Go modules · #2356 by repository stars

github.com/hashicorp/vault-secrets-operator

v1.6.0hashicorp/vault-secrets-operator ↗New releases in your daily digest, changelog included.

Last release 15 days ago
23 Sep 2026
Release timing varies
gaps range from 8 days to 2 months
Nearly every release is documented
notes for 32 of 32 stable releases
Nothing withdrawn
no release was ever pulled
4 years old
109 releases · first in 2023

Release timeline

109 releases since 2023

2023202420252026

20232026

One column per quarter.

Releases

v1.6.023 Sept 20263 sources agree
Remove HCP Vault Secrets (HVS) support. HVS reached end-of-life on July 1, 2026. The HCPAuth and HCPVaultSecretsApp CRDs, their controllers, credentia
1.6.0 (September 23rd, 2026)

BREAKING CHANGES:

Remove HCP Vault Secrets (HVS) support. HVS reached end-of-life on July 1, 2026. The HCPAuth and HCPVaultSecretsApp CRDs, their controllers, credentials provider, RBAC manifests, Helm chart assets, and the github.com/hashicorp/hcp-sdk-go dependency have all been permanently removed. Clusters with existing HCPVaultSecretsApp or HCPAuth resources must clean up those instances before upgrading to avoid resources becoming stuck in Terminating due to the finalizer hcpvaultsecretsapp.secrets.hashicorp.com/finalizer. (#1307)

Enhancements:

VDS: Support instant event-driven updates (spec.syncConfig.instantUpdates) for any Vault secret engine that supports Vault events, covering both static roles (allowStaticCreds=true) and dynamic leases: (#1295)

VSS/VDS: Attach X-Vault-Index header on event-triggered reconciles to prevent stale reads on Performance Standbys (Requires Vault 1.20+): (#1285)

Helm: add controller.rbac.enabled flag to allow skipping RBAC resource creation (ClusterRole, ClusterRoleBinding, Role, RoleBinding). When set to false, the chart still creates ServiceAccounts, the controller Deployment, and hook Jobs — equivalent RBAC must be pre-provisioned out-of-band by a cluster administrator using the same Helm release name (or fullnameOverride) before running helm install/helm upgrade. (#1291)

Fix:

VaultPKISecret: correct Vault API path when issuerRef is set; path was rendered as pki/issuer/<name>/<role> instead of the correct pki/issuer/<name>/issue/<role>, causing Vault to return 404 for all cert issuance requests when issuerRef was specified (#1336)

VDS: fix rolloutRestartTargets being triggered on every reconcile for static roles consumed with allowStaticCreds: false; static-creds detection now uses Vault response metadata instead of spec.allowStaticCreds, so restarts only occur when the HMAC-compared credentials actually change (#1299)

Helm: omit spec.namespace from the default VaultAuth and transit VaultAuth resources when no Vault namespace is configured, instead of rendering an empty namespace: key. Server-side apply deserialized the empty key as null, which failed CRD schema validation and blocked installs where Vault namespaces are not in use (#1319)

VaultStaticSecret: return the non-nil error alongside RequeueAfter on Vault failures so resources are re-queued with backoff instead of being silently dropped after a transient Vault HA event (#1323)

Build:

Build with Go 1.27.1

Test with Vault 2.1.1, 1.21.11, 1.20.16, 1.19.22

Test with Kind v0.33.0

Test with K8s 1.37.0, 1.36.4, 1.35.8, 1.34.11, 1.33.12

Dependency Updates:

Bump go.mod dependencies:

Updates github.com/hashicorp/vault/api from 1.20.1-0.20250822193320-eff87a134a94 to 1.23.0

Updates github.com/hashicorp/vault/sdk from 0.18.1-0.20250822193320-eff87a134a94 to 0.25.1

Updates github.com/argoproj/argo-rollouts from 1.8.3 to 1.10.0

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Updates google.golang.org/api from 0.298.0 to 0.299.0

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260819154853-08b0e4226688 to 0.0.0-20260921155816-b14227669459

Updates k8s.io/utils from 0.0.0-20260626114624-be93311217bd to 0.0.0-20260707023825-cf1189d6abe3

Updates golang.org/x/net from 0.58.0 to 0.59.0

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Updates golang.org/x/time from 0.15.0 to 0.16.0

Updates cloud.google.com/go/auth from 0.23.2 to 0.23.3

Updates github.com/googleapis/enterprise-certificate-proxy from 0.3.20 to 0.3.22

Updates github.com/googleapis/gax-go/v2 from 2.24.0 to 2.24.1

Updates github.com/google/s2a-go from 0.1.9 to 0.1.10

Updates github.com/aws/aws-sdk-go from 1.44.122 to 1.55.8

Updates github.com/felixge/httpsnoop from 1.0.4 to 1.1.0

Updates github.com/fatih/color from 1.18.0 to 1.19.0

Updates github.com/spf13/cast from 1.7.0 to 1.7.1

Updates cloud.google.com/go/compute/metadata from 0.9.0 to 0.9.1

Updates github.com/coder/websocket from 1.8.14 to 1.8.15

Updates github.com/onsi/gomega from 1.42.1 to 1.43.1

Updates github.com/prometheus/client_model from 0.6.2 to 0.6.3

Updates github.com/stretchr/testify from 1.12.0 to 1.12.1

Updates golang.org/x/crypto from 0.55.0 to 0.57.0

Updates google.golang.org/api from 0.293.0 to 0.298.0

Updates k8s.io/apiextensions-apiserver from 0.36.3 to 0.37.0

Updates k8s.io/apimachinery from 0.36.3 to 0.37.0

Updates k8s.io/client-go from 0.36.3 to 0.37.0

Updates k8s.io/utils from 0.0.0-20260210185600-b8788abfbbc2 to 0.0.0-20260626114624-be93311217bd

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.1

v1.5.2-0.20260915134319-451a61fc0eda15 Sept 2026pre-release

Nothing published for this version

v1.5.2-0.20260904092350-090e9e6932a04 Sept 2026pre-release

Nothing published for this version

v1.5.111 Aug 20263 sources agree

Add ppc64le (IBM Power) architecture support: build and publish UBI-based images to icr.io/cpopen/ibm-vault and quay.io/redhat-isv-containers

1.5.1 (August 11th, 2026)

Build:

Add ppc64le (IBM Power) architecture support: build and publish UBI-based images to icr.io/cpopen/ibm-vault and quay.io/redhat-isv-containers (#1325)
Update chart-upgrade-tests matrix to cover the last 6 chart versions (1.1.0–1.5.0); drop stale entries 0.2.0–1.0.1
Test with Vault 2.0.4, 1.21.9, 1.20.14, 1.19.20

Dependency Updates:

Bump the gomod-backward-compatible group across 1 directory with 7 updates (#1324)
- Updates github.com/go-openapi/runtime from 0.32.6 to 0.33.0
- Updates github.com/prometheus/client_golang from 1.24.0 to 1.24.1
- Updates google.golang.org/api from 0.290.0 to 0.291.0
- Updates k8s.io/api from 0.36.2 to 0.36.3
- Updates k8s.io/apiextensions-apiserver from 0.36.2 to 0.36.3
- Updates k8s.io/apimachinery from 0.36.2 to 0.36.3
- Updates k8s.io/client-go from 0.36.2 to 0.36.3
Bump google.golang.org/api from 0.291.0 to 0.292.0 in the gomod-backward-compatible group (#1330)
Bump actions/setup-node from v6.4.0 to v7.0.0 in .github/workflows/build.yaml

Open source →

v1.5.023 Jul 20263 sources agree

VaultAuth / VaultAuthGlobal AppRole spec.appRole.secretIDPath has been removed. Use spec.appRole.secretRef instead, which references a Kubernetes Secr

1.5.0 (July 23rd, 2026)

BREAKING CHANGES:

VaultAuth/VaultAuthGlobal AppRole spec.appRole.secretIDPath has been removed. Use
spec.appRole.secretRef instead, which references a Kubernetes Secret containing the AppRole
Secret ID.

Dependency Updates:

Bump the gomod-backward-compatible group across 1 directory with 2 updates: (#1302)
Bump the gomod-backward-compatible group across 1 directory with 5 updates (#1308)
Bump github.com/go-openapi/runtime from 0.32.5 to 0.32.6 in the gomod-backward-compatible group (#1310)
Bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#1311)
Bump google.golang.org/api from 0.289.0 to 0.290.0 in the gomod-backward-compatible group across 1 directory (#1313)

Build:

Build with Go 1.26.5
Test with Vault 2.0.3, 1.21.8, 1.20.13, 1.19.19
Test with Kind v0.32.0
Test with K8s 1.36.1, 1.35.5, 1.34.8, 1.33.12, 1.32.11

Open source →

v1.4.2-0.20260716090816-e3d4dbee417216 Jul 2026pre-release

Nothing published for this version

v1.4.130 Jun 20263 sources agree

Test with Vault 2.0.3, 1.21.8, 1.20.13, 1.19.19

1.4.1 (June 30th, 2026)

Build:

Building with Go 1.26.4
Test with Vault 2.0.3, 1.21.8, 1.20.13, 1.19.19
Test with Kind v0.32.0
Test with K8s 1.36.1, 1.35.5, 1.34.8, 1.33.12, 1.32.11

Dependency Updates:

Bump the gomod-backward-compatible group with 4 updates: (#1294)
Bump the gomod-backward-compatible group with 9 updates: (#1290)
Bump github.com/gruntwork-io/terratest from 0.56.0 to 1.0.0 in the gomod-breaking group across 1 directory: (#1289)
Bump ubi10/ubi-minimal from 10.1 to 10.2: (#1275)
Bump ubi10/ubi-micro from 10.1 to 10.2: (#1274)
Bump the gomod-backward-compatible group across 1 directory with 10 updates: (#1273)

Open source →

v1.4.1-0.20260622081406-e5341b84fa6322 Jun 2026pre-release

Nothing published for this version

v1.4.05 May 20263 sources agree

Detect TTL reset for uneven rotation schedules with ttl rollover bug:

1.4.0 (May 5th, 2026)

Fix:

Detect TTL reset for uneven rotation schedules with ttl rollover bug: (#1259)
Update kube-rbac-proxy version for openshift: (#1254)
VSS: Add vault client callback handler: (#867)
fix: Update VDS static credentials metadata handling: (#1255)

Dependency Updates:

Bump the gomod-backward-compatible group across 1 directory with 12 updates: (#1262)
Bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0: (#1257)
Bump github.com/jackc/pgx/v5 from 5.7.1 to 5.9.2: (#1251)
Bump github.com/moby/spdystream from 0.5.0 to 0.5.1: (#1248)
Bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.6.7 to 1.7.8: (#1246)
Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.69.0 to 1.97.3: (#1245)
Bump github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.44.0 to 1.65.0: (#1244)
Bump github.com/aws/aws-sdk-go-v2/service/lambda from 1.69.0 to 1.88.5: (#1243)
Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4: (#1242)
Bump google.golang.org/grpc from 1.78.0 to 1.79.3: (#1238)
Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1: (#1223)

Open source →

v1.3.1-0.20260304173905-7984c80c20a04 Mar 2026pre-release

Nothing published for this version

v1.3.019 Feb 20263 sources agree

Add additional printer column fields:

1.3.0 (February 19th, 2026)

Enhancements:

Add Ready condition: (#1204)
Support CA cert from disk: (#1203)
Add additional printer column fields: (#1202)
Allow custom cache key func: (#1199)
Internal integration work: (#1186)
Get AppRole secret ID from file on disk: (#1153)

Fix:

VDS: ensure periodic static-role rotations are honored: (#1220)
fix: nullEventLogger panics on calls to Eventf(): (#1214)

Build:

Add 1.2.0 chart upgrade test: (#1205)

Dependency Updates:

Bump golang.org/x/crypto from 0.46.0 to 0.47.0 in the gomod-backward-compatible group: (#1201)
Bump google.golang.org/api from 0.264.0 to 0.265.0 in the gomod-backward-compatible group: (#1213)
Bump the gomod-backward-compatible group across 1 directory with 3 updates: (#1210)
Bump the gomod-backward-compatible group with 2 updates: (#1206)
Bump the gomod-backward-compatible group across 1 directory with 6 updates: (#1216)

Open source →

v1.2.1-0.20260209175449-b4ca74f9a0db9 Feb 2026pre-release

Nothing published for this version

v1.2.1-0.20260209172305-408e2f1836059 Feb 2026pre-release

Nothing published for this version

v1.2.1-0.20260115143235-f96d2429aa3f15 Jan 2026pre-release

Nothing published for this version

v1.2.1-0.20260114220833-27afef2ffa9b14 Jan 2026pre-release

Nothing published for this version

v1.2.1-0.20260114202830-08861e7ae29614 Jan 2026pre-release

Nothing published for this version

v1.2.012 Jan 2026Security3 sources agree

Suppress CVE-2025-6020 on the container only:

1.2.0 (January 12th, 2026)

Fix:

Helm: properly set the PodSecurityContext: (#1183)
VDS: only trigger rollout restarts on static cred changes.: (#1191)
VDS: invalid secret HMAC validation on static creds: (#1194)
HMAC: only support non-nil data: (#1200)

Enhancements:

Helm: bump CSI driver version to 1.0.1: (#1184)

Build:

Suppress CVE-2025-6020 on the container only: (#1190)
CI: test against k8s 1.35 + update changelog: (#1197)

Dependency Updates:

Bump the gomod-backward-compatible group across 1 directory with 5 updates: (#1188)
Bump google.golang.org/api from 0.258.0 to 0.259.0 in the gomod-backward-compatible group: (#1192)
Bump github.com/onsi/gomega from 1.38.3 to 1.39.0 in the gomod-backward-compatible group: (#1196)

Open source →

v1.1.1-0.20260113200949-420bb3e8df6d13 Jan 2026pre-release

Nothing published for this version

v1.1.1-0.20260109130648-01360aadeb679 Jan 2026pre-release

Nothing published for this version

v1.1.1-0.20251216230915-0c640ae5e7c816 Dec 2025pre-release

Nothing published for this version

v1.1.012 Dec 20253 sources agree

Add support for linux/s390x and linux/arm64 (Red Hat):

1.1.0 (December 12th, 2025)

Enhancements:

Add support for linux/s390x and linux/arm64 (Red Hat): (#1152)

Fixes:

Topology spread constraints bugfix: (#1148)
Update docs branch version: (#1140)

Build:

ci: updating vault-helm to v0.31.0 and latest Vault versions: (#1125)

Dependency Updates:

Bump the gomod-backward-compatible group across 1 directory with 4 updates: (#1172)
Bump the gomod-backward-compatible group with 4 updates: (#1178)
Bump github.com/gruntwork-io/terratest from 0.53.0 to 0.54.0 in the gomod-backward-compatible group: (#1162)
Bump the gomod-backward-compatible group across 1 directory with 6 updates: (#1147)
Bump golang.org/x/crypto from 0.43.0 to 0.45.0: (#1154)
Bump the gomod-backward-compatible group with 7 updates: (#1157)
Bump google.golang.org/api from 0.250.0 to 0.251.0 in the gomod-backward-compatible group: (#1133)
Bump the gomod-backward-compatible group with 5 updates: (#1128)
Bump Go version to 1.25.4: (#1151)
Bump ubi10/ubi-micro from 10.0 to 10.1: (#1150)
Bump ubi10/ubi-minimal from 10.0 to 10.1: (#1149)

Open source →

v1.0.2-0.20260126200331-dcd147775a2a26 Jan 2026pre-release

Nothing published for this version

v1.0.2-0.20260117004124-6a830e3fd00917 Jan 2026pre-release

Nothing published for this version

v1.0.2-0.20260114231816-a95ab24cb94d14 Jan 2026pre-release

Nothing published for this version

v1.0.2-0.20260110010325-343be850ee8a10 Jan 2026pre-release

Nothing published for this version

v1.0.2-0.20260109203340-68e5518860ec9 Jan 2026pre-release

Nothing published for this version

v1.0.2-0.20251231201649-dac89c37d37f31 Dec 2025pre-release

Nothing published for this version

v1.0.2-0.20251231182401-373f50a6570f31 Dec 2025pre-release

Nothing published for this version

v1.0.2-0.20251217163808-bf182ff0fd1e17 Dec 2025pre-release

Nothing published for this version

v1.0.2-0.20251209224305-0bedca03dce89 Dec 2025pre-release

Nothing published for this version

v1.0.2-0.20251209203712-627c60e7221b9 Dec 2025pre-release

Nothing published for this version

v1.0.2-0.20251209201852-3e6bef860fad9 Dec 2025pre-release

Nothing published for this version

v1.0.2-0.20251126215002-74f870281f4226 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251125201025-09977fb1a1d625 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251121181555-acbf6015b42721 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251119153911-b48bed50b3e319 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251117210157-1e23cda5cd6f17 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251117163655-6046ef13ba6a17 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251111182339-2ac1de4c5a9211 Nov 2025pre-release

Nothing published for this version

v1.0.2-0.20251023221105-6e263a168f8a23 Oct 2025pre-release

Nothing published for this version

v1.0.2-0.20251009202120-f39d989193849 Oct 2025pre-release

Nothing published for this version

v1.0.126 Sept 20253 sources agree

VSS: rollout restarts were being executed erroneously GH-1126

1.0.1 (September 26th, 2025)

Fix:

VSS: rollout restarts were being executed erroneously GH-1126

Open source →

v1.0.1-0.20251022205730-cbf19c5abba722 Oct 2025pre-release

Nothing published for this version

v1.0.025 Sept 20253 sources agree

Add support for the VSO CSI Driver (Vault Enterprise only): GH-1098

1.0.0 (September 24th, 2025)

Features:

Add support for the VSO CSI Driver (Vault Enterprise only): GH-1098

Enhancements:

Helm: update values comment: GH-1046
Helm: Support setting priorityClassName, topologySpreadConstraints and podDisruptionBudget: GH-1050
API: Include conditions on supported types: GH-1058
API: Clarify VaultAuth allowedNamespaces docs: GH-1113

Fix:

No longer store non-renewable Vault clients: GH-1066

Build:

CI: Add scale tests: GH-916
CI: update k8s and vault versions: GH-1033
SEC-090: Automated trusted workflow pinning (2025-03-24): GH-1038
CI: Add v0.9.1 and v0.10.0 to chart upgrade tests: GH-1039
SEC-090: Automated trusted workflow pinning (2025-03-31): GH-1042
CI: disable HVS integration tests.: GH-1090
CI: Update k8s and vault versions: GH-1105
[Compliance] - PR Template Changes Required: GH-1086
CI: Give the VDS reconciliation check a bit more time.: GH-1114
CI: Standardize security-scanner config and update Go version: GH-1080
Add CSI containers to check-versions script: GH-1116

Dependency Updates:

Bump golang.org/x/net from 0.35.0 to 0.36.0: GH-1031
Bump the gomod-backward-compatible group across 1 directory with 10 updates: GH-1037
Bump the gomod-backward-compatible group across 1 directory with 4 updates: GH-1048
Bump golang.org/x/net from 0.37.0 to 0.38.0: GH-1052
Bump the gomod-backward-compatible group across 1 directory with 9 updates: GH-1065
Bump ubi9/ubi-micro from 9.5 to 9.6: GH-1067
Bump ubi9/ubi-minimal from 9.5 to 9.6: GH-1068
Bump the gomod-backward-compatible group across 1 directory with 11 updates: GH-1083
Bump the gomod-backward-compatible group across 1 directory with 8 updates: GH-1089
Bump the gomod-backward-compatible group across 1 directory with 8 updates: GH-1095
Bump github.com/ulikunitz/xz from 0.5.10 to 0.5.14: GH-1102
Bump go version to 1.24.7: GH-1108
Bump the gomod-backward-compatible group across 1 directory with 9 updates: GH-1110
Upgrade to ubi10: GH-1111
Bump the gomod-backward-compatible group with 7 updates: GH-1112
Bump cloud.google.com/go/compute/metadata from 0.8.0 to 0.8.4: GH-1117
Bump argorollouts to v1.8.3: GH-1119

Open source →

v0.10.1-0.20250917114014-acee3e8dbfaa17 Sept 2025pre-release

Nothing published for this version

v0.10.1-0.20250916182728-f758be0189aa16 Sept 2025pre-release

Nothing published for this version

v0.10.1-0.20250905171807-da62ac4337765 Sept 2025pre-release

Nothing published for this version

v0.10.1-0.20250904204402-c8b2074073994 Sept 2025pre-release

Nothing published for this version

v0.10.1-0.20250829205258-5d177e8cfc4c29 Aug 2025pre-release

Nothing published for this version

v0.10.1-0.20250822231140-f797604fe72522 Aug 2025pre-release

Nothing published for this version

v0.10.1-0.20250822215121-a2e3b0123c1922 Aug 2025pre-release

Nothing published for this version

v0.10.1-0.20250819174437-38ac6154530c19 Aug 2025pre-release

Nothing published for this version

v0.10.04 Mar 20253 sources agree

Add Kubernetes Client QPS and Burst Configuration: GH-1013

0.10.0 (March 4th, 2025)

Enhancements:

Add Kubernetes Client QPS and Burst Configuration: GH-1013

Fix:

Add new Client for caching VSO owned Secrets: GH-1010
VPS: support day duration notation for TTL: GH-990

Build:

Build with Go 1.23.6: GH-1024
SEC-090: Automated trusted workflow pinning (2024-12-23): GH-993
SEC-090: Automated trusted workflow pinning (2024-12-30): GH-995
SEC-090: Automated trusted workflow pinning (2025-01-07): GH-997
SEC-090: Automated trusted workflow pinning (2025-01-20): GH-1005
SEC-090: Automated trusted workflow pinning (2025-02-03): GH-1009
SEC-090: Automated trusted workflow pinning (2025-02-10): GH-1012
SEC-090: Automated trusted workflow pinning (2025-02-17): GH-1015

Dependency Updates:

Bump github.com/go-jose/go-jose/v4 from 4.0.1 to 4.0.5: GH-1020
Bump the gomod-backward-compatible group across 1 directory with 3 updates: GH-994
Bump the gomod-backward-compatible group across 1 directory with 8 updates: GH-1014
Bump the gomod-backward-compatible group across 1 directory with 9 updates: GH-988
Bump the gomod-backward-compatible group with 2 updates: GH-1007
Bump the gomod-backward-compatible group with 3 updates: GH-1001
Bump the gomod-backward-compatible group with 3 updates: GH-1018
Bump the gomod-backward-compatible group with 6 updates: GH-989
Bump the gomod-backward-compatible group with 7 updates: GH-1004
Bump golang.org/x/crypto from v0.34.0 to v0.35.0 GH-1024

Open source →

v0.9.111 Dec 20242 sources agree

Memory: Prevent OOM due to large K8s Secrets cache: GH-982 GH-984

Fix:

Memory: Prevent OOM due to large K8s Secrets cache: GH-982 GH-984

Improvements:

add events for HVS client failures: GH-960
Memory: Use the mutex pool provided by K8s keymutex: GH-975

Build:

SEC-090: Automated trusted workflow pinning (2024-10-28): GH-957
Bump K8s version: GH-968

Dependency Updates:

Bump the gomod-backward-compatible group with 2 updates: GH-950
Bump the gomod-backward-compatible group across 1 directory with 9 updates: GH-958
Bump ubi9/ubi-micro from 9.4-15 to 9.5: GH-970
Bump ubi9/ubi-minimal from 9.4-1227.1726694542 to 9.5: GH-971
Bump golang.org/x/crypto from 0.28.0 to 0.31.0: GH-987

Open source →

v0.9.1-0.20241113195554-6ab056c22acb13 Nov 2024pre-release

Nothing published for this version

v0.9.1-0.20241017063501-c5fa7cf740f917 Oct 2024pre-release

Nothing published for this version

v0.9.08 Oct 20242 sources agree

Add support for syncing HVS rotating secrets: GH-893 GH-889

Features:

Add support for syncing HVS rotating secrets: GH-893 GH-889
Add support for syncing HVS dynamic secrets: GH-917 GH-939 GH-934 GH-941

Fix:

VC: update spec.timeout to be a string: GH-906

Improvements:

VSS(instant-updates): more stable event watcher: GH-898
Bump kube-rbac-proxy to 0.18.1: GH-909

Build:

Upgrade controller-gen to 0.16.3: GH-944
SEC-090: Automated trusted workflow pinning (2024-08-13): GH-888
SEC-090: Automated trusted workflow pinning (2024-08-19): GH-897
SEC-090: Automated trusted workflow pinning (2024-09-30): GH-937
Use dependabot groups for Go deps: GH-924
Conform to IPS-002: GH-947

Dependency Updates:

Bump the gomod-backward-compatible group across 1 directory with 14 updates: GH-943
Bump golang.org/x/crypto from 0.27.0 to 0.28.0 in the gomod-backward-compatible group: GH-945
Bump ubi9/ubi-micro from 9.4-13 to 9.4-15: GH-904
Bump ubi9/ubi-minimal from 9.4-1227.1725849298 to 9.4-1227.1726694542: GH-930

Open source →

v0.8.2-0.20241008220039-08a6e5071ffa8 Oct 2024pre-release

Nothing published for this version

v0.8.129 Jul 20242 sources agree

Log build info on startup: GH-872

Improvements:

Log build info on startup: GH-872
API: Support setting the Vault request timeout on a VaultConnection: GH-862

Fix:

Fix: encryption client deadlocking the factory: GH-868
Helm(hooks): honor imagePullPolicy and imagePullSecrets: GH-873

Build:

SEC-090: Automated trusted workflow pinning (2024-07-22): GH-866
SEC-090: Automated trusted workflow pinning (2024-07-17): GH-859

Dependency Updates:

Bump github.com/onsi/gomega from 1.33.1 to 1.34.0: GH-874
Bump google.golang.org/api from 0.188.0 to 0.189.0: GH-875
Bump k8s.io/apiextensions-apiserver from 0.30.2 to 0.30.3: GH-864
Bump k8s.io/client-go from 0.30.2 to 0.30.3: GH-865
Bump ubi9/ubi-micro from 9.4-9 to 9.4-13: GH-870
Bump ubi9/ubi-minimal from 9.4-1134 to 9.4-1194: GH-869

Open source →

v0.8.022 Jul 20242 sources agree

Helm: CRD schema changes are now automatically applied at upgrade time.

Important

Helm: CRD schema changes are now automatically applied at upgrade time.

See updating-crds for more details.
This release contains CRD schema changes which remove the field validation on most VaultAuth spec fields. That means invalid VaultAuth configurations will no longer be handled at resource application time. Please review the VSO logs and K8s events when troubleshooting Vault authentication issues.

Features:

Helm: add support for auto upgrading CRDs: GH-789
VaultStaticSecret: support instant event-driven updates: GH-771
Add new VaultAuthGlobal type for shared VaultAuth configurations: GH-735 GH-800 GH-847 GH-855 GH-850
CachingClientFactory: support client taints to trigger Vault client token validation: GH-717 GH-769

Improvements:

VPS: add ca.crt from issuing CA for tls secret type: GH-848
Helm: support setting VaultAuthGlobalRef on VaultAuth: GH-851
Migrate to k8s.io/utils/ptr: GH-856
Core: update backoff option docs: GH-801

Fix:

VaultAuth: set valid status on VaultAuthGlobal deref error: GH-854
VDS: properly handle the clone cache key variant during client callback execution: GH-835
Core: delete resource status metrics upon object deletion: GH-815
VSS: use a constant backoff on some reconciliation errors: GH-811
VDS: work around Vault DB static creds TTL rollover bug: GH-730

Build:

CI: bump Vault versions: GH-797

Dependency Updates:

Bump cloud.google.com/go/compute/metadata from 0.4.0 to 0.5.0: GH-853
Bump github.com/gruntwork-io/terratest from 0.46.16 to 0.47.0: GH-852
Bump github.com/hashicorp/go-getter from 1.7.4 to 1.7.5: GH-834
Bump github.com/hashicorp/go-retryablehttp from 0.7.1 to 0.7.7: GH-833
Bump github.com/hashicorp/go-version from 1.6.0 to 1.7.0: GH-810
Bump golang.org/x/crypto from 0.24.0 to 0.25.0: GH-843
Bump google.golang.org/api from 0.186.0 to 0.188.0: GH-846
Bump google.golang.org/grpc from 1.64.0 to 1.64.1: GH-845
Bump k8s.io/api from 0.30.1 to 0.30.2: GH-822
Bump k8s.io/apiextensions-apiserver from 0.30.1 to 0.30.2: GH-828
Bump k8s.io/client-go from 0.30.1 to 0.30.2: GH-830
Bump sigs.k8s.io/controller-runtime from 0.18.3 to 0.18.4: GH-808
Bump ubi9/ubi-micro from 9.4-6.1716471860 to 9.4-9: GH-819
Bump ubi9/ubi-minimal from 9.4-949.1717074713 to 9.4-1134: GH-820

Open source →

Your coding agent can read these notes before it upgrades. Set up the MCP server →

github.com/hashicorp/vault-secrets-operator

Release timeline

Releases

1.6.0 (September 23rd, 2026)

1.5.1 (August 11th, 2026)

1.5.0 (July 23rd, 2026)

1.4.1 (June 30th, 2026)

1.4.0 (May 5th, 2026)

1.3.0 (February 19th, 2026)

1.2.0 (January 12th, 2026)

1.1.0 (December 12th, 2025)

1.0.1 (September 26th, 2025)

1.0.0 (September 24th, 2025)

0.10.0 (March 4th, 2025)