KubeVault v2026.8.7 (2026-08-07)

kubevault/apimachinery

v0.25.0

• 599a2bed chore(deps): go mod tidy && go mod vendor (#168)
• 1a0e4147 Add Sigilr as an OpenBao-derivative Vault distro (#167)
• 4efa732f Remove VaultRelay.spec.image; resolve it from the hub AppBinding’s spec.version (#166)
• a4f10f8d Add Namespace Slice Helpers (#165)
• 9506b557 Add tenant-namespace API for automatic OpenBao namespaces (#156)
• ba64406c Add spec.exposePrimary and the ClientTrafficPinned condition (#164)
• aecac0c3 Modernize golangci-lint config (#162)
• 0f322b76 Rename Vault Agent Leftovers (#161)
• db14309e Use vr as shortname for VaultRelay
• 19e335e6 Rename VaultAgent CRD to VaultRelay (agent->relay) (#158)
• c2df818e Name the spoke kubernetes-auth role k8s-- (#155)
• e584cf38 Add VaultAgent and OCM agent placement API to VaultServer (#137)
• b177c3ef Bump go.bytebuilders.dev/audit to v0.0.52 (#135)
• 50440b1b Update go.bytebuilders.dev/audit to v0.0.51 (#134)
• 3b2e0d05 Add CLAUDE.md pointing to AGENTS.md
• 258f03b3 Fix release tracker workflow
• d03a6c7c Add AGENTS.md (#133)
• 075c9c56 Add 1gtm-app[bot] to kodiak auto_approve_usernames (#132)
• 3eac0dd1 Cleanup cves (#131)
• a1a8b7b2 Harden CI workflows (#130)
• 7e04d17f Configure dependabot refresh schedule (#128)

kubevault/cli

v0.25.0

• a64b70d8 Prepare for release v0.25.0 (#231)
• f6bcff38 Clean up deps
• 5461dc81 Prepare for release v0.25.0-rc.2 (#230)
• 7866f7d3 Modernize golangci-lint config (#229)
• 0f49286d Drop kubevault.dev/apimachinery/client dependency (#228)
• 3832c2fc Add CLAUDE.md pointing to AGENTS.md
• 4839a579 Fix release tracker workflow
• 61d31fd8 Prepare for release v0.25.0-rc.1 (#227)
• ca45ac56 Add AGENTS.md (#226)
• 4ed7b9d5 Harden CI workflows (#225)
• b42d2b9b Prepare for release v0.25.0-rc.0 (#224)
• c0234062 Cleanup cves (#223)
• 00b5938d Harden CI workflows (#222)
• 289a185b Configure dependabot refresh schedule (#220)

kubevault/installer

v2026.8.7

• 31143fe9 Prepare for release v2026.8.7 (#467)
• ef9f89db Add OpenBao Version 2.6.1 (#466)
• 49c7e5fe Prepare for release v2026.7.24-rc.2 (#464)
• f3fb56eb Remove update command for kubevault-certified chart (#463)
• 9e4e586d Fetch kubevault-certified chart dependencies before regenerating it; add OpenShift chart-verify script (#462)
• 1564d541 Sync CRDs for tenant isolation (spec.isolateTenants, NamespaceSlice) (#461)
• 87362390 Sync vaultserver CRDs for spec.exposePrimary and fix the pods-patch comment (#460)
• f35219c6 Add make refresh target and require it before opening a PR (#459)
• b8a96caa Grant the operator pods patch for role labeling (#458)
• 761ddb47 Clean up cves
• 62c8c74b Build kubevault-certified dependencies in update-chart-dependencies.sh (#457)
• f2fff71b Add reproducible make targets for catalog and certified charts (#456)
• 33f8eca6 Modernize golangci-lint config (#455)
• 64741473 Add Additional Rules in Cluster Role (#454)
• 42ae5979 Rename VaultAgent to VaultRelay in charts/CRDs (agent->relay) (#452)
• 4e174433 Support OCM hub-driven VaultAgent placement in operator charts (#449)
• 3ed9e4bb catalog: mark pre-1.10 Vault versions as deprecated (#451)
• 39b17213 Add audit-token-requester ClusterRoleBinding to charts (#450)
• 7a88fdf7 Fix charts (#448)
• b35a72b6 feat(charts): Phase 7 webhook host + –register-crds + VaultServer conversion webhook (#444)
• 5d791450 Use ace-user-roles v2026.6.12 with audit cluster role (#446)
• ef9df4ab Add docker.io prefix to Docker Hub images (#447)
• 82acef9e Add CLAUDE.md pointing to AGENTS.md
• ad0ee4fa Prepare for release v2026.5.18-rc.1 (#443)
• 14ccba08 Fix release tracker workflow
• 4e8a272d Add AGENTS.md (#442)
• 80830cdf publish-oci.yml: replace GHCRX app token with LGTM_GITHUB_TOKEN (#441)
• a7636bb6 Remove bzr install from workflows (#440)
• 2bb52809 Prepare for release v2026.5.14-rc.0 (#437)
• 81043cc4 Pin docker/login-action to v4.1.0 (#439)
• 7420547c Harden CI workflows (#438)
• cbe0e016 Cleanup cves (#435)
• 4bf42d14 Harden CI workflows (#434)
• a1e1f7bf Update cve report (#431)
• 1471293b Update cve report (#430)
• b1076760 Update cve report (#429)
• 3a063b0d Update cve report (#428)
• bad352e3 Update cve report (#427)
• 258774cc Configure dependabot refresh schedule (#426)
• 3739ecf2 Update cve report (#425)
• e2ead60b Update cve report (#424)
• 7e7140a7 Update cve report (#423)
• e58673ae Update cve report (#422)
• 45567a96 Update cve report (#421)
• da65b37e Update cve report (#420)
• 9eee7121 Update cve report (#419)
• 001cb34c Update cve report (#418)
• 0e330ac2 Update cve report (#417)
• 4022b1f1 Update cve report (#416)
• 072f7834 Update cve report (#415)
• 41bc426a Update cve report (#414)
• 3e830d6a Update cve report (#413)
• 46f7442d Update cve report (#412)
• 8c32d070 Update cve report (#411)
• 26480eea Update cve report (#410)

kubevault/operator

v0.25.0

• fc6afdce Merge commit ‘f63c2452e679487c11e6addd77f07e973c0aca5a’ into release-0.25
• f63c2452 Prepare for release v0.25.0 (#228)
• d1338690 Refactor Vault namespace/relay code and fix relay-image & migration correctness bugs (#224)
• 4402f8d6 Support Sigilr as an OpenBao-derivative distribution (#227)
• 2fc4269c Resolve VaultRelay’s container image from the hub AppBinding’s spec.version (#225)
• 0e659db1 Ensure Namespace Slice CRD, Add ClusterID to Webhook (#223)
• 5b9c0ed9 Merge commit ‘2fcebcc9b329cba16769d030cd5e5bc666b35b75’ into release-0.25
• 2fcebcc9 Prepare for release v0.25.0-rc.2 (#222)
• 6a93d458 Automatic OpenBao namespaces for KubeDB Platform tenants (#213)
• 1706fa88 design: tenant isolation on the OCM hub-spoke model (#214)
• fe678460 Pin client traffic to the Vault primary (spec.exposePrimary) (#220)
• f76a2164 Modernize golangci-lint config (#218)
• 400d7789 Rename VaultAgent to VaultRelay; agentbackend -> relaybackend (agent->relay) (#217)
• e3abfcbf Remove nul file (#212)
• 11af4877 design: automatic OpenBao namespaces for KubeDB Platform tenants (#210)
• b937d1d6 Fix errcheck lint: check fmt.Fprintf return in vault_test (#211)
• 8d8afcde VaultAgent: hub-spoke deployment across OCM-managed clusters (#191)
• 8e259c10 Fix e2e workflows (#190)
• a09d5f2e feat: Migrate operator to kubebuilder/controller-runtime style (#175)
• 83b7774f Add CLAUDE.md pointing to AGENTS.md
• 3d90749d Fix release tracker workflow
• 9418ad4b Fix release tracker workflow
• 593dd1ee Prepare for release v0.25.0-rc.1 (#174)
• ecd00441 Add AGENTS.md (#173)
• eb6ba157 Pin git user to 1gtm in update-crds/update-docs workflows (#172)
• 29418235 Pin docker/login-action to v4.1.0 (#171)
• 545de7ef Use docker/login-action instead of docker login command (#170)
• 402f21bc Harden CI workflows (#169)
• 5a1522f2 Prepare for release v0.25.0-rc.0 (#168)
• ae69e2d1 Cleanup cves (#167)
• 7c4b7a9a Harden CI workflows (#166)
• eea0fa0c Configure dependabot refresh schedule (#164)

kubevault/unsealer

v0.25.0

• bcce8ad3 Cleanup deps
• 0f6a92ca Modernize golangci-lint config (#162)
• d2717085 add namespace policy (#161)
• a34e6891 Grant policy-controller the relay/* backend paths (hub-spoke placement) (#160)
• a7fe869a Add CLAUDE.md pointing to AGENTS.md
• 3b5bf9c4 Fix release tracker workflow
• aa6de2ae Add AGENTS.md (#158)
• a7096a5a Pin git user to 1gtm in update-crds/update-docs workflows (#157)
• c92ce049 Pin docker/login-action to v4.1.0 (#156)
• 97e4d369 Add 1gtm-app[bot] to kodiak auto_approve_usernames (#155)
• 8dda08bf Use docker/login-action instead of docker login command (#154)
• 50ce5684 Normalize Prepare git user, fetch-depth, drop permission-issues (#153)
• 87ceec47 Cleanup cves (#152)
• 5989ad61 Use GitHub App token for release tracker comments (#151)
• 4f672af9 Harden CI workflows (#150)
• e283b0fb Configure dependabot refresh schedule (#148)