[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
openbao	HelmChart	minor	0.29.6 → 0.30.6	0.30.7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

openbao/openbao-helm (openbao)

v0.30.6

Compare Source

• fix: ArtifactHub changes annotation

v0.30.5

Compare Source

• chore: bump OpenBao to v2.7.2

v0.30.4

Compare Source

• fix(grafana/dashboard): add Namespace variable (#​252)

v0.30.3

Compare Source

• fix(chart): ensure name uniqueness for clusterrolebinding resources (#​243)
• fix(deps): Update injector to v1.7.6

v0.30.2

Compare Source

• chore: bump OpenBao to v2.7.1

v0.30.1

Compare Source

• ocm: remove openbao-hsm-ubi-image reference

v0.30.0

Compare Source

• BREAKING: Standalone storage backend changed to PebbleDB, manual migration required
• chore: Bump OpenBao to v2.7.0
• feat: Sign Helm charts using GPG
• feat: Sign Helm OCI images using Cosign keyless
• feat(snapshot-agent): support resource-specific metadata

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #4756 | upstream | last-verified 2026-11-10: platform#4756 is still open with no delivery PR (re-read 2026-11-10). Head 5fae822 fails Validate Independent Manifest Regressions (contracts) in run 41628742630: the OpenBao chart changed, so the staged-rollout guard requires revalidation. Cold-start/recovery, negative unsealed-health, API/quorum and retained-storage proof remain unverified, so version and checksum changes alone cannot authorize this upgrade. Earlier records: 2026-11-02, 2026-10-20.

[devantler]

🤖 Generated by the Agentic Engineer

Current-head triage: cd9ff86ea166b372dceca4359bad036d733ba0f3 fails manifest validation because the staged OpenBao regression deliberately requires its validated chart and canary rollout (native failure). This is an active rollout safety gate, not an incidental runner failure.

Fresh readback still shows the existing three-member cluster with one updated canary and two unchanged healthy peers. The bootstrap readiness probe accepts sealed/uninitialized responses, so Ready alone cannot authorize another replacement or a new server-version rollout. #4391 records the initialization dependency and required cold-start/recovery negative proofs; #4394 was closed as unsafe.

Blocker: Revalidate the actual new chart/server rollout together with the bootstrap- and recovery-safe unsealed-health gate in #4391. Do not update the guard's version/checksum alone, rerun unchanged failing input, or enqueue this upgrade before that evidence exists.

[devantler]

🤖 Generated by the Agentic Engineer

The old 2.6.3 delivery prerequisite is now satisfied: separated OIDC-only readbacks today found all three servers on the current revision, reporting 2.6.3, initialized and unsealed, with one active member. #4391 records that patch-delivery result.

The upgrade hold remains. Its unfinished bootstrap/recovery-safe unsealed-health proof is now tracked explicitly in #4756 under #2653. This PR still proposes a different chart/server release, whose actual render, cold-start/recovery behavior and controlled replacement path have not been validated. Do not update the regression pin/checksum alone or enqueue this red upgrade. Today's readbacks did not provide fresh per-member health API/quorum or negative-health evidence.