v2.2.0 Release !

[JanMa]

Tip

This is the first release with Web UI support!

New Features:

• ACME TLS Listener Certificate Provisioning: Automatically fetch TLS certificates for OpenBao Server's TCP listeners via an Automatic Certificate Management Environment (ACME - RFC 8555) capable certificate authority (CA). This allows OpenBao to be self-hosted, using a CA contained within the instance to sign the instance's own certificates. [GH-857]
• PKCS#11 Auto-Unseal: Add support for automatic unsealing of OpenBao using a PKCS#11-enabled Hardware Security Module (HSM) or Key Management System (KMS). [GH-889]
• Scanning: introduce the ability to recursively list (scan) within plugins, adding a separate scan ACL capability, operation type, HTTP verb (SCAN with GET fallback via ?scan=true), API, and CLI support. This also adds support to the KVv1 and KVv2 engines. [GH-763]
• Transit: Add support for key derivation mechansims (derives a new key from a base key).
  • This path uses the named base key and derivation algorithm specific parameters to derive a new named key.
  • Currently, only the ECDH key agreement algorithm is supported: the base key is one's own ECC private key and the "peer_public_key" is the pem-encoded other party's ECC public key.The computed shared secret is the resulting derived key. [GH-811]
• UI: Reintroduction of the WebUI. [GH-940]
• raft: Added support for nodes to join the Raft cluster as non-voters. [GH-741]

What's Changed over Beta

• 8c6ec0b: Add API and CLI commands to promote/demote nodes in the Raft cluster (Add API and CLI commands to promote/demote nodes in the Raft cluster #996) (Backport: Add API and CLI commands to promote/demote nodes in the Raft cluster (#996) #1072) (@JanMa)
• cf7800c: Backport: Bump actions/cache to v4, use pinning (Bump actions/cache to v4, use pinning #1064) (Backport: Bump actions/cache to v4, use pinning (#1064) #1078) (@JanMa)
• 7e7146b: Backport: Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 #1058) (Backport: Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058) #1077) (@JanMa)
• a2bf51c: Release 2.2.0 (Release 2.2.0 #1082) (@JanMa)
• 158c6b2: cleanup leftover DR Token options (Cleanup leftover DR Token CLI and API options #1018) (Backport: cleanup leftover DR Token options (#1018) #1074) (@JanMa)
• 72fed38: fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (FIX: UI missing checkmarks #1042) (Backport: fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042) #1076) (@JanMa)
• 04a8a01: identity: return metadata when listing entity-aliases (feat(identity/entity-alias): return metadata when listing entity-aliases #1013) (Backport: identity: return metadata when listing entity-aliases (#1013) #1073) (@JanMa)

Release notes: https://openbao.org/docs/release-notes/2-2-0/#220
Full Changelog: v2.1.0...v2.2.0