feat(container): update image external-secrets ( 2.1.0 → 2.9.0 ) - #3311
Open
renovate[bot] wants to merge 1 commit into
Open
feat(container): update image external-secrets ( 2.1.0 → 2.9.0 )#3311renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Path: --- /tmp/tmp.WKg5GzxcdR 2026-06-18 17:46:54.348808910 +0000
+++ /tmp/tmp.1gaH971Ewy 2026-06-18 17:46:55.809815364 +0000
@@ -4882,6 +4882,14 @@
- None
- Fetch
type: string
+ nullBytePolicy:
+ default: Ignore
+ description: Controls how ESO handles fetched secret data containing NUL bytes
+ for this source.
+ enum:
+ - Ignore
+ - Fail
+ type: string
property:
description: Used to select a specific property of the Provider value (if a
map), if supported
@@ -5013,6 +5021,14 @@
- None
- Fetch
type: string
+ nullBytePolicy:
+ default: Ignore
+ description: Controls how ESO handles fetched secret data containing NUL bytes
+ for this source.
+ enum:
+ - Ignore
+ - Fail
+ type: string
property:
description: Used to select a specific property of the Provider value (if a
map), if supported
@@ -5052,6 +5068,14 @@
description: Finds secrets base
type: string
type: object
+ nullBytePolicy:
+ default: Ignore
+ description: Controls how ESO handles fetched secret data containing NUL bytes
+ for this find source.
+ enum:
+ - Ignore
+ - Fail
+ type: string
path:
description: A root path to start the find operations.
type: string
@@ -5455,6 +5479,7 @@
namespaceSelector:
description: |-
The labels to select by to find the Namespaces to create the ExternalSecrets in.
+
Deprecated: Use NamespaceSelectors instead.
properties:
matchExpressions:
@@ -5554,6 +5579,7 @@
namespaces:
description: |-
Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
+
Deprecated: Use NamespaceSelectors instead.
items:
maxLength: 63
@@ -6325,6 +6351,7 @@
namespaces:
description: |-
Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
+
Deprecated: Use NamespaceSelectors instead.
items:
maxLength: 63
@@ -6983,6 +7010,18 @@
credential_source.url in the provided credConfig. This field is merely to double-check the external token source
URL is having the expected value.
type: string
+ gcpServiceAccountEmail:
+ description: |-
+ GCPServiceAccountEmail is the email of the Google Cloud service account to impersonate
+ after Workload Identity Federation. Use this to grant access through the service account's
+ IAM bindings (for example roles/secretmanager.secretAccessor). When set, it overrides
+ service_account_impersonation_url in the external account JSON from credConfig;
+ when serviceAccountRef is set, it also overrides the "iam.gke.io/gcp-service-account" annotation
+ on that ServiceAccount.
+ example: my-gsa@my-project.iam.gserviceaccount.com
+ minLength: 1
+ pattern: ^.*@.*\.iam\.gserviceaccount\.com$
+ type: string
serviceAccountRef:
description: |-
serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
@@ -7531,6 +7570,16 @@
Used to select the correct ESO controller (think: ingress.ingressClassName)
The ESO controller is instantiated with a specific controller name and filters VDS based on this property
type: string
+ getParameters:
+ additionalProperties:
+ items:
+ type: string
+ type: array
+ description: |-
+ GetParameters are query-string parameters passed to Vault on GET calls.
+ Each key may map to multiple values, matching HTTP query-string semantics.
+ Ignored for non-GET methods; use Parameters for write bodies.
+ type: object
method:
description: Vault API method to use (GET/POST/other)
type: string
@@ -7694,6 +7743,10 @@
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
type: object
+ vaultRole:
+ description: VaultRole specifies the Vault role to use for TLS certificate
+ authentication.
+ type: string
type: object
gcp:
description: |-
@@ -7991,6 +8044,7 @@
Optional audiences field that will be used to request a temporary Kubernetes service
account token for the service account referenced by `serviceAccountRef`.
Defaults to a single audience `vault` it not specified.
+
Deprecated: use serviceAccountRef.Audiences instead
items:
type: string
@@ -8000,6 +8054,7 @@
Optional expiration time in seconds that will be used to request a temporary
Kubernetes service account token for the service account referenced by
`serviceAccountRef`.
+
Deprecated: this will be removed in the future.
Defaults to 10 minutes.
format: int64
@@ -8865,6 +8920,154 @@
- match
type: object
type: array
+ dataTo:
+ description: DataTo defines bulk push rules that expand source Secret keys into
+ provider entries.
+ items:
+ description: PushSecretDataTo defines how to bulk-push secrets to providers
+ without explicit per-key mappings.
+ properties:
+ conversionStrategy:
+ default: None
+ description: Used to define a conversion Strategy for the secret keys
+ enum:
+ - None
+ - ReverseUnicode
+ type: string
+ match:
+ description: |-
+ Match pattern for selecting keys from the source Secret.
+ If not specified, all keys are selected.
+ properties:
+ regexp:
+ description: |-
+ Regexp matches keys by regular expression.
+ If not specified, all keys are matched.
+ type: string
+ type: object
+ metadata:
+ description: |-
+ Metadata is metadata attached to the secret.
+ The structure of metadata is provider specific, please look it up in the provider documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ remoteKey:
+ description: |-
+ RemoteKey is the name of the single provider secret that will receive ALL
+ matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}).
+ When set, per-key expansion is skipped and a single push is performed.
+ The provider's store prefix (if any) is still prepended to this value.
+ When not set, each matched key is pushed as its own individual provider secret.
+ type: string
+ rewrite:
+ description: |-
+ Rewrite operations to transform keys before pushing to the provider.
+ Operations are applied sequentially.
+ items:
+ description: PushSecretRewrite defines how to transform secret keys before
+ pushing.
+ properties:
+ regexp:
+ description: Used to rewrite with regular expressions.
+ properties:
+ source:
+ description: Used to define the regular expression of a re.Compiler.
+ type: string
+ target:
+ description: Used to define the target pattern of a ReplaceAll operation.
+ type: string
+ required:
+ - source
+ - target
+ type: object
+ transform:
+ description: Used to apply string transformation on the secrets.
+ properties:
+ template:
+ description: |-
+ Used to define the template to apply on the secret name.
+ `.value ` will specify the secret name in the template.
+ type: string
+ required:
+ - template
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: exactly one of regexp or transform must be set
+ rule: (has(self.regexp) && !has(self.transform)) || (!has(self.regexp) &&
+ has(self.transform))
+ type: array
+ storeRef:
+ description: StoreRef specifies which SecretStore to push to. Required.
+ properties:
+ kind:
+ default: SecretStore
+ description: Kind of the SecretStore resource (SecretStore or
+ ClusterSecretStore)
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ labelSelector:
+ description: Optionally, sync to secret stores with label selector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The
+ requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ name:
+ description: Optionally, sync to the SecretStore of the given name
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: storeRef must specify either name or labelSelector
+ rule: has(self.storeRef) && (has(self.storeRef.name) ||
+ has(self.storeRef.labelSelector))
+ - message: 'remoteKey and rewrite are mutually exclusive: rewrite is only
+ supported in per-key mode (without remoteKey)'
+ rule: '!has(self.remoteKey) || !has(self.rewrite) || size(self.rewrite) == 0'
+ type: array
deletionPolicy:
default: None
description: Deletion Policy to handle Secrets in the provider.
@@ -9757,6 +9960,18 @@
type: object
type: object
type: object
+ customSessionTags:
+ additionalProperties:
+ type: string
+ description: |-
+ CustomSessionTags defines additional STS session tags to include when SessionTagsPolicy is Custom.
+ These are merged with the automatically injected esoNamespace, esoStoreName, and esoStoreKind tags.
+ type: object
+ x-kubernetes-validations:
+ - message: 'customSessionTags cannot contain automatically injected reserved keys:
+ esoNamespace, esoStoreName, esoStoreKind'
+ rule: '!(''esoNamespace'' in self) && !(''esoStoreName'' in self) &&
+ !(''esoStoreKind'' in self)'
externalID:
description: AWS External ID set on assumed IAM roles
type: string
@@ -9813,6 +10028,19 @@
- value
type: object
type: array
+ sessionTagsPolicy:
+ default: None
+ description: |-
+ SessionTagsPolicy controls whether and how STS session tags are added when assuming roles.
+ None (default): no tags are added.
+ Simple: automatically adds esoNamespace (from the ExternalSecret), esoStoreName, and esoStoreKind tags.
+ Custom: adds esoNamespace, esoStoreName, and esoStoreKind plus any tags defined in CustomSessionTags.
+ Note: the IAM role must have sts:TagSession permission when using Simple or Custom.
+ enum:
+ - None
+ - Simple
+ - Custom
+ type: string
transitiveTagKeys:
description: AWS STS assume role transitive session tags. Required when multiple
rules are used with the provider
@@ -11086,6 +11314,11 @@
description: ServerURL is the DVLS instance URL (e.g.,
https://dvls.example.com).
type: string
+ vault:
+ description: |-
+ Vault is the name or UUID of the vault to fetch secrets from.
+ When omitted, the vault must be specified in the secret key using the legacy format "<vault-id>/<entry-id>".
+ type: string
required:
- auth
- serverUrl
@@ -11327,6 +11560,18 @@
credential_source.url in the provided credConfig. This field is merely to double-check the external token source
URL is having the expected value.
type: string
+ gcpServiceAccountEmail:
+ description: |-
+ GCPServiceAccountEmail is the email of the Google Cloud service account to impersonate
+ after Workload Identity Federation. Use this to grant access through the service account's
+ IAM bindings (for example roles/secretmanager.secretAccessor). When set, it overrides
+ service_account_impersonation_url in the external account JSON from credConfig;
+ when serviceAccountRef is set, it also overrides the "iam.gke.io/gcp-service-account" annotation
+ on that ServiceAccount.
+ example: my-gsa@my-project.iam.gserviceaccount.com
+ minLength: 1
+ pattern: ^.*@.*\.iam\.gserviceaccount\.com$
+ type: string
serviceAccountRef:
description: |-
serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
@@ -11429,6 +11674,16 @@
used to authenticate the client
format: int64
type: integer
+ orgSecretVisibility:
+ description: |-
+ orgSecretVisibility controls the visibility of organization secrets pushed via PushSecret.
+ Valid values are "all" or "private".
+ When unset, new secrets are created with visibility "all" and existing secrets preserve
+ whatever visibility they already have in GitHub.
+ enum:
+ - all
+ - private
+ type: string
organization:
description: organization will be used to fetch secrets from the Github
organization
@@ -12475,6 +12730,8 @@
type: object
folderID:
type: string
+ getByTitleFallback:
+ type: boolean
required:
- authRef
- folderID
@@ -13236,6 +13493,173 @@
- region
- vault
type: object
+ ovh:
+ description: OVHcloud configures this store to sync secrets using the OVHcloud
+ provider.
+ properties:
+ auth:
+ description: Authentication method (mtls or token).
+ properties:
+ mtls:
+ description: OvhClientMTLS defines the configuration required to authenticate to
+ OVHcloud's Secret Manager using mTLS.
+ properties:
+ caBundle:
+ format: byte
+ type: string
+ caProvider:
+ description: |-
+ CAProvider provides a custom certificate authority for accessing the provider's store.
+ The CAProvider points to a Secret or ConfigMap resource that contains a PEM-encoded certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or
+ ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ certSecretRef:
+ description: |-
+ SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - certSecretRef
+ - keySecretRef
+ type: object
+ token:
+ description: OvhClientToken defines the configuration required to authenticate
+ to OVHcloud's Secret Manager using a token.
+ properties:
+ tokenSecretRef:
+ description: |-
+ SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - tokenSecretRef
+ type: object
+ type: object
+ casRequired:
+ description: 'Enables or disables check-and-set (CAS) (default: false).'
+ type: boolean
+ okmsTimeout:
+ default: 30
+ description: 'Setup a timeout in seconds when requests to the KMS are made
+ (default: 30).'
+ format: int32
+ minimum: 1
+ type: integer
+ okmsid:
+ description: specifies the OKMS ID.
+ type: string
+ server:
+ description: specifies the OKMS server endpoint.
+ type: string
+ required:
+ - auth
+ - okmsid
+ - server
+ type: object
passbolt:
description: |-
PassboltProvider provides access to Passbolt secrets manager.
@@ -13305,6 +13729,48 @@
- passwordSecretRef
- privateKeySecretRef
type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Passbolt server certificate. Only used
+ if the Host URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Passbolt server
+ certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or
+ ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
host:
description: Host defines the Passbolt Server to connect to
type: string
@@ -13416,8 +13882,10 @@
provider
properties:
accessToken:
- description: AccessToken is the access tokens to sign in to the Pulumi Cloud
- Console.
+ description: |-
+ AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
+
+ Deprecated: Use auth.accessToken instead.
properties:
secretRef:
description: SecretRef is a reference to a secret containing the Pulumi API
@@ -13451,6 +13919,97 @@
default: https://api.pulumi.com/api/esc
description: APIURL is the URL of the Pulumi API.
type: string
+ auth:
+ description: |-
+ Auth configures how the Operator authenticates with the Pulumi API.
+ Either auth or the deprecated accessToken field must be specified.
+ properties:
+ accessToken:
+ description: AccessToken authenticates using a Pulumi access token stored in a
+ Kubernetes Secret.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the Pulumi API
+ token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ oidcConfig:
+ description: OIDCConfig authenticates using Kubernetes ServiceAccount tokens via
+ OIDC.
+ properties:
+ expirationSeconds:
+ default: 600
+ description: |-
+ ExpirationSeconds sets the token validity duration for service account and OIDC token.
+ Defaults to 10 minutes.
+ format: int64
+ minimum: 600
+ type: integer
+ organization:
+ description: Organization is the name of the Pulumi organization configured for
+ OIDC authentication.
+ type: string
+ serviceAccountRef:
+ description: ServiceAccountRef specifies the Kubernetes ServiceAccount to use
+ for authentication.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - organization
+ - serviceAccountRef
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: Exactly one of 'accessToken' or 'oidcConfig' must be specified
+ rule: (has(self.accessToken) && !has(self.oidcConfig)) ||
+ (!has(self.accessToken) && has(self.oidcConfig))
environment:
description: |-
Environment are YAML documents composed of static key-value pairs, programmatic expressions,
@@ -13468,11 +14027,14 @@
belongs to.
type: string
required:
- - accessToken
- environment
- organization
- project
type: object
+ x-kubernetes-validations:
+ - message: Exactly one of 'auth' or deprecated 'accessToken' must be specified
+ rule: (has(self.auth) && !has(self.accessToken)) || (!has(self.auth) &&
+ has(self.accessToken))
scaleway:
description: Scaleway configures this store to sync secrets using the Scaleway
provider.
@@ -13904,6 +14466,10 @@
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
type: object
+ vaultRole:
+ description: VaultRole specifies the Vault role to use for TLS certificate
+ authentication.
+ type: string
type: object
gcp:
description: |-
@@ -14199,6 +14765,7 @@
Optional audiences field that will be used to request a temporary Kubernetes service
account token for the service account referenced by `serviceAccountRef`.
Defaults to a single audience `vault` it not specified.
+
Deprecated: use serviceAccountRef.Audiences instead
items:
type: string
@@ -14208,6 +14775,7 @@
Optional expiration time in seconds that will be used to request a temporary
Kubernetes service account token for the service account referenced by
`serviceAccountRef`.
+
Deprecated: this will be removed in the future.
Defaults to 10 minutes.
format: int64
@@ -18727,6 +19295,7 @@
Optional audiences field that will be used to request a temporary Kubernetes service
account token for the service account referenced by `serviceAccountRef`.
Defaults to a single audience `vault` it not specified.
+
Deprecated: use serviceAccountRef.Audiences instead
items:
type: string
@@ -18736,6 +19305,7 @@
Optional expiration time in seconds that will be used to request a temporary
Kubernetes service account token for the service account referenced by
`serviceAccountRef`.
+
Deprecated: this will be removed in the future.
Defaults to 10 minutes.
format: int64
@@ -19807,6 +20377,9 @@
- jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
+ - jsonPath: .status.refreshTime
+ name: Last Sync
+ type: date
name: v1
schema:
openAPIV3Schema:
@@ -19873,6 +20446,14 @@
- None
- Fetch
type: string
+ nullBytePolicy:
+ default: Ignore
+ description: Controls how ESO handles fetched secret data containing NUL bytes
+ for this source.
+ enum:
+ - Ignore
+ - Fail
+ type: string
property:
description: Used to select a specific property of the Provider value (if a
map), if supported
@@ -20004,6 +20585,14 @@
- None
- Fetch
type: string
+ nullBytePolicy:
+ default: Ignore
+ description: Controls how ESO handles fetched secret data containing NUL bytes
+ for this source.
+ enum:
+ - Ignore
+ - Fail
+ type: string
property:
description: Used to select a specific property of the Provider value (if a
map), if supported
@@ -20043,6 +20632,14 @@
description: Finds secrets base
type: string
type: object
+ nullBytePolicy:
+ default: Ignore
+ description: Controls how ESO handles fetched secret data containing NUL bytes
+ for this find source.
+ enum:
+ - Ignore
+ - Fail
+ type: string
path:
description: A root path to start the find operations.
type: string
@@ -20524,6 +21121,9 @@
- jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
+ - jsonPath: .status.refreshTime
+ name: Last Sync
+ type: date
deprecated: true
name: v1beta1
schema:
@@ -21423,6 +22023,18 @@
credential_source.url in the provided credConfig. This field is merely to double-check the external token source
URL is having the expected value.
type: string
+ gcpServiceAccountEmail:
+ description: |-
+ GCPServiceAccountEmail is the email of the Google Cloud service account to impersonate
+ after Workload Identity Federation. Use this to grant access through the service account's
+ IAM bindings (for example roles/secretmanager.secretAccessor). When set, it overrides
+ service_account_impersonation_url in the external account JSON from credConfig;
+ when serviceAccountRef is set, it also overrides the "iam.gke.io/gcp-service-account" annotation
+ on that ServiceAccount.
+ example: my-gsa@my-project.iam.gserviceaccount.com
+ minLength: 1
+ pattern: ^.*@.*\.iam\.gserviceaccount\.com$
+ type: string
serviceAccountRef:
description: |-
serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
@@ -22073,6 +22685,9 @@
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
name: Status
type: string
+ - jsonPath: .status.refreshTime
+ name: Last Sync
+ type: date
name: v1alpha1
schema:
openAPIV3Schema:
@@ -22142,6 +22757,154 @@
- match
type: object
type: array
+ dataTo:
+ description: DataTo defines bulk push rules that expand source Secret keys into
+ provider entries.
+ items:
+ description: PushSecretDataTo defines how to bulk-push secrets to providers
+ without explicit per-key mappings.
+ properties:
+ conversionStrategy:
+ default: None
+ description: Used to define a conversion Strategy for the secret keys
+ enum:
+ - None
+ - ReverseUnicode
+ type: string
+ match:
+ description: |-
+ Match pattern for selecting keys from the source Secret.
+ If not specified, all keys are selected.
+ properties:
+ regexp:
+ description: |-
+ Regexp matches keys by regular expression.
+ If not specified, all keys are matched.
+ type: string
+ type: object
+ metadata:
+ description: |-
+ Metadata is metadata attached to the secret.
+ The structure of metadata is provider specific, please look it up in the provider documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ remoteKey:
+ description: |-
+ RemoteKey is the name of the single provider secret that will receive ALL
+ matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}).
+ When set, per-key expansion is skipped and a single push is performed.
+ The provider's store prefix (if any) is still prepended to this value.
+ When not set, each matched key is pushed as its own individual provider secret.
+ type: string
+ rewrite:
+ description: |-
+ Rewrite operations to transform keys before pushing to the provider.
+ Operations are applied sequentially.
+ items:
+ description: PushSecretRewrite defines how to transform secret keys before
+ pushing.
+ properties:
+ regexp:
+ description: Used to rewrite with regular expressions.
+ properties:
+ source:
+ description: Used to define the regular expression of a re.Compiler.
+ type: string
+ target:
+ description: Used to define the target pattern of a ReplaceAll operation.
+ type: string
+ required:
+ - source
+ - target
+ type: object
+ transform:
+ description: Used to apply string transformation on the secrets.
+ properties:
+ template:
+ description: |-
+ Used to define the template to apply on the secret name.
+ `.value ` will specify the secret name in the template.
+ type: string
+ required:
+ - template
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: exactly one of regexp or transform must be set
+ rule: (has(self.regexp) && !has(self.transform)) || (!has(self.regexp) &&
+ has(self.transform))
+ type: array
+ storeRef:
+ description: StoreRef specifies which SecretStore to push to. Required.
+ properties:
+ kind:
+ default: SecretStore
+ description: Kind of the SecretStore resource (SecretStore or
+ ClusterSecretStore)
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ labelSelector:
+ description: Optionally, sync to secret stores with label selector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The
+ requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ name:
+ description: Optionally, sync to the SecretStore of the given name
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: storeRef must specify either name or labelSelector
+ rule: has(self.storeRef) && (has(self.storeRef.name) ||
+ has(self.storeRef.labelSelector))
+ - message: 'remoteKey and rewrite are mutually exclusive: rewrite is only
+ supported in per-key mode (without remoteKey)'
+ rule: '!has(self.remoteKey) || !has(self.rewrite) || size(self.rewrite) == 0'
+ type: array
deletionPolicy:
default: None
description: Deletion Policy to handle Secrets in the provider.
@@ -23146,6 +23909,18 @@
type: object
type: object
type: object
+ customSessionTags:
+ additionalProperties:
+ type: string
+ description: |-
+ CustomSessionTags defines additional STS session tags to include when SessionTagsPolicy is Custom.
+ These are merged with the automatically injected esoNamespace, esoStoreName, and esoStoreKind tags.
+ type: object
+ x-kubernetes-validations:
+ - message: 'customSessionTags cannot contain automatically injected reserved keys:
+ esoNamespace, esoStoreName, esoStoreKind'
+ rule: '!(''esoNamespace'' in self) && !(''esoStoreName'' in self) &&
+ !(''esoStoreKind'' in self)'
externalID:
description: AWS External ID set on assumed IAM roles
type: string
@@ -23202,6 +23977,19 @@
- value
type: object
type: array
+ sessionTagsPolicy:
+ default: None
+ description: |-
+ SessionTagsPolicy controls whether and how STS session tags are added when assuming roles.
+ None (default): no tags are added.
+ Simple: automatically adds esoNamespace (from the ExternalSecret), esoStoreName, and esoStoreKind tags.
+ Custom: adds esoNamespace, esoStoreName, and esoStoreKind plus any tags defined in CustomSessionTags.
+ Note: the IAM role must have sts:TagSession permission when using Simple or Custom.
+ enum:
+ - None
+ - Simple
+ - Custom
+ type: string
transitiveTagKeys:
description: AWS STS assume role transitive session tags. Required when multiple
rules are used with the provider
@@ -24475,6 +25263,11 @@
description: ServerURL is the DVLS instance URL (e.g.,
https://dvls.example.com).
type: string
+ vault:
+ description: |-
+ Vault is the name or UUID of the vault to fetch secrets from.
+ When omitted, the vault must be specified in the secret key using the legacy format "<vault-id>/<entry-id>".
+ type: string
required:
- auth
- serverUrl
@@ -24716,6 +25509,18 @@
credential_source.url in the provided credConfig. This field is merely to double-check the external token source
URL is having the expected value.
type: string
+ gcpServiceAccountEmail:
+ description: |-
+ GCPServiceAccountEmail is the email of the Google Cloud service account to impersonate
+ after Workload Identity Federation. Use this to grant access through the service account's
+ IAM bindings (for example roles/secretmanager.secretAccessor). When set, it overrides
+ service_account_impersonation_url in the external account JSON from credConfig;
+ when serviceAccountRef is set, it also overrides the "iam.gke.io/gcp-service-account" annotation...*[Comment body truncated]* |
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
April 19, 2026 19:53
2f69f0b to
c90edd4
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
April 24, 2026 19:44
c90edd4 to
284b0ca
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
April 28, 2026 11:29
284b0ca to
da423bd
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
May 15, 2026 14:10
da423bd to
b054342
Compare
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
May 22, 2026 21:16
b054342 to
75bc696
Compare
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
June 7, 2026 09:10
75bc696 to
5f3505b
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
June 18, 2026 17:45
5f3505b to
c4de681
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
June 26, 2026 16:09
c4de681 to
a632685
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
2 times, most recently
from
July 20, 2026 20:41
3037350 to
4f7223d
Compare
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
July 30, 2026 16:05
4f7223d to
f9b38f3
Compare
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
August 8, 2026 12:53
f9b38f3 to
0bf32aa
Compare
renovate
Bot
changed the title
| datasource | package | from | to | | ---------- | ------------------------------------------------ | ----- | ----- | | docker | ghcr.io/external-secrets/charts/external-secrets | 2.1.0 | 2.9.0 | Signed-off-by: Roger Rumao <rogerrum@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
August 12, 2026 03:55
0bf32aa to
a11f29f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.1.0→2.9.0Release Notes
external-secrets/external-secrets (external-secrets)
v2.9.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.9.0Image:
ghcr.io/external-secrets/external-secrets:v2.9.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.9.0-ubi-boringsslWhat's Changed
General
Dependencies
0178a64to0178a64by @dependabot[bot] in #6663d5f030cto9197324by @dependabot[bot] in #66628bf0e8fto2a6bd69by @dependabot[bot] in #6661fc21748tocd3439aby @dependabot[bot] in #6714cd3439ato1206044by @dependabot[bot] in #6737New Contributors
Full Changelog: external-secrets/external-secrets@v2.8.0...v2.9.0
v2.8.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.8.0Image:
ghcr.io/external-secrets/external-secrets:v2.8.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringsslWhat's Changed
General
Dependencies
3ad5730to3ad5730by @dependabot[bot] in #65381b99266to37a1589by @dependabot[bot] in #65375f68ec6tob305420in /e2e by @dependabot[bot] in #65393ad5730to3ad5730by @dependabot[bot] in #660037a1589to8bf0e8fby @dependabot[bot] in #65993592aa8tod5f030cby @dependabot[bot] in #6635New Contributors
Full Changelog: external-secrets/external-secrets@v2.7.0...v2.8.0
v2.7.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.7.0Image:
ghcr.io/external-secrets/external-secrets:v2.7.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.7.0-ubi-boringsslWhat's Changed
General
caBundleandcaProviderby @phil9909 in #6461replicationLocationsto AWS SecretsManager provider by @cmoscofian in #6451auth.userPassauth method by @phil9909 in #6492github.com/pulumi/esc-sdk/sdkto v0.14.0 by @phil9909 in #6495auth.appRoleauth method by @phil9909 in #6497Dependencies
8942b73to46d19c1by @dependabot[bot] in #6436f23e8b2to7a3e500by @dependabot[bot] in #64685d2b868to5f68ec6in /e2e by @dependabot[bot] in #64715b10f43toa2d49eaby @dependabot[bot] in #646946d19c1to1b99266by @dependabot[bot] in #6467a2d49eato28bd5fein /hack/api-docs by @dependabot[bot] in #6472a2d49eato28bd5feby @dependabot[bot] in #64997a3e500to3ad5730by @dependabot[bot] in #6501New Contributors
Full Changelog: external-secrets/external-secrets@v2.6.0...v2.7.0
v2.6.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.6.0Image:
ghcr.io/external-secrets/external-secrets:v2.6.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringsslWhat's Changed
General
Dependencies
91eda97to91eda97by @dependabot[bot] in #636347b2d72to3592aa8by @dependabot[bot] in #63622323fcfto151fc1bby @dependabot[bot] in #636191eda97to91eda97by @dependabot[bot] in #6383252599ato386d475in /e2e by @dependabot[bot] in #6389Configuration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.