Release 0.6.1

NVCF Self-Hosted 0.6.1 is a maintenance release. It updates OpenBao to address security issues in the runtime and migration images. It also replaces the archived Bitnami Cassandra runtime with the official Apache Cassandra 5.0.8 image and an in-house Cassandra Helm chart.

Highlights

Change	Status	Summary
OpenBao security update	GA	OpenBao uses the remediated runtime and migration images. Existing installations must continue through 0.6.2 before rotating server pods.
Cassandra off Bitnami	GA	Cassandra runs on the official Apache Cassandra 5.0.8 image, deployed by an in-house Helm chart, replacing the Bitnami image and subchart.

Cassandra runtime and chart

The Cassandra runtime image is now built on the official Apache Cassandra 5.0.8 image instead of the archived Bitnami image, and the Bitnami Cassandra Helm subchart is replaced by an in-house StatefulSet chart. This removes the CVE-affected Bitnami base and its bundled components while keeping the same operational surface: PasswordAuthenticator and CassandraAuthorizer, stable-DNS seed discovery, the Prometheus metrics exporter, keyspace initialization, and schema migrations.

The chart runs the nodes with storage_compatibility_mode: NONE to match the existing fleet’s on-disk and streaming format.

Upgrade Notes

Fresh installs need no special handling; Cassandra comes up on the official image with the in-house chart.

Existing clusters that already hold data need a migration, because the runtime image, the Helm chart shape, and the on-disk data layout all change. A normal in-place Helm upgrade does not carry an existing Bitnami-based cluster onto the new stack. Follow the 0.6.0 to 0.6.1 Upgrade procedure, which describes the supported migration methods (datacenter expansion, in-place volume adoption, backup and restore) and their trade-offs.

OpenBao security update

The OpenBao StatefulSet uses OnDelete. A Helm upgrade updates its pod configuration and the injector, but existing server pods keep running their previous images. A successful Helm upgrade alone does not complete this security update.

For an existing 0.6.0 installation, apply the full 0.6.1 stack after the Cassandra migration, then continue through the 0.6.1 to 0.6.2 upgrade. Keep the healthy OpenBao server pods running at the 0.6.1 checkpoint. Do not restart them there: 0.6.1 does not refresh the stored JWT plugin checksum to match the new binary.

The 0.6.2 procedure refreshes the plugin catalog, verifies the migration, and replaces stale server pods one at a time while preserving Raft quorum and persistent volumes. It checks the images actually running in each pod, even when the StatefulSet template did not change between 0.6.1 and 0.6.2. Fresh authentication and secret injection checks confirm that the new runtime works.

Follow that procedure as the source of truth for the rotation order and health checks. Do not delete OpenBao persistent volume claims or reinitialize the cluster during the upgrade.