Update Helm release external-secrets to v2.8.0 (main)
This MR contains the following updates:
| Package | Update | Change | Pending |
|---|---|---|---|
| external-secrets | minor | 2.4.1 -> 2.8.0 |
2.9.0 |
⚠️ WarningSome dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
external-secrets/external-secrets (external-secrets)
v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl
What's Changed
General
- chore: release helm chart 2.7.0 by @Skarlso in #6529
- docs(barbican): correct find semantics and document property/extract by @alekc in #6531
- docs(gcp): use external-secrets.io/v1 in SecretStore examples by @alekc in #6563
- feat(generators): add GitLab deploy token generator by @alekc in #6493
- fix(barbican): validate store config and fix SecretExists error message by @alekc in #6534
- docs(beyondtrust): fix capability matrix and document decrypt/separator by @alekc in #6535
- feat: Make SecondsToLive optional for Grafana generator by @jaruwat-panturat in #6479
- docs: add missing generators to ClusterGenerator spec snippet by @jaruwat-panturat in #6590
- docs(doppler): fix download format list and heading levels by @alekc in #6559
- docs(fortanix): add to support matrix and tidy provider page by @alekc in #6562
- docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @alekc in #6585
- docs(volcengine): mark referent authentication as supported by @alekc in #6584
- docs(senhasegura): mark deletion + referent in matrix and fix title by @alekc in #6583
- docs(scaleway): mark referent auth in matrix and fix headings by @alekc in #6581
- docs(pulumi): correct find/referent matrix cells and fix headings by @alekc in #6578
- docs(previder): correct find/referent matrix cells and fix headings by @alekc in #6577
- docs(1password): mark SDK find support in matrix and promote titles by @alekc in #6568
- feat(charts): Add aggregateToAdmin toggle by @illrill in #6586
- docs(providers): consolidate 11 conflicting provider-doc MRs by @alekc in #6592
- feat(charts): add startupProbe support to webhook deployment by @alpcanaydin in #6612
- feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @baraka-akeyless in #6530
- docs(kubernetes): fix invalid tab indentation and heading levels by @alekc in #6565
- docs(dvls): mark DeletionPolicy supported and fix page title by @alekc in #6557
- docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @alekc in #6551
- docs(github): add to support matrix, fix auth field, tidy page by @alekc in #6564
- docs: Improve explanations of pem_chain by @evrardjp in #6623
- feat: Make our stance regarding AI usage more explicit. by @evrardj-roche in #6621
- fix(barbican): treat find.name.regexp as a regexp, not an exact match by @arpitjain099 in #6614
- chore: update go version 1.26.5 - Fix CVE-2026-39822 by @alekc in #6631
- ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @alekc in #6634
- chore: updating ok-to-test to allow interim maintainers by @gusfcarvalho in #6638
- fix(onepassword): support PushSecret IfNotExists by @civilizedBaboon in #6646
- fix(testing): check out MR head in fork e2e instead of main by @alekc in #6647
- fix(secretserver): validate store and map fields correctly by @dbinger in #6616
- feat(charts): Add optional networkPolicy by @jcpunk in #5779
- feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @baraka-akeyless in #6507
- feat(provider): implement AWS Certificate Manager provider by @dsp0x4 in #6117
- feat: expose more values for custom metadata for vault v2 by @Skarlso in #6652
- clean: Remove duplicate code by @evrardj-roche in #6629
- feat: configurable leader election lease timings by @izz-linux in #6644
- fix(akeyless): support dataFrom.extract.property for nested JSON by @baraka-akeyless in #6633
- feat(conjur): Certificate Auth support by @hdabrowski in #6393
- docs(aws): restore dropped access section and document missing fields by @alekc in #6517
- feat(secretserver): support authentication via access token by @sumanpal97 in #6597
- docs(secretserver): document authentication, key formats, property behavior, and limitations by @dbinger in #6619
- feat(release): Support reading values from kubernetes CRD by @alekc in #6211
- clean: Standardize and friendly name for validations policies by @evrardj-roche in #6630
- feat: add CreateOrMerge creation policy for ExternalSecrets by @alekc in #6641
- feat(core): accept duration string for SecretStore refreshInterval by @alekc in #6594
- fix(beyondtrust): validate store without panicking on API key auth by @emmayusufu in #6553
- fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @Ashutosh-3601 in #6421
Dependencies
- chore(deps): bump golang from
3ad5730to3ad5730by @dependabot[bot] in #6538 - chore(deps): bump ubi9/ubi from
1b99266to37a1589by @dependabot[bot] in #6537 - chore(deps): bump golang from
5f68ec6tob305420in /e2e by @dependabot[bot] in #6539 - chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #6540
- chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @dependabot[bot] in #6542
- chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in #6543
- chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @dependabot[bot] in #6544
- chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #6541
- chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6545
- chore(deps): bump golang from
3ad5730to3ad5730by @dependabot[bot] in #6600 - chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6606
- chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6603
- chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #6607
- chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in #6604
- chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in #6608
- chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #6605
- chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6602
- chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in #6601
- chore(deps): bump ubi9/ubi from
37a1589to8bf0e8fby @dependabot[bot] in #6599 - chore(deps): bump golang from 1.26.4 to 1.26.5 by @dependabot[bot] in #6636
- chore(deps): bump distroless/static from
3592aa8tod5f030cby @dependabot[bot] in #6635
New Contributors
- @alpcanaydin made their first contribution in #6612
- @baraka-akeyless made their first contribution in #6530
- @arpitjain099 made their first contribution in #6614
- @civilizedBaboon made their first contribution in #6646
- @dbinger made their first contribution in #6616
- @dsp0x4 made their first contribution in #6117
- @izz-linux made their first contribution in #6644
- @hdabrowski made their first contribution in #6393
- @sumanpal97 made their first contribution in #6597
- @emmayusufu made their first contribution in #6553
- @Ashutosh-3601 made their first contribution in #6421
Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.7.0...v2.8.0
v2.7.0
Image: ghcr.io/external-secrets/external-secrets:v2.7.0
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi-boringssl
What's Changed
General
- chore: release helm charts 2.6.0 by @Skarlso in #6427
- test: add Infisical provider e2e suite by @alekc in #6415
- docs: fix discrepancies and add missing documentation for GitLab provider by @alekc in #6430
- docs: fix discrepancies and add missing documentation for Infisical provider by @alekc in #6431
- feat(templating): add hexdec function by @tstenner in #6422
- fix(volcengine): honor secretRef.namespace for ClusterSecretStore by @ruslan-rm in #6423
- docs(core): correct CRD examples and document missing fields by @alekc in #6441
- feat(provider): initial dedicated OpenBao provider by @phil9909 in #6405
- feat(onepasswordsdk): implement GetAllSecrets by @calebmckay in #6445
- feat(controller): log secret deletions and data-key changes by @alekc in #6443
- feat: Add BeyondTrust WorkloadCredentials provider by @sdahal-bt in #5999
- fix(charts): truncate component names to stay within 63-char DNS limit by @alekc in #6428
- docs(gitops-fluxcd): fix webhook race condition in Flux deployment guide by @alekc in #6455
- fix: no need for the field to have a default if it can be omitted by @knelasevero in #6453
- fix(templating): preserve mixed-case in generic target paths by @alekc in #6459
- docs(generator): document Password secretKeys for multiple keys by @alekc in #6440
- docs: Update deprecated field in docs by @evrardj-roche in #6456
- chore(deps): Bump passbolt SDK to v0.8.0 by @cedricherzog-passbolt in #6447
- chore(charts): Expose storeRequeueInterval in helm charts by @jfhcagip in #6140
- feat(openbao): support custom CAs via
caBundleandcaProviderby @phil9909 in #6461 - feat(ngrok): use API filtering for vault and secret lookups by @jonstacks in #6376
- fix: remove broken link from blog section by @riccardomc in #6465
- chore: fix the template parser for resolving slice notations by @Skarlso in #6449
- fix: bump docs deps for python3.13 by @evrardj-roche in #6475
- fix(kubernetes): replace entire remote secret when pushing rather than merging by @riccardomc in #6485
- feat(infisical): return NoSecretErr on 404 and add PushSecret support by @alekc in #6434
- feat(AWS): add
replicationLocationsto AWS SecretsManager provider by @cmoscofian in #6451 - feat(openbao): add
auth.userPassauth method by @phil9909 in #6492 - chore(deps): Bump
github.com/pulumi/esc-sdk/sdkto v0.14.0 by @phil9909 in #6495 - chore(onepasswordsdk): fix the caching logic and cleanup the code a bit by @Skarlso in #6466
- feat(charts): scope cert-controller RBAC to managed CRDs and webhook secret by @somaz94 in #6481
- test(ngrok): Remove over complicated mocks by @jonstacks in #6483
- chore: Unpin mike by @evrardj-roche in #6477
- docs(akeyless): fix errors and expand provider documentation by @alekc in #6506
- chore: update go sys net and crypto libs by @Skarlso in #6511
- chore(onepasswordsdk): enable the GetAllSecrets and GetSecret unit test and fix it by @Skarlso in #6513
- feat(infisical): allow organization slug to be set in secret scope by @mathnogueira in #6508
- feat(templating): decode templateFrom values by @evrardj-roche in #6482
- chore(bug): fix missing lgtm runner script from the workflow by @Skarlso in #6512
- fix(akeyless): return ReadWrite so PushSecret is routed by @alekc in #6515
- feat(openbao): add
auth.appRoleauth method by @phil9909 in #6497 - feat(externalsecret): add SyncWindows to gate periodic refresh by @alekc in #6452
- docs(azure): correct Azure Stack example version and note expiry limit by @alekc in #6522
- feat(openbao): add support for OpenBao Namespaces by @phil9909 in #6527
- fix(github): preserve selected repositories on org secret update by @alekc in #6519
- docs(azure): list WorkloadIdentity in authType field description by @alekc in #6523
- feat(doppler): include HTTP status in API errors by @alekc in #6489
Dependencies
- chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6437
- chore(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #6438
- chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #6435
- chore(deps): bump idna from 3.17 to 3.18 in /hack/api-docs by @dependabot[bot] in #6439
- chore(deps): bump ubi9/ubi from
8942b73to46d19c1by @dependabot[bot] in #6436 - chore(deps): bump platformdirs from 4.9.6 to 4.10.0 in /hack/api-docs by @dependabot[bot] in #6410
- chore(deps): bump golang from
f23e8b2to7a3e500by @dependabot[bot] in #6468 - chore(deps): bump golang from
5d2b868to5f68ec6in /e2e by @dependabot[bot] in #6471 - chore(deps): bump tornado from 6.5.6 to 6.5.7 in /hack/api-docs by @dependabot[bot] in #6473
- chore(deps): bump alpine from 3.23.4 to 3.24.0 in /e2e by @dependabot[bot] in #6470
- chore(deps): bump alpine from
5b10f43toa2d49eaby @dependabot[bot] in #6469 - chore(deps): bump ubi9/ubi from
46d19c1to1b99266by @dependabot[bot] in #6467 - chore(deps): bump alpine from
a2d49eato28bd5fein /hack/api-docs by @dependabot[bot] in #6472 - chore(deps): bump alpine from 3.24.0 to 3.24.1 in /e2e by @dependabot[bot] in #6498
- chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6500
- chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @dependabot[bot] in #6502
- chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #6503
- chore(deps): bump alpine from
a2d49eato28bd5feby @dependabot[bot] in #6499 - chore(deps): bump golang from
7a3e500to3ad5730by @dependabot[bot] in #6501
New Contributors
- @tstenner made their first contribution in #6422
- @ruslan-rm made their first contribution in #6423
- @calebmckay made their first contribution in #6445
- @sdahal-bt made their first contribution in #5999
- @jfhcagip made their first contribution in #6140
- @somaz94 made their first contribution in #6481
- @mathnogueira made their first contribution in #6508
Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.6.0...v2.7.0
v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl
What's Changed
General
- chore: release helm chart 2.5.0 by @Skarlso in #6352
- feat(keeper): implement provider_api_calls_count metric by @m-k8s in #6345
- docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @bharath-b-rh in #6356
- feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @cedricherzog-passbolt in #6377
- feat(testing): OpenBao e2e test by @phil9909 in #6396
- docs: Explanation of our labels by @evrardj-roche in #6306
- docs: add AGENTS.md and AI setup guide for ESO by @rowanruseler in #6141
- fix(makefile): clean up cross-submodule go.mod churn after make test by @alekc in #6378
- fix(provider): align TokenRequest body namespace with URL namespace by @alekc in #6420
- fix(build): use buildx --load and non-registry image tag by @alekc in #6419
- fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @blindrood in #6360
- chore: update go version 1.26.4 by @Skarlso in #6426
Dependencies
- chore(deps): bump golang from
91eda97to91eda97by @dependabot[bot] in #6363 - chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @dependabot[bot] in #6370
- chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @dependabot[bot] in #6364
- chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #6365
- chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @dependabot[bot] in #6366
- chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @dependabot[bot] in #6368
- chore(deps): bump distroless/static from
47b2d72to3592aa8by @dependabot[bot] in #6362 - chore(deps): bump ubi9/ubi from
2323fcfto151fc1bby @dependabot[bot] in #6361 - chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @dependabot[bot] in #6367
- chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @dependabot[bot] in #6369
- chore(deps): bump golang from
91eda97to91eda97by @dependabot[bot] in #6383 - chore(deps): bump golang from
252599ato386d475in /e2e by @dependabot[bot] in #6389 - chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #6384
- chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #6387
- chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6386
- chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #6388
- chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @dependabot[bot] in #6390
- chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @dependabot[bot] in #6391
- chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @dependabot[bot] in #6392
- chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6385
- chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @dependabot[bot] in #6372
- chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @dependabot[bot] in #6412
- chore(deps): bump ubi9/ubi from
151fc1bto8942b73by @dependabot[bot] in #6407 - chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @dependabot[bot] in #6408
- chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6409
- chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @dependabot[bot] in #6411
New Contributors
- @m-k8s made their first contribution in #6345
- @phil9909 made their first contribution in #6396
- @blindrood made their first contribution in #6360
Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.5.0...v2.6.0
v2.5.0
Image: ghcr.io/external-secrets/external-secrets:v2.5.0
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.5.0-ubi-boringssl
What's Changed
General
- chore: release chart for v2.4.1 by @Skarlso in #6293
- fix(doc): Adds missing doc reference for VaultDynamicSecret example using GET by @bharath-b-rh in #6296
- feat(charts): make serviceaccounts/token create RBAC rule conditional by @kriszkern in #6295
- ref: delete duplication of applyOwnership logic by @jaruwat-panturat in #6301
- feat: add Pulumi OIDC-based authentication by @johnstonmatt in #5893
- fix: datarace in fake runtime test and push secret test by @Skarlso in #6300
- docs(release): Update docs to build for arm for bitwarden-cli by @Senk02 in #6312
- feat: add healthz check for liveness probe to cert and webhook by @Skarlso in #6319
- chore: bump go version 1.26.3 by @Skarlso in #6339
- fix(charts): gate externalsecrets write RBAC on processClusterExternalSecret by @kriszkern in #6332
- feat(gcp): issue-5790: optional GCP service account email for WIF impersonation by @bharath-b-rh in #6273
- ref(beyondtrust): BIPS-32651 add API v3.2 support for create Secrets by @btfhernandez in #6309
- fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race by @duizabojul in #6334
- docs: add Rootline to ADOPTERS.md by @daanschipper in #6342
- feat(charts): default scopedNamespace to .Release.Namespace when scopedRBAC is true by @kriszkern in #6343
- docs: add blank lines before lists by @chlab in #6336
- chore(doc): fix Azure role name typo by @hobti01 in #6335
- feat(security): Enable Authentication and Authorization for Metrics Endpoint using FilterProvider by @Zacky3181V in #5574
- feat: inject kube context as STS session tags by @robertchildresscfa in #6311
- fix(charts): remove stale args guard in controller deployment by @kriszkern in #6347
- fix: provider/infisical provider sub-folder references in remoteRef.key by @varonix0 in #6338
Dependencies
- chore(deps): bump golang from
4f4ab2cto47ce563in /e2e by @dependabot[bot] in #6286 - chore(deps): bump click from 8.3.2 to 8.3.3 in /hack/api-docs by @dependabot[bot] in #6287
- chore(deps): bump certifi from 2026.2.25 to 2026.4.22 in /hack/api-docs by @dependabot[bot] in #6288
- chore(deps): bump pathspec from 1.0.4 to 1.1.1 in /hack/api-docs by @dependabot[bot] in #6291
- chore(deps): bump idna from 3.11 to 3.13 in /hack/api-docs by @dependabot[bot] in #6290
- chore(deps): bump packaging from 26.1 to 26.2 in /hack/api-docs by @dependabot[bot] in #6289
- chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #6304
- chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #6305
- chore(deps): bump golang from 1.26.2 to 1.26.3 by @dependabot[bot] in #6320
- chore(deps): bump golang from 1.26.2-bookworm to 1.26.3-bookworm in /e2e by @dependabot[bot] in #6327
- chore(deps): bump ubi9/ubi from
fd3612eto2323fcfby @dependabot[bot] in #6321 - chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #6322
- chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #6323
- chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by @dependabot[bot] in #6325
- chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #6324
- chore(deps): bump actions/labeler from 6.0.1 to 6.1.0 by @dependabot[bot] in #6326
- chore(deps): bump idna from 3.13 to 3.14 in /hack/api-docs by @dependabot[bot] in #6328
- chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /hack/api-docs by @dependabot[bot] in #6329
- chore(deps): bump regex from 2026.4.4 to 2026.5.9 in /hack/api-docs by @dependabot[bot] in #6330
New Contributors
- @kriszkern made their first contribution in #6295
- @johnstonmatt made their first contribution in #5893
- @Senk02 made their first contribution in #6312
- @duizabojul made their first contribution in #6334
- @daanschipper made their first contribution in #6342
- @chlab made their first contribution in #6336
- @hobti01 made their first contribution in #6335
- @Zacky3181V made their first contribution in #5574
- @robertchildresscfa made their first contribution in #6311
Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.4.1...v2.5.0
Configuration
- If you want to rebase/retry this MR, check this box
This MR has been generated by Renovate Bot Sylva instance.
CI configuration couldn't be handle by MR description. A dedicated comment has been posted to control it.
If no checkbox is checked, a default pipeline will be enabled (capm3, or capo if capo label is set)