Deprecation release to prepare for the HCP Vault Secrets sunset.

CHANGELOG.md

@@ -5,6 +5,9 @@ Breaking Changes:
   `spec.appRole.secretRef` instead, which references a Kubernetes Secret containing the AppRole
   Secret ID.
 
+Deprecations:
+* HCPAuth and HCPVaultSecretsApp (HCP Vault Secrets) are deprecated and will be removed in a future release of the Vault Secrets Operator. The operator now emits a `Deprecated` warning event on each reconcile of these resources, and `kubectl` will surface a deprecation warning for the corresponding CRDs. Migrate off HCP Vault Secrets and remove any `HCPVaultSecretsApp` and `HCPAuth` resources before upgrading to the removal release. ([#1293](https://github.com/hashicorp/vault-secrets-operator/pull/1293))
+
 ## 1.4.1 (June 30th, 2026)
 
 Build:

api/v1beta1/hcpauth_types.go

@@ -8,6 +8,10 @@ import (
 )
 
 // HCPAuthSpec defines the desired state of HCPAuth
+//
+// Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+// removed in a future release of the Vault Secrets Operator. Migrate off HCP
+// Vault Secrets before upgrading to the removal release.
 type HCPAuthSpec struct {
 	// OrganizationID of the HCP organization.
 	OrganizationID string `json:"organizationID"`
@@ -35,6 +39,10 @@ type HCPAuthSpec struct {
 
 // HCPAuthServicePrincipal provides HCPAuth configuration options needed for
 // authenticating to HCP using a service principal configured in SecretRef.
+//
+// Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+// removed in a future release of the Vault Secrets Operator. Migrate off HCP
+// Vault Secrets before upgrading to the removal release.
 type HCPAuthServicePrincipal struct {
 	// SecretRef is the name of a Kubernetes secret in the consumer's
 	// (VDS/VSS/PKI/HCP) namespace which provides the HCP ServicePrincipal clientID,
@@ -47,6 +55,10 @@ type HCPAuthServicePrincipal struct {
 }
 
 // HCPAuthStatus defines the observed state of HCPAuth
+//
+// Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+// removed in a future release of the Vault Secrets Operator. Migrate off HCP
+// Vault Secrets before upgrading to the removal release.
 type HCPAuthStatus struct {
 	// Valid auth mechanism.
 	Valid *bool  `json:"valid"`
@@ -58,8 +70,13 @@ type HCPAuthStatus struct {
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
+// +kubebuilder:deprecatedversion:warning="HCPAuth is deprecated and will be removed in a future release of the Vault Secrets Operator. HCP Vault Secrets support is being retired; migrate off HCP Vault Secrets before upgrading to the removal release."
 
 // HCPAuth is the Schema for the hcpauths API
+//
+// Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+// removed in a future release of the Vault Secrets Operator. Migrate off HCP
+// Vault Secrets before upgrading to the removal release.
 type HCPAuth struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
@@ -71,6 +88,10 @@ type HCPAuth struct {
 // +kubebuilder:object:root=true
 
 // HCPAuthList contains a list of HCPAuth
+//
+// Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+// removed in a future release of the Vault Secrets Operator. Migrate off HCP
+// Vault Secrets before upgrading to the removal release.
 type HCPAuthList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

api/v1beta1/hcpvaultsecretsapp_types.go

@@ -8,6 +8,10 @@ import (
 )
 
 // HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
+//
+// Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+// and will be removed in a future release of the Vault Secrets Operator.
+// Migrate off HCP Vault Secrets before upgrading to the removal release.
 type HCPVaultSecretsAppSpec struct {
 	// AppName of the Vault Secrets Application that is to be synced.
 	AppName string `json:"appName"`
@@ -37,12 +41,18 @@ type HCPVaultSecretsAppSpec struct {
 }
 
 // HVSSyncConfig configures sync behavior from HVS to VSO
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 type HVSSyncConfig struct {
 	// Dynamic configures sync behavior for dynamic secrets.
 	Dynamic *HVSDynamicSyncConfig `json:"dynamic,omitempty"`
 }
 
 // HVSDynamicSyncConfig configures sync behavior for HVS dynamic secrets.
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 type HVSDynamicSyncConfig struct {
 	// RenewalPercent is the percent out of 100 of a dynamic secret's TTL when
 	// new secrets are generated. Defaults to 67 percent plus up to 10% jitter.
@@ -54,6 +64,9 @@ type HVSDynamicSyncConfig struct {
 
 // HVSDynamicStatus defines the observed state of a dynamic secret within an HCP
 // Vault Secrets App
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 type HVSDynamicStatus struct {
 	// Name of the dynamic secret
 	Name string `json:"name,omitempty"`
@@ -66,6 +79,10 @@ type HVSDynamicStatus struct {
 }
 
 // HCPVaultSecretsAppStatus defines the observed state of HCPVaultSecretsApp
+//
+// Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+// and will be removed in a future release of the Vault Secrets Operator.
+// Migrate off HCP Vault Secrets before upgrading to the removal release.
 type HCPVaultSecretsAppStatus struct {
 	// LastGeneration is the Generation of the last reconciled resource.
 	LastGeneration int64 `json:"lastGeneration"`
@@ -88,8 +105,13 @@ type HCPVaultSecretsAppStatus struct {
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
+// +kubebuilder:deprecatedversion:warning="HCPVaultSecretsApp is deprecated and will be removed in a future release of the Vault Secrets Operator. HCP Vault Secrets support is being retired; migrate off HCP Vault Secrets before upgrading to the removal release."
 
 // HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API
+//
+// Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+// and will be removed in a future release of the Vault Secrets Operator.
+// Migrate off HCP Vault Secrets before upgrading to the removal release.
 type HCPVaultSecretsApp struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
@@ -101,6 +123,10 @@ type HCPVaultSecretsApp struct {
 // +kubebuilder:object:root=true
 
 // HCPVaultSecretsAppList contains a list of HCPVaultSecretsApp
+//
+// Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+// and will be removed in a future release of the Vault Secrets Operator.
+// Migrate off HCP Vault Secrets before upgrading to the removal release.
 type HCPVaultSecretsAppList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`

chart/crds/secrets.hashicorp.com_hcpauths.yaml

@@ -17,10 +17,19 @@ spec:
     singular: hcpauth
   scope: Namespaced
   versions:
-  - name: v1beta1
+  - deprecated: true
+    deprecationWarning: HCPAuth is deprecated and will be removed in a future release
+      of the Vault Secrets Operator. HCP Vault Secrets support is being retired; migrate
+      off HCP Vault Secrets before upgrading to the removal release.
+    name: v1beta1
     schema:
       openAPIV3Schema:
-        description: HCPAuth is the Schema for the hcpauths API
+        description: |-
+          HCPAuth is the Schema for the hcpauths API
+
+          Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+          removed in a future release of the Vault Secrets Operator. Migrate off HCP
+          Vault Secrets before upgrading to the removal release.
         properties:
           apiVersion:
             description: |-
@@ -40,7 +49,12 @@ spec:
           metadata:
             type: object
           spec:
-            description: HCPAuthSpec defines the desired state of HCPAuth
+            description: |-
+              HCPAuthSpec defines the desired state of HCPAuth
+
+              Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+              removed in a future release of the Vault Secrets Operator. Migrate off HCP
+              Vault Secrets before upgrading to the removal release.
             properties:
               allowedNamespaces:
                 description: |-
@@ -92,7 +106,12 @@ spec:
             - projectID
             type: object
           status:
-            description: HCPAuthStatus defines the observed state of HCPAuth
+            description: |-
+              HCPAuthStatus defines the observed state of HCPAuth
+
+              Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+              removed in a future release of the Vault Secrets Operator. Migrate off HCP
+              Vault Secrets before upgrading to the removal release.
             properties:
               conditions:
                 description: |-

chart/crds/secrets.hashicorp.com_hcpvaultsecretsapps.yaml

@@ -17,11 +17,19 @@ spec:
     singular: hcpvaultsecretsapp
   scope: Namespaced
   versions:
-  - name: v1beta1
+  - deprecated: true
+    deprecationWarning: HCPVaultSecretsApp is deprecated and will be removed in a
+      future release of the Vault Secrets Operator. HCP Vault Secrets support is being
+      retired; migrate off HCP Vault Secrets before upgrading to the removal release.
+    name: v1beta1
     schema:
       openAPIV3Schema:
-        description: HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps
-          API
+        description: |-
+          HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API
+
+          Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+          and will be removed in a future release of the Vault Secrets Operator.
+          Migrate off HCP Vault Secrets before upgrading to the removal release.
         properties:
           apiVersion:
             description: |-
@@ -41,7 +49,12 @@ spec:
           metadata:
             type: object
           spec:
-            description: HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
+            description: |-
+              HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
+
+              Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+              and will be removed in a future release of the Vault Secrets Operator.
+              Migrate off HCP Vault Secrets before upgrading to the removal release.
             properties:
               appName:
                 description: AppName of the Vault Secrets Application that is to be
@@ -264,7 +277,12 @@ spec:
             - destination
             type: object
           status:
-            description: HCPVaultSecretsAppStatus defines the observed state of HCPVaultSecretsApp
+            description: |-
+              HCPVaultSecretsAppStatus defines the observed state of HCPVaultSecretsApp
+
+              Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+              and will be removed in a future release of the Vault Secrets Operator.
+              Migrate off HCP Vault Secrets before upgrading to the removal release.
             properties:
               conditions:
                 description: |-
@@ -333,6 +351,9 @@ spec:
                   description: |-
                     HVSDynamicStatus defines the observed state of a dynamic secret within an HCP
                     Vault Secrets App
+
+                    Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+                    future release of the Vault Secrets Operator.
                   properties:
                     createdAt:
                       description: CreatedAt is the timestamp string of when the dynamic

common/common.go

@@ -605,6 +605,9 @@ func GetVaultAuthWithRetry(ctx context.Context, c client.Client, key types.Names
 
 // GetHCPAuthForObj returns the corresponding secretsv1beta1.HCPAuth for obj.
 // Supported client.Object: secretsv1beta1.HCPVaultSecretsApp
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 func GetHCPAuthForObj(ctx context.Context, c client.Client, obj client.Object) (*secretsv1beta1.HCPAuth, error) {
 	authRef, err := getAuthRefNamespacedName(obj)
 	if err != nil {
@@ -627,6 +630,11 @@ func GetHCPAuthForObj(ctx context.Context, c client.Client, obj client.Object) (
 	return authObj, nil
 }
 
+// GetHCPAuthWithRetry returns the secretsv1beta1.HCPAuth for key, retrying on
+// transient not-found errors.
+//
+// Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+// future release of the Vault Secrets Operator.
 func GetHCPAuthWithRetry(ctx context.Context, c client.Client, key types.NamespacedName,
 	delay time.Duration, max uint64,
 ) (*secretsv1beta1.HCPAuth, error) {

config/crd/bases/secrets.hashicorp.com_hcpauths.yaml

@@ -17,10 +17,19 @@ spec:
     singular: hcpauth
   scope: Namespaced
   versions:
-  - name: v1beta1
+  - deprecated: true
+    deprecationWarning: HCPAuth is deprecated and will be removed in a future release
+      of the Vault Secrets Operator. HCP Vault Secrets support is being retired; migrate
+      off HCP Vault Secrets before upgrading to the removal release.
+    name: v1beta1
     schema:
       openAPIV3Schema:
-        description: HCPAuth is the Schema for the hcpauths API
+        description: |-
+          HCPAuth is the Schema for the hcpauths API
+
+          Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+          removed in a future release of the Vault Secrets Operator. Migrate off HCP
+          Vault Secrets before upgrading to the removal release.
         properties:
           apiVersion:
             description: |-
@@ -40,7 +49,12 @@ spec:
           metadata:
             type: object
           spec:
-            description: HCPAuthSpec defines the desired state of HCPAuth
+            description: |-
+              HCPAuthSpec defines the desired state of HCPAuth
+
+              Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+              removed in a future release of the Vault Secrets Operator. Migrate off HCP
+              Vault Secrets before upgrading to the removal release.
             properties:
               allowedNamespaces:
                 description: |-
@@ -92,7 +106,12 @@ spec:
             - projectID
             type: object
           status:
-            description: HCPAuthStatus defines the observed state of HCPAuth
+            description: |-
+              HCPAuthStatus defines the observed state of HCPAuth
+
+              Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
+              removed in a future release of the Vault Secrets Operator. Migrate off HCP
+              Vault Secrets before upgrading to the removal release.
             properties:
               conditions:
                 description: |-

config/crd/bases/secrets.hashicorp.com_hcpvaultsecretsapps.yaml

@@ -17,11 +17,19 @@ spec:
     singular: hcpvaultsecretsapp
   scope: Namespaced
   versions:
-  - name: v1beta1
+  - deprecated: true
+    deprecationWarning: HCPVaultSecretsApp is deprecated and will be removed in a
+      future release of the Vault Secrets Operator. HCP Vault Secrets support is being
+      retired; migrate off HCP Vault Secrets before upgrading to the removal release.
+    name: v1beta1
     schema:
       openAPIV3Schema:
-        description: HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps
-          API
+        description: |-
+          HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API
+
+          Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+          and will be removed in a future release of the Vault Secrets Operator.
+          Migrate off HCP Vault Secrets before upgrading to the removal release.
         properties:
           apiVersion:
             description: |-
@@ -41,7 +49,12 @@ spec:
           metadata:
             type: object
           spec:
-            description: HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
+            description: |-
+              HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
+
+              Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+              and will be removed in a future release of the Vault Secrets Operator.
+              Migrate off HCP Vault Secrets before upgrading to the removal release.
             properties:
               appName:
                 description: AppName of the Vault Secrets Application that is to be
@@ -264,7 +277,12 @@ spec:
             - destination
             type: object
           status:
-            description: HCPVaultSecretsAppStatus defines the observed state of HCPVaultSecretsApp
+            description: |-
+              HCPVaultSecretsAppStatus defines the observed state of HCPVaultSecretsApp
+
+              Deprecated: HCPVaultSecretsApp and HCP Vault Secrets support are deprecated
+              and will be removed in a future release of the Vault Secrets Operator.
+              Migrate off HCP Vault Secrets before upgrading to the removal release.
             properties:
               conditions:
                 description: |-
@@ -333,6 +351,9 @@ spec:
                   description: |-
                     HVSDynamicStatus defines the observed state of a dynamic secret within an HCP
                     Vault Secrets App
+
+                    Deprecated: HCP Vault Secrets support is deprecated and will be removed in a
+                    future release of the Vault Secrets Operator.
                   properties:
                     createdAt:
                       description: CreatedAt is the timestamp string of when the dynamic