Repository navigation
Update Helm release external-secrets to v2.12.0 - #358
Merged
Merged
Conversation
Argo CD Diff PreviewSummary: Modified (1):
± sandbox-oci-external-secrets (+508|-4)sandbox-oci-external-secrets (applications/appset-ops-tools.yaml)Deployment: external-secrets/sandbox-oci-external-secrets - --metrics-addr=:8080
- --loglevel=info
- --zap-time-encoding=epoch
- image: ghcr.io/external-secrets/external-secrets:v2.11.0
+ image: ghcr.io/external-secrets/external-secrets:v2.12.0
imagePullPolicy: IfNotPresent
name: external-secrets
ports:Deployment: external-secrets/sandbox-oci-external-secrets-cert-controller - --loglevel=info
- --zap-time-encoding=epoch
- --enable-partial-cache=true
- image: ghcr.io/external-secrets/external-secrets:v2.11.0
+ image: ghcr.io/external-secrets/external-secrets:v2.12.0
imagePullPolicy: IfNotPresent
name: cert-controller
ports:Deployment: external-secrets/sandbox-oci-external-secrets-webhook - --healthz-addr=:8081
- --loglevel=info
- --zap-time-encoding=epoch
- image: ghcr.io/external-secrets/external-secrets:v2.11.0
+ image: ghcr.io/external-secrets/external-secrets:v2.12.0
imagePullPolicy: IfNotPresent
name: webhook
ports:CustomResourceDefinition: clustergenerators.generators.external-secrets.io default: false
description: Set NoUpper to disable uppercase characters
type: boolean
+ prefix:
+ description: |-
+ Prefix is prepended to every generated password after encoding.
+ It is not counted in length or subject to the character settings.
+ type: string
secretKeys:
description: |-
SecretKeys defines the keys that will be populated with generated passwords.
Defaults to "password" when not set.
items:
type: string
minItems: 1
type: array
+ suffix:
+ description: |-
+ Suffix is appended to every generated password after encoding.
+ It is not counted in length or subject to the character settings.
+ type: string
symbolCharacters:
description: |-
SymbolCharacters specifies the special characters that should be usedCustomResourceDefinition: clustersecretstores.external-secrets.io - apiKeyRef
- userRef
type: object
+ azure:
+ description: Azure enables authentication to Conjur via
+ the authn-azure authenticator.
+ properties:
+ account:
+ description: Account is the Conjur organization account
+ name.
+ type: string
+ clientId:
+ description: |-
+ ClientID is the Azure managed identity client ID. Required for user-assigned
+ managed identities; omit for system-assigned identities.
+ type: string
+ hostId:
+ description: |-
+ HostID is the Conjur host mapped to the Azure managed identity
+ (e.g. "data/myapp/myhost").
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specifies the Kubernetes service account for which to request
+ a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+ authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ Some providers automatically extend the audience field based on well-known annotations for workload
+ identity (e.g. IRSA or GCP Workload Identity)
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ serviceID:
+ description: ServiceID is the Conjur authn-azure webservice
+ identifier (e.g. "prod").
+ type: string
+ required:
+ - account
+ - hostId
+ - serviceID
+ type: object
cert:
description: Cert enables certificate-based authentication
using a client certificate and key.
@@ skipped 71 lines (1824 -> 1894) @@
- account
- clientCertRef
- clientKeyRef
+ - serviceID
+ type: object
+ gcp:
+ description: GCP enables authentication to Conjur via
+ the authn-gcp authenticator.
+ properties:
+ account:
+ description: Account is the Conjur organization account
+ name.
+ type: string
+ hostId:
+ description: |-
+ HostID is the Conjur host mapped to the GCP service account
+ (e.g. "data/myapp/myhost").
+ type: string
+ secretRef:
+ description: |-
+ SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+ GCP identity token. If omitted, the token is fetched from the GCP Metadata
+ Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+ properties:
+ jwt:
+ description: JWT is a reference to the Kubernetes
+ Secret key holding the GCP identity token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - jwt
+ type: object
+ serviceID:
+ description: |-
+ ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+ Note: Conjur's authn-gcp authenticator does not include the service ID in the
+ authentication URL; this field is reserved for future use.
+ type: string
+ required:
+ - account
+ - hostId
+ type: object
+ iam:
+ description: IAM enables authentication to Conjur via
+ the authn-iam authenticator.
+ properties:
+ account:
+ description: Account is the Conjur organization account
+ name.
+ type: string
+ hostId:
+ description: |-
+ HostID is the Conjur host mapped to the AWS IAM role
+ (e.g. "data/myapp/123456789012/MyRole").
+ type: string
+ insecure:
+ description: |-
+ Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+ sends a signed request as a bearer credential, so this should only be enabled when the
+ connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+ type: boolean
+ secretRef:
+ description: |-
+ SecretRef holds optional references to Kubernetes Secrets containing explicit
+ AWS credentials. If omitted, the default AWS SDK credential chain is used
+ (IRSA, instance metadata, environment variables, etc.).
+ properties:
+ accessKeyIDSecretRef:
+ description: A reference to a Secret key containing
+ the AWS Access Key ID.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: A reference to a Secret key containing
+ the AWS Secret Access Key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ A reference to a Secret key containing the AWS Session Token.
+ Required only when using temporary credentials.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - secretAccessKeySecretRef
+ type: object
+ serviceID:
+ description: ServiceID is the Conjur authn-iam webservice
+ identifier (e.g. "prod").
+ type: string
+ required:
+ - account
+ - hostId
- serviceID
type: object
jwt:CustomResourceDefinition: passwords.generators.external-secrets.io default: false
description: Set NoUpper to disable uppercase characters
type: boolean
+ prefix:
+ description: |-
+ Prefix is prepended to every generated password after encoding.
+ It is not counted in length or subject to the character settings.
+ type: string
secretKeys:
description: |-
SecretKeys defines the keys that will be populated with generated passwords.
Defaults to "password" when not set.
items:
type: string
minItems: 1
type: array
+ suffix:
+ description: |-
+ Suffix is appended to every generated password after encoding.
+ It is not counted in length or subject to the character settings.
+ type: string
symbolCharacters:
description: |-
SymbolCharacters specifies the special characters that should be usedCustomResourceDefinition: secretstores.external-secrets.io - apiKeyRef
- userRef
type: object
+ azure:
+ description: Azure enables authentication to Conjur via
+ the authn-azure authenticator.
+ properties:
+ account:
+ description: Account is the Conjur organization account
+ name.
+ type: string
+ clientId:
+ description: |-
+ ClientID is the Azure managed identity client ID. Required for user-assigned
+ managed identities; omit for system-assigned identities.
+ type: string
+ hostId:
+ description: |-
+ HostID is the Conjur host mapped to the Azure managed identity
+ (e.g. "data/myapp/myhost").
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specifies the Kubernetes service account for which to request
+ a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+ authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ Some providers automatically extend the audience field based on well-known annotations for workload
+ identity (e.g. IRSA or GCP Workload Identity)
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ serviceID:
+ description: ServiceID is the Conjur authn-azure webservice
+ identifier (e.g. "prod").
+ type: string
+ required:
+ - account
+ - hostId
+ - serviceID
+ type: object
cert:
description: Cert enables certificate-based authentication
using a client certificate and key.
@@ skipped 71 lines (1824 -> 1894) @@
- account
- clientCertRef
- clientKeyRef
+ - serviceID
+ type: object
+ gcp:
+ description: GCP enables authentication to Conjur via
+ the authn-gcp authenticator.
+ properties:
+ account:
+ description: Account is the Conjur organization account
+ name.
+ type: string
+ hostId:
+ description: |-
+ HostID is the Conjur host mapped to the GCP service account
+ (e.g. "data/myapp/myhost").
+ type: string
+ secretRef:
+ description: |-
+ SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+ GCP identity token. If omitted, the token is fetched from the GCP Metadata
+ Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+ properties:
+ jwt:
+ description: JWT is a reference to the Kubernetes
+ Secret key holding the GCP identity token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - jwt
+ type: object
+ serviceID:
+ description: |-
+ ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+ Note: Conjur's authn-gcp authenticator does not include the service ID in the
+ authentication URL; this field is reserved for future use.
+ type: string
+ required:
+ - account
+ - hostId
+ type: object
+ iam:
+ description: IAM enables authentication to Conjur via
+ the authn-iam authenticator.
+ properties:
+ account:
+ description: Account is the Conjur organization account
+ name.
+ type: string
+ hostId:
+ description: |-
+ HostID is the Conjur host mapped to the AWS IAM role
+ (e.g. "data/myapp/123456789012/MyRole").
+ type: string
+ insecure:
+ description: |-
+ Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+ sends a signed request as a bearer credential, so this should only be enabled when the
+ connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+ type: boolean
+ secretRef:
+ description: |-
+ SecretRef holds optional references to Kubernetes Secrets containing explicit
+ AWS credentials. If omitted, the default AWS SDK credential chain is used
+ (IRSA, instance metadata, environment variables, etc.).
+ properties:
+ accessKeyIDSecretRef:
+ description: A reference to a Secret key containing
+ the AWS Access Key ID.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: A reference to a Secret key containing
+ the AWS Secret Access Key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ A reference to a Secret key containing the AWS Session Token.
+ Required only when using temporary credentials.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource
+ being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - secretAccessKeySecretRef
+ type: object
+ serviceID:
+ description: ServiceID is the Conjur authn-iam webservice
+ identifier (e.g. "prod").
+ type: string
+ required:
+ - account
+ - hostId
- serviceID
type: object
jwt:CustomResourceDefinition: uuids.generators.external-secrets.io - name: v1alpha1
schema:
openAPIV3Schema:
- description: UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216).
+ description: UUID generates a version 4 UUID (21061816-abbd-40ef-8985-6db0fbcbc4c4).
properties:
apiVersion:
description: |-Stats: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.11.0→2.12.0Release Notes
external-secrets/external-secrets (external-secrets)
v2.12.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v2.12.0Image:
ghcr.io/external-secrets/external-secrets:v2.12.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v2.12.0-ubi-boringsslWhat's Changed
General
Dependencies
c5cc9c2toa4b9ec0by @dependabot[bot] in #7001648f440to69a7b97in /e2e by @dependabot[bot] in #704428bd5feto294b683by @dependabot[bot] in #704228bd5feto294b683in /hack/api-docs by @dependabot[bot] in #7045a4b9ec0to7a38d75by @dependabot[bot] in #7041f2ea270to5813399by @dependabot[bot] in #69577a38d75to803a35aby @dependabot[bot] in #7079New Contributors
Full Changelog: external-secrets/external-secrets@v2.11.0...v2.12.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.