Our company is using External Secrets to push secrets from Kubernetes to Google Secret Manager. However, the security team has implemented a GCP organization policy that restricts writing secrets to a global scope. Secrets must be stored in specific authorized zones. Unfortunately, when using PushSecret with External Secrets, it attempts to write the secret to Secret Manager at a global level. Due to the organization policy, this write operation fails, and the secret remains unsaved.

To address this issue, the ideal solution would be to allow specifying the target zone or region within the SecretStore configuration. This would enable PushSecret to write the secret to one of the authorized zones, complying with the security policy and successfully storing the secret.