chore(chart-deps): update external-secrets to version 2.8.0 - #3502
Draft
svcAPLBot wants to merge 2 commits into
Draft
chore(chart-deps): update external-secrets to version 2.8.0#3502svcAPLBot wants to merge 2 commits into
svcAPLBot wants to merge 2 commits into
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
This PR bumps the vendored external-secrets Helm chart/dependency to 2.8.0 and aligns the chart’s defaults, schema, templates, and generated CRDs/README with the upstream release.
Changes:
- Updated chart/dependency versions to 2.8.0 (Chart.yaml, dependencies.yaml, README badge).
- Added new configuration surface (leader election timing flags, network policies, webhook startupProbe) and updated templates/schema accordingly.
- Refreshed generated CRDs and RBAC resources to include new/updated generator types and spec validations.
Reviewed changes
Copilot reviewed 27 out of 27 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| charts/external-secrets/values.yaml | Adds new values for leader election timing, network policies, webhook startupProbe; updates certController startupProbe fields. |
| charts/external-secrets/values.schema.json | Extends Helm values schema to cover newly added values (networkPolicy, leader election fields, startupProbe updates, RBAC aggregateToAdmin). |
| charts/external-secrets/templates/webhook-networkpolicy.yaml | New template to optionally render a webhook NetworkPolicy. |
| charts/external-secrets/templates/webhook-deployment.yaml | Adds optional webhook startupProbe rendering. |
| charts/external-secrets/templates/rbac.yaml | Adds gitlabdeploytokens generator resource and makes aggregate-to-admin conditional. |
| charts/external-secrets/templates/networkpolicy.yaml | New template to optionally render the controller NetworkPolicy. |
| charts/external-secrets/templates/deployment.yaml | Adds leader election timing flags when configured. |
| charts/external-secrets/templates/crds/secretstore.yaml | Updates CRD template schema (new fields/validations/providers). |
| charts/external-secrets/templates/crds/pushsecret.yaml | Adds GitlabDeployToken generator enum value. |
| charts/external-secrets/templates/crds/grafana.yaml | Adds secondsToLive to grafana generator schema. |
| charts/external-secrets/templates/crds/gitlabdeploytoken.yaml | New CRD template for GitlabDeployToken generator. |
| charts/external-secrets/templates/crds/externalsecret.yaml | Adds GitlabDeployToken enum + CreateOrMerge policy enum. |
| charts/external-secrets/templates/crds/clustersecretstore.yaml | Updates CRD template schema (new fields/validations/providers). |
| charts/external-secrets/templates/crds/clusterpushsecret.yaml | Adds GitlabDeployToken generator enum value. |
| charts/external-secrets/templates/crds/clustergenerator.yaml | Adds GitlabDeployTokenSpec and secondsToLive support + enum updates. |
| charts/external-secrets/templates/crds/clusterexternalsecret.yaml | Adds GitlabDeployToken enum + CreateOrMerge policy enum. |
| charts/external-secrets/templates/cert-controller-networkpolicy.yaml | New template to optionally render the certController NetworkPolicy. |
| charts/external-secrets/templates/cert-controller-deployment.yaml | Aligns startupProbe rendering with new values (timings/failureThreshold) and removes separate startup port. |
| charts/external-secrets/README.md | Regenerated chart README for 2.8.0 values/metadata. |
| charts/external-secrets/crds/secretstore.yaml | Updated rendered CRD output to match new upstream schema. |
| charts/external-secrets/crds/pushsecret.yaml | Updated rendered CRD output enum. |
| charts/external-secrets/crds/grafana.yaml | Updated rendered CRD output with secondsToLive. |
| charts/external-secrets/crds/gitlabdeploytoken.yaml | New rendered CRD output for GitlabDeployToken generator. |
| charts/external-secrets/crds/externalsecret.yaml | Updated rendered CRD output enums. |
| charts/external-secrets/crds/clustersecretstore.yaml | Updated rendered CRD output to match new upstream schema. |
| charts/external-secrets/Chart.yaml | Bumps appVersion/version to 2.8.0. |
| charts/dependencies.yaml | Bumps external-secrets dependency version to 2.8.0. |
Comment on lines
+13
to
+27
| spec: | ||
| egress: | ||
| {{- with .Values.webhook.networkPolicy.egress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| ingress: | ||
| {{- with .Values.webhook.networkPolicy.ingress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }} | ||
| policyTypes: | ||
| - Egress | ||
| - Ingress |
Comment on lines
825
to
826
| # -- Pod priority class name. | ||
| priorityClassName: "" |
Comment on lines
+13
to
+27
| spec: | ||
| egress: | ||
| {{- with .Values.networkPolicy.egress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| ingress: | ||
| {{- with .Values.networkPolicy.ingress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| {{- include "external-secrets.selectorLabels" . | nindent 6 }} | ||
| policyTypes: | ||
| - Egress | ||
| - Ingress |
Comment on lines
+13
to
+27
| spec: | ||
| egress: | ||
| {{- with .Values.certController.networkPolicy.egress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| ingress: | ||
| {{- with .Values.certController.networkPolicy.ingress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 6 }} | ||
| policyTypes: | ||
| - Egress | ||
| - Ingress |
Comment on lines
1
to
3
| apiVersion: v2 | ||
| appVersion: v2.7.0 | ||
| appVersion: v2.8.0 | ||
| dependencies: |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.
Suppressed comments (5)
charts/external-secrets/templates/networkpolicy.yaml:21
- When
.Values.networkPolicy.egress/ingressis an empty list, the surroundingwithblock renders nothing, leavingegress:/ingress:with a null value. This can produce an invalid NetworkPolicy manifest (arrays rendered as null) when users enable the NetworkPolicy but keep defaults (egress defaults to[]). Render the lists unconditionally so empty lists become[](or omit the key entirely).
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:21
- When
.Values.webhook.networkPolicy.egress/ingressis an empty list, the surroundingwithblock renders nothing, leavingegress:/ingress:with a null value. This can produce an invalid NetworkPolicy manifest (arrays rendered as null) when users enable the NetworkPolicy but keep defaults (egress defaults to[]). Render the lists unconditionally so empty lists become[](or omit the key entirely).
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.webhook.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/values.yaml:826
- The
# -- Pod priority class name.doc comment is indented as if it belongs undercertController.networkPolicy, but thepriorityClassNamekey is at thecertControllerlevel. This breaks doc extraction (seen in the generated README wherecertController.priorityClassNameloses its description). Align the comment indentation with the key.
# -- Pod priority class name.
priorityClassName: ""
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:21
- When
.Values.certController.networkPolicy.egress/ingressis an empty list, the surroundingwithblock renders nothing, leavingegress:/ingress:with a null value. This can produce an invalid NetworkPolicy manifest (arrays rendered as null) when users enable the NetworkPolicy but keep defaults (egress defaults to[]). Render the lists unconditionally so empty lists become[](or omit the key entirely).
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.certController.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/dependencies.yaml:32
- The PR description mentions "TODO: Update app version in apps.yaml", but this PR doesn't update
apps.yamland the repo's/apps.yamlcurrently has noexternal-secretsentry to update. Please either update the correct version source referenced by the TODO, add the missing entry, or remove/clarify the TODO in the PR description to avoid confusion about remaining work.
version: 2.8.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates the dependency external-secrets to version 2.8.0.
TODO: Update app version in apps.yaml.