OpenBao

CHANGES

• packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504]

IMPROVEMENTS

• core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555]
• core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506]

BUG FIXES

• core/expiration: Ensure leases are not inadvertently cached on standby nodes. [GH-3555]
• core/policies: Allow removal of expiration from policies on POST/PUT to sys/policies/acl/<name> by eliding the parameter; use PATCH to update policies without modifying unnecessary parameters. [GH-3506]
• core/policies: Fix limit=0 and negative limits bypassing the pagination_limit ACL option. [GH-3518]
• core/policies: Fix persistence of new allow_wildcards_in_identity_templates, allow_slashes_in_identity_templates parameters in storage. [GH-3506]
• auth/approle: Ensure initial salt is created without transaction to avoid deadlocks. [GH-3556]
• auth/jwt: Fix patch operation of CEL roles losing existing data (bound_audiences not_before_leeway, clock_skew_leeway and expiration_leeway). [GH-3551]
• auth/token: Ensure salt cache is invalidated properly on standby nodes. [GH-3555]
• sdk/plugin: Ensure all log messages are visible under plugin.ServeMultiplex(...) by default to align with plugin.Serve(...). [GH-3536]
• sdk: Better support non-usr-merged distributions in containerized testing. [GH-3554]
• packaging/container: Ensure that labels on UBI-based images comply with Red Hat's certification requirements. [GH-3504]

What's Changed

• Set user=root when invoking OpenBao for Alpine (#3499 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3501
• Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo) backported by @satoqz in https://github.com/openbao/openbao/pull/3524
• Restore container image labels & fix UBI-specific ones (#3504 by @pree) backported by @satoqz in https://github.com/openbao/openbao/pull/3525
• Fix policy persistence issue, introduce PATCH support for policies (#3506 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3538
• Allow all log messages in multiplexed plugins (#3536 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3537
• Fix limit=0 and negative limits bypassing pagination_limit ACL cap (#3518 by @RealFakeAccount) backported by @phil9909 in https://github.com/openbao/openbao/pull/3548
• Fix profile source headings, response field (#3550 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3553
• auth/jwt: fix patch operation of CEL roles lost data (#3551 by @phil9909) backported by @phil9909 in https://github.com/openbao/openbao/pull/3552
• Fix lease renewal cache invalidation (#3555 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3566
• Ensure AppRole salt is created without transaction (#3556 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3565
• Copy binary to additional path in test container (#3554 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3568
• Bump dependencies for v2.6.1 by @satoqz in https://github.com/openbao/openbao/pull/3570
• Add changelog for v2.6.1 by @satoqz in https://github.com/openbao/openbao/pull/3571

Full Changelog: https://github.com/openbao/openbao/compare/v2.6.0...v2.6.1