chore(deps): update helm release external-secrets to v2.4.1#1546
Merged
Conversation
--- kubernetes/apps/infrastructure/secrets/external-secrets/app Kustomization: flux-system/external-secrets HelmRelease: secrets/external-secrets
+++ kubernetes/apps/infrastructure/secrets/external-secrets/app Kustomization: flux-system/external-secrets HelmRelease: secrets/external-secrets
@@ -12,13 +12,13 @@
spec:
chart: external-secrets
sourceRef:
kind: HelmRepository
name: external-secrets
namespace: flux-system
- version: 2.3.0
+ version: 2.4.1
install:
remediation:
retries: 3
interval: 30m
upgrade:
cleanupOnFail: true |
--- HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/clustergenerators.generators.external-secrets.io
+++ HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/clustergenerators.generators.external-secrets.io
@@ -1172,12 +1172,22 @@
type: boolean
controller:
description: |-
Used to select the correct ESO controller (think: ingress.ingressClassName)
The ESO controller is instantiated with a specific controller name and filters VDS based on this property
type: string
+ getParameters:
+ additionalProperties:
+ items:
+ type: string
+ type: array
+ description: |-
+ GetParameters are query-string parameters passed to Vault on GET calls.
+ Each key may map to multiple values, matching HTTP query-string semantics.
+ Ignored for non-GET methods; use Parameters for write bodies.
+ type: object
method:
description: Vault API method to use (GET/POST/other)
type: string
parameters:
description: Parameters to pass to Vault write (for non-GET
methods)
--- HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/clustersecretstores.external-secrets.io
+++ HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/clustersecretstores.external-secrets.io
@@ -1898,12 +1898,17 @@
This is NOT RECOMMENDED for production use.
Set to true only if you understand the security implications.
type: boolean
serverUrl:
description: ServerURL is the DVLS instance URL (e.g., https://dvls.example.com).
type: string
+ vault:
+ description: |-
+ Vault is the name or UUID of the vault to fetch secrets from.
+ When omitted, the vault must be specified in the secret key using the legacy format "<vault-id>/<entry-id>".
+ type: string
required:
- auth
- serverUrl
type: object
fake:
description: Fake configures a store with static key/value pairs
@@ -3345,12 +3350,14 @@
minLength: 1
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
type: object
folderID:
type: string
+ getByTitleFallback:
+ type: boolean
required:
- authRef
- folderID
type: object
kubernetes:
description: Kubernetes configures this store to sync secrets
@@ -4378,12 +4385,56 @@
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
type: object
required:
- passwordSecretRef
- privateKeySecretRef
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Passbolt server certificate. Only used
+ if the Host URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate
+ Passbolt server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found
+ in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider
+ type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret",
+ or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
type: object
host:
description: Host defines the Passbolt Server to connect to
type: string
required:
- auth
--- HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/secretstores.external-secrets.io
+++ HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/secretstores.external-secrets.io
@@ -1898,12 +1898,17 @@
This is NOT RECOMMENDED for production use.
Set to true only if you understand the security implications.
type: boolean
serverUrl:
description: ServerURL is the DVLS instance URL (e.g., https://dvls.example.com).
type: string
+ vault:
+ description: |-
+ Vault is the name or UUID of the vault to fetch secrets from.
+ When omitted, the vault must be specified in the secret key using the legacy format "<vault-id>/<entry-id>".
+ type: string
required:
- auth
- serverUrl
type: object
fake:
description: Fake configures a store with static key/value pairs
@@ -3345,12 +3350,14 @@
minLength: 1
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
type: object
folderID:
type: string
+ getByTitleFallback:
+ type: boolean
required:
- authRef
- folderID
type: object
kubernetes:
description: Kubernetes configures this store to sync secrets
@@ -4378,12 +4385,56 @@
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
type: object
required:
- passwordSecretRef
- privateKeySecretRef
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Passbolt server certificate. Only used
+ if the Host URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate
+ Passbolt server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found
+ in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider
+ type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret",
+ or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
type: object
host:
description: Host defines the Passbolt Server to connect to
type: string
required:
- auth
--- HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/vaultdynamicsecrets.generators.external-secrets.io
+++ HelmRelease: secrets/external-secrets CustomResourceDefinition: secrets/vaultdynamicsecrets.generators.external-secrets.io
@@ -52,12 +52,22 @@
type: boolean
controller:
description: |-
Used to select the correct ESO controller (think: ingress.ingressClassName)
The ESO controller is instantiated with a specific controller name and filters VDS based on this property
type: string
+ getParameters:
+ additionalProperties:
+ items:
+ type: string
+ type: array
+ description: |-
+ GetParameters are query-string parameters passed to Vault on GET calls.
+ Each key may map to multiple values, matching HTTP query-string semantics.
+ Ignored for non-GET methods; use Parameters for write bodies.
+ type: object
method:
description: Vault API method to use (GET/POST/other)
type: string
parameters:
description: Parameters to pass to Vault write (for non-GET methods)
x-kubernetes-preserve-unknown-fields: true
--- HelmRelease: secrets/external-secrets Deployment: secrets/external-secrets-cert-controller
+++ HelmRelease: secrets/external-secrets Deployment: secrets/external-secrets-cert-controller
@@ -34,13 +34,13 @@
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
- image: ghcr.io/external-secrets/external-secrets:v2.3.0
+ image: ghcr.io/external-secrets/external-secrets:v2.4.1
imagePullPolicy: IfNotPresent
args:
- certcontroller
- --crd-requeue-interval=5m
- --service-name=external-secrets-webhook
- --service-namespace=secrets
@@ -62,7 +62,10 @@
readinessProbe:
httpGet:
port: ready
path: /readyz
initialDelaySeconds: 20
periodSeconds: 5
+ timeoutSeconds: 5
+ failureThreshold: 3
+ successThreshold: 1
--- HelmRelease: secrets/external-secrets Deployment: secrets/external-secrets
+++ HelmRelease: secrets/external-secrets Deployment: secrets/external-secrets
@@ -34,13 +34,13 @@
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
- image: ghcr.io/external-secrets/external-secrets:v2.3.0
+ image: ghcr.io/external-secrets/external-secrets:v2.4.1
imagePullPolicy: IfNotPresent
args:
- --enable-leader-election=true
- --concurrent=1
- --metrics-addr=:8080
- --loglevel=info
--- HelmRelease: secrets/external-secrets Deployment: secrets/external-secrets-webhook
+++ HelmRelease: secrets/external-secrets Deployment: secrets/external-secrets-webhook
@@ -34,13 +34,13 @@
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
- image: ghcr.io/external-secrets/external-secrets:v2.3.0
+ image: ghcr.io/external-secrets/external-secrets:v2.4.1
imagePullPolicy: IfNotPresent
args:
- webhook
- --port=10250
- --dns-name=external-secrets-webhook.secrets.svc
- --cert-dir=/tmp/certs
@@ -62,12 +62,15 @@
readinessProbe:
httpGet:
port: ready
path: /readyz
initialDelaySeconds: 20
periodSeconds: 5
+ timeoutSeconds: 5
+ failureThreshold: 3
+ successThreshold: 1
volumeMounts:
- name: certs
mountPath: /tmp/certs
readOnly: true
volumes:
- name: certs
--- HelmRelease: secrets/external-secrets ValidatingWebhookConfiguration: secrets/secretstore-validate
+++ HelmRelease: secrets/external-secrets ValidatingWebhookConfiguration: secrets/secretstore-validate
@@ -53,7 +53,8 @@
path: /validate-external-secrets-io-v1-clustersecretstore
admissionReviewVersions:
- v1
- v1beta1
sideEffects: None
timeoutSeconds: 5
+ failurePolicy: Fail
|
renovate
Bot
force-pushed
the
renovate/external-secrets-2.x
branch
from
May 5, 2026 06:17
59420aa to
e952a4e
Compare
bo0tzz
approved these changes
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.3.0→2.4.1Release Notes
external-secrets/external-secrets (external-secrets)
v2.4.1Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.4.1Image:
ghcr.io/external-secrets/external-secrets:v2.4.1-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.4.1-ubi-boringsslWhat's Changed
General
Dependencies
f853308tof853308by @dependabot[bot] in #62822510918to5b10f43in /hack/api-docs by @dependabot[bot] in #6285cf13fe2tofd3612eby @dependabot[bot] in #6281Full Changelog: external-secrets/external-secrets@v2.4.0...v2.4.1
v2.4.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.4.0Image:
ghcr.io/external-secrets/external-secrets:v2.4.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.4.0-ubi-boringsslWhat's Changed
General
Dependencies
c2a1f7btoc2a1f7bby @dependabot[bot] in #62149e6e193to039095fby @dependabot[bot] in #6213c2a1f7btof853308by @dependabot[bot] in #62522510918to5b10f43by @dependabot[bot] in #6251039095ftocf13fe2by @dependabot[bot] in #6253New Contributors
Full Changelog: external-secrets/external-secrets@v2.3.0...v2.4.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.