minimal 8.10-1764046129 => 8.10-1765178706
  • k8s.io/api v0.34.2 => v0.34.3
  • k8s.io/apimachinery v0.34.2 => v0.34.3
  • k8s.io/client-go v0.34.2 => v0.34.3

1.7.1 (November 20, 2025)

Changes:

• Building with Go 1.25.4
• Default Vault version updated to 1.21.1
• Dependency updates:
  • Docker image ubi8/ubi-minimal 8.10-1295.1749680713 => 8.10-1763613452
  • github.com/hashicorp/vault/sdk v0.18.0 => v0.20.0
  • github.com/operator-framework/operator-lib v0.18.0 => v0.19.0
  • github.com/prometheus/client_golang v1.22.0 => v1.23.2
  • github.com/stretchr/testify v1.10.0 => v1.11.1
  • k8s.io/api v0.33.2 => v0.34.2
  • k8s.io/apimachinery v0.33.2 => v0.34.2
  • k8s.io/client-go v0.33.2 => v0.34.2
  • k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 => v0.0.0-20250604170112-4c0f3b243397
  • sigs.k8s.io/controller-runtime v0.21.0 => v0.22.4

Improvements:

• Add arm64 to the UBI container builds GH-799

1.7.0 (June 24, 2025)

Changes:

• Building with Go 1.24.4
• Default Vault version updated to 1.19.5
• Testing with K8s versions 1.29 - 1.33
• Dependency updates:
  • Docker image alpine 3.21.3 => 3.22.0
  • Docker image ubi8/ubi-minimal 8.10-1179.1739286367 => 8.10-1295.1749680713
  • github.com/go-logr/logr v1.4.2 => v1.4.3
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9 => v0.2.0
  • github.com/hashicorp/vault/sdk v0.15.0 => v0.18.0
  • github.com/operator-framework/operator-lib v0.17.0 => v0.18.0
  • github.com/prometheus/client_golang v1.21.0 => v1.22.0
  • k8s.io/api v0.32.2 => v0.33.2
  • k8s.io/apimachinery v0.32.2 => v0.33.2
  • k8s.io/client-go v0.32.2 => v0.33.2
  • sigs.k8s.io/controller-runtime v0.20.2 => v0.21.0

Features:

• Add support for setting template_config.lease_renewal_threshold in Agent config GH-761

1.6.2 (February 26, 2025)

Changes:

• Building with Go 1.23.6
• Default Vault version updated to 1.18.5
• Testing with K8s versions 1.28 - 1.32
• Dependency updates:
  • Docker image alpine 3.21.0 => 3.21.3
  • Docker image ubi8/ubi-minimal 8.10-1130 => 8.10-1179.1739286367
  • github.com/evanphx/json-patch v5.9.0+incompatible => v5.9.11+incompatible
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 => v0.1.9
  • github.com/hashicorp/vault/sdk v0.14.0 => v0.15.0
  • github.com/operator-framework/operator-lib v0.15.0 => v0.17.0
  • golang.org/x/crypto v0.31.0 => v0.35.0
  • golang.org/x/net v0.32.0 => v0.35.0
  • golang.org/x/oauth2 v0.21.0 => v0.27.0
  • golang.org/x/sys v0.28.0 => v0.30.0
  • golang.org/x/term v0.27.0 => v0.29.0
  • golang.org/x/text v0.21.0 => v0.22.0
  • k8s.io/api v0.31.3 => v0.32.2
  • k8s.io/apimachinery v0.31.3 => v0.32.2
  • k8s.io/client-go v0.31.3 => v0.32.2
  • k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 => v0.0.0-20241104100929-3ea5e8cea738
  • sigs.k8s.io/controller-runtime v0.19.2 => v0.20.2

Bugs:

• Update webhook CA bundle verification log message GH-739

1.6.1 (December 16, 2024)

Changes:

• Dependency updates:
  • Docker image alpine 3.20.3 => 3.21.0
  • golang.org/x/crypto v0.30.0 => v0.31.0

Bugs:

• Fix metrics sidecar injection false positives GH-716

1.6.0 (December 5, 2024)

Changes:

• Building with Go 1.22.10
• Default Vault version updated to 1.18.2
• Dependency updates:
  • Docker image ubi8/ubi-minimal 8.10-1086 => 8.10-1130
  • github.com/stretchr/testify v1.9.0 => v1.10.0
  • golang.org/x/crypto v0.28.0 => v0.30.0
  • golang.org/x/net v0.30.0 => v0.32.0
  • golang.org/x/sys v0.26.0 => v0.28.0
  • golang.org/x/term v0.25.0 => v0.27.0
  • golang.org/x/text v0.19.0 => v0.21.0
  • k8s.io/api v0.31.2 => v0.31.3
  • k8s.io/apimachinery v0.31.2 => v0.31.3
  • k8s.io/client-go v0.31.2 => v0.31.3
  • sigs.k8s.io/controller-runtime v0.19.1 => v0.19.2

Features:

• Agent injection telemetry GH-703 GH-709

Improvements:

• Support AGENT_INJECT_TLS_CA_CERT_FILE env option when using manual TLS GH-679

Changes:

• Building with Go 1.22.8
• Default Vault version updated to 1.18.1
• Testing with Vault 1.16 - 1.18
• Testing with K8s versions 1.27 - 1.31
• Dependency updates:
  • Docker image alpine 3.20.1 => 3.20.3
  • Docker image ubi8/ubi-minimal 8.10-1018 => 8.10-1086
  • github.com/hashicorp/vault/sdk v0.13.0 => v0.14.0
  • github.com/operator-framework/operator-lib v0.14.0 => v0.15.0
  • github.com/prometheus/client_golang v1.19.1 => v1.20.5
  • golang.org/x/crypto v0.26.0 => v0.28.0
  • golang.org/x/net v0.28.0 => v0.30.0
  • golang.org/x/sys v0.24.0 => v0.26.0
  • golang.org/x/term v0.23.0 => v0.25.0
  • golang.org/x/text v0.17.0 => v0.19.0
  • k8s.io/api v0.30.2 => v0.31.2
  • k8s.io/apimachinery v0.30.2 => v0.31.2
  • k8s.io/client-go v0.30.2 => v0.31.2
  • k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0 => v0.0.0-20240711033017-18e509b52bc8
  • sigs.k8s.io/controller-runtime v0.18.4 => v0.19.1

Features:

• Add annotations for customizing template delimiters GH-664

Bugs:

• Disable handling update on pods GH-619

Changes:

• Building with Go 1.22.5
• Default Vault version updated to 1.17.1
• Testing with Vault 1.15 - 1.17
• Dependency updates:
  • Docker image alpine 3.19.1 => 3.20.1
  • Docker image ubi8/ubi-minimal 8.9-1161 => 8.10-1018
  • github.com/go-logr/logr v1.4.1 => v1.4.2
  • github.com/hashicorp/vault/sdk v0.11.1 => v0.13.0
  • github.com/operator-framework/operator-lib v0.12.0 => v0.14.0
  • github.com/prometheus/client_golang v1.19.0 => v1.19.1
  • golang.org/x/crypto v0.22.0 => v0.24.0
  • golang.org/x/net v0.24.0 => v0.26.0
  • golang.org/x/sys v0.19.0 => v0.21.0
  • golang.org/x/term v0.19.0 => v0.21.0
  • golang.org/x/text v0.14.0 => v0.16.0
  • k8s.io/api v0.29.3 => v0.30.2
  • k8s.io/apimachinery v0.29.3 => v0.30.2
  • k8s.io/client-go v0.29.3 => v0.30.2
  • k8s.io/utils v0.0.0-20230726121419-3b25d923346b => v0.0.0-20240502163921-fe8a2dddb1d0
  • sigs.k8s.io/controller-runtime v0.17.2 => v0.18.4

Changes:

• Building with Go 1.22.2
• Default Vault version updated to 1.16.1
• Dependency updates:
  • Docker UBI image ubi8/ubi-minimal 8.9-1137 => 8.9-1161
  • github.com/cenkalti/backoff/v4 v4.2.1 => v4.3.0
  • github.com/go-logr/logr v1.3.0 => v1.4.1
  • github.com/hashicorp/go-hclog v1.6.2 => v1.6.3
  • github.com/hashicorp/vault/sdk v0.11.0 => v0.11.1
  • golang.org/x/crypto v0.18.0 => v0.22.0
  • golang.org/x/net v0.20.0 => v0.24.0
  • golang.org/x/sys v0.16.0 => v0.19.0
  • golang.org/x/term v0.16.0 => v0.19.0
  • k8s.io/api v0.29.2 => v0.29.3
  • k8s.io/apimachinery v0.29.2 => v0.29.3
  • k8s.io/client-go v0.29.2 => v0.29.3
  • sigs.k8s.io/controller-runtime v0.16.3 => v0.17.2

Bugs:

• Enable logging from operator-lib's leader election (used during auto-tls certificate generation) GH-608

Features:

• Add support for max_connections_per_host within Agent injector GH-579
• Add support for error_on_missing_key within Agent injector GH-441

Changes:

• Default Vault version updated to 1.15.6
• Building with Go 1.21.7
• Testing with K8s versions 1.25-1.29
• Dependency updates:
  • Docker UBI image ubi8/ubi-minimal 8.8-1072.1697626218 => 8.9-1137
  • Docker alpine version 3.18.4 => 3.19.1
  • k8s.io/api v0.28.3 => v0.29.2
  • k8s.io/apimachinery v0.28.3 => v0.29.2
  • k8s.io/client-go v0.28.3 => v0.29.2
  • k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 => v0.0.0-20230726121419-3b25d923346b`
  • github.com/hashicorp/go-hclog v1.5.0 => v1.6.2
  • github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 => v0.1.3
  • github.com/hashicorp/vault/sdk v0.10.2 => v0.11.0
  • github.com/prometheus/client_golang v1.17.0 => v1.19.0
  • github.com/operator-framework/operator-lib v0.11.0 => v0.12.0
  • github.com/evanphx/json-patch v5.7.0 => v5.9.0
  • github.com/stretchr/testify v1.8.4 => v1.9.0

Changes:

• Default Vault version updated to 1.15.1
• Building with Go 1.21.3
• Testing with K8s versions 1.24-1.28
• Dependency updates:
  • Docker UBI image ubi8/ubi-minimal 8.8-1037 -> 8.8-1072.1697626218
  • Docker alpine version 3.18.3 -> 3.18.4
  • golang.org/x/crypto v0.11.0 => v0.14.0
  • golang.org/x/net v0.13.0 => v0.17.0
  • golang.org/x/sys v0.10.0 => v0.13.0
  • golang.org/x/term v0.10.0 => v0.13.0
  • golang.org/x/text v0.11.0 => v0.13.0
  • k8s.io/api v0.27.4 => v0.28.3
  • k8s.io/apimachinery v0.27.4 => v0.28.3
  • k8s.io/client-go v0.27.4 => v0.28.3
  • github.com/hashicorp/vault/sdk v0.9.2 => v0.10.2
  • github.com/prometheus/client_golang v1.16.0 => v1.17.0
  • github.com/evanphx/json-patch v5.6.0 => v5.7.0

Improvements:

• Injector can set CA certificate for injected pods via AGENT_INJECT_VAULT_CACERT_BYTES env var or -vault-cacert-bytes flag GH-507
• Remove refs to deprecated io/ioutil GH-516

Improvements:

• Add NAMESPACE, HOST_IP, and POD_IP environment variables to Agent container using downward API GH-486

Changes:

• Templated secrets no longer require the -secret annotation GH-505
• Only inject Pods that are Pending GH-501
• Default to Vault 1.14.1
• Building with Go 1.20.7
• Testing with K8s versions 1.23-1.27
• Dependency updates:
  • github.com/cenkalti/backoff/v4 v4.2.0 -> v4.2.1
  • github.com/hashicorp/vault/sdk v0.8.1 -> v0.9.2
  • github.com/stretchr/testify v1.8.2 -> v1.8.4
  • github.com/prometheus/client_golang v1.14.0 -> v1.16.0
  • k8s.io/apimachinery v0.26.3 -> v0.27.4
  • k8s.io/api v0.26.3 -> v0.27.4
  • k8s.io/client-go v0.26.3 -> v0.27.4
  • golang.org/x/net v0.7.0 -> v0.13.0
  • golang.org/x/sys v0.5.0 -> v0.10.0
  • golang.org/x/term v0.5.0 -> v0.10.0
  • golang.org/x/text v0.7.0 -> v0.11.0
  • Docker alpine version 3.17.3 -> 3.18.3
  • Docker UBI image ubi8/ubi-minimal 8.7-1107 -> 8.8-1037

Bugs:

• Prevent auth-config-token-path from being overridden when another serviceaccount volume is present GH-457

Changes:

• Default to Vault 1.13.1
• Building with Go 1.20.3
• Dependency updates:
  • github.com/cenkalti/backoff/v4 v4.1.3 -> v4.2.0
  • github.com/hashicorp/go-hclog v1.3.1 -> v1.5.0
  • github.com/hashicorp/vault/sdk v0.6.1 -> v0.8.1
  • golang.org/x/net v0.4.0 -> v0.7.0
  • golang.org/x/sys v0.3.0 -> v0.5.0
  • golang.org/x/term v0.3.0 -> v0.5.0
  • golang.org/x/text v0.5.0 -> v0.7.0
  • k8s.io/api v0.25.4 -> v0.26.3
  • k8s.io/apimachinery v0.25.4 -> v0.26.3
  • k8s.io/client-go v0.25.4 -> v0.26.3
  • k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed -> v0.0.0-20230406110748-d93618cff8a2
  • Docker UBI image ubi8/ubi-minimal 8.7 -> 8.7-1107
  • Used fixed Docker alpine version: 3.17.3

Bugs:

• Don't override shareProcessNamespace if an annotation is not present GH-445

Changes:

• Building with Go 1.19.5
• Update golang.org/x/net to v0.4.0 GH-409
• Default to Vault v1.12.3

Features:

• Add support for enabling sharedProcessNamespace on the Pod spec GH-408
• Add agent-telemetry annotation GH-413

Improvements:

• Set Kubernetes user-agent to include vault-k8s version GH-411

Bugs:

• Preserve metadata when updating the cert secret GH-401

Changes:

• Building with go 1.19.3
• Default to Vault v1.12.1

Features:

• Allow modifying agent and agent-init containers with json-patch GH-399
• Support for setting exit_on_err in the agent auto-auth method config GH-400.

Improvements:

• Dependency updates:
  • github.com/cenkalti/backoff/v4 v4.1.1 => v4.1.3
  • github.com/hashicorp/go-hclog v1.0.0 => v1.3.1
  • github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 => v0.1.2
  • github.com/hashicorp/vault/sdk v0.2.1 => v0.6.1
  • github.com/mitchellh/cli v1.1.4 => v1.1.5
  • github.com/operator-framework/operator-lib v0.8.0 => v0.11.0
  • github.com/prometheus/client_golang v1.11.1 => v1.12.1
  • github.com/stretchr/testify v1.8.0 => v1.8.1
  • k8s.io/api v0.22.2 => v0.25.4
  • k8s.io/apimachinery v0.22.2 => v0.25.4
  • k8s.io/client-go v0.22.2 => v0.25.4

Changes:

• Default to Vault v1.12.0

Bugs:

• Default ephemeral storage resources to unset for injected containers GH-386

Improvements:

• Upgrade dependency golang.org/x/net from v0.0.0-20220708220712-1185a9018129 to v0.0.0-20221004154528-8021a29435af
• Upgrade dependency golang.org/x/sys from v0.0.0-20220520151302-bc2c85ada10a to v0.0.0-20220728004956-3c1f35247d10
• Upgrade dependency golang.org/x/text from v0.3.7 to v0.3.8

Changes:

• Upgrade Docker base image to alpine:3.16.2 GH-382
• Default to Vault v1.11.3

Features:

• Support for setting disable_keep_alives in the agent config GH-376
• Added flags, envs and annotations to control ephemeral storage resources for injected containers GH-360

Features:

• Support for setting disable_idle_connections in the agent config GH-366

Improvements:

• Added support to configure default vault namespace on the agent config GH-345

Bugs:

• Properly return admission errors GH-363

Improvements:

• ConfigMap with missing vault section should default to env vars GH-353
• Wait for certificate before starting HTTP listener GH-354
• Update example injector mutating webhook config to exclude agent pod GH-351

Bugs:

• Certificate watcher timer deadlock fix GH-350

Features:

• Add agent-enable-quit annotation GH-330
• Add go-max-procs annotation GH-333
• Add min and max auth backoff annotations and environment variables GH-341

Improvements:

• Add a name to the service port GH-262

Changes:

• Only update webhook CA bundles when needed GH-336

Features:

• Add agent-inject-containers annotation GH-313

Changes:

• Build with go 1.17.8
• Default to Vault v1.9.4