feat: add support for GCP Workload Identity Federation by bharath-b-rh · Pull Request #4654 · external-secrets/external-secrets

bharath-b-rh · 2025-04-14T11:34:41Z

Problem Statement

PR adds support for Workload Identity Federation in GCP SecretStore.

Related Issue

Proposed Changes

The GCP SecretStore API is updated with new auth field for configuring the Workload Identity Federation similar to existing Workload Identity. In which an user can configure the audience value to be used to obtain the STS and the configmap reference containing the external_account type credential configuration in json format.

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

sonarqubecloud · 2025-04-14T11:36:39Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

torfjor · 2025-04-21T17:00:25Z

I don't see why we need this. Both in terms of functionality and API surface. The identity used for the token exchange will in this case always be that of the controller Pod's ServiceAccount. Having the option to reference multiple external account credentials doesn't result in any significant improvement in terms of tenant isolation or security, as the identity used for accessing the API is identical.

If you provide a unique ESO instance to tenant namespaces, you can achieve what this PR implements by supplying adc to the controller Pod:

# kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: external-secrets
helmCharts:
  - includeCRDs: true
    name: external-secrets
    releaseName: external-secrets
    repo: https://charts.external-secrets.io
    version: 0.16.1
resources:
  - store.yaml
  - externalsecret.yaml
configMapGenerator:
  - name: adc
    options:
      disableNameSuffixHash: true
    literals:
      - |-
        adc.json={
          "type": "external_account",
          "audience": "//iam.googleapis.com/projects/PROJECT_ID/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID",
          "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
          "token_url": "https://sts.googleapis.com/v1/token",
          "credential_source": {
            "file": "/var/run/secrets/credentials/token",
            "format": {
              "type": "text"
            }
          }
        }
patches:
  - target:
      kind: Deployment
      name: external-secrets
    patch: |-
      - op: add
        path: /spec/template/spec/containers/0/env
        value:
          - name: GOOGLE_APPLICATION_CREDENTIALS
            value: /var/run/secrets/credentials/adc.json
      - op: add
        path: /spec/template/spec/containers/0/volumeMounts
        value:
          - name: credentials
            mountPath: /var/run/secrets/credentials
      - op: add
        path: /spec/template/spec/volumes
        value:
          - name: credentials
            projected:
              defaultMode: 420
              sources:
              - serviceAccountToken:
                  path: token
                  audience: "https://iam.googleapis.com/projects/PROJECT_ID/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID"
                  expirationSeconds: 172800
              - configMap:
                  name: adc
                  items:
                    - key: adc.json

For the ESO-as-a-service model, we just need a way to override the identity provider and pool (audience) like mentioned here.

dronenb · 2025-04-21T21:11:30Z

For ESO as a service / multitenancy, you should only need to provide the projectID, provider and pool, as well as the service account reference, and an optional audience (not all workload identity pools use the default audience, some have custom), so that ESO can create a tokenRequest for the service account in the tenant's namespace, then perform the token exchange using the tenant's service account token rather than the controller.

Tenants should not be using the controller's token, since that would mean that any namespace in the cluster would have access to any secret the controller has access to.

Should be similar to how it works for secrets store CSI driver: GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp#459

gusfcarvalho · 2025-04-21T22:24:26Z

Tenants should not be using the controller's token, since that would mean that any namespace in the cluster would have access to any secret the controller has access to.

I generally agree with this logic ☝️. TBH, I think just allowing for 'ServiceAccountRef' to provide an Audience, plus the scope for the workload Identity pools should be enough.

bharath-b-rh · 2025-04-25T14:45:04Z

Should we add ServiceAccountRef only for the generators? So that in the providers where its just for controller makes use of own service account and in generators indicated ServiceAccount will be used for getting the tokens?

gusfcarvalho · 2025-04-27T00:35:30Z

Should we add ServiceAccountRef only for the generators? So that in the providers where its just for controller makes use of own service account and in generators indicated ServiceAccount will be used for getting the tokens?

I'm not sure if I follow. Do you have an example?

sonarqubecloud · 2025-05-21T10:20:44Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

bharath-b-rh · 2025-05-21T10:33:30Z

I apologize for the delay. I couldn't work on this issue at the intended pace.

I'm not sure if I follow. Do you have an example?

@gusfcarvalho Would having two config options like here in secretstore and generators be feasible? For secret store since it's only used by the operator, own service account will be used and for a generating a token using generators user provided service account will be used.

y4ri · 2025-05-28T16:55:15Z

Thank you for this patch. My use case is to produce username and password in a secret for crossplane helm provider to pull charts from Google Artifact Registry. I have Crossplane running on AWS, using GCP Workload Identity Federation for GCP providers. Thanks to your work here, that same identity setup can now be used by the Helm provider to pull charts as well. I hope this will be merged soon. Cheers!

alexandrst88 · 2025-07-10T11:15:27Z

Hi! Will this feature be merged soon, it will help to interact with Google Artifact Registry from other clouds like AWS and others? I have the similar use case as @y4ri.

bharath-b-rh · 2025-07-10T13:25:47Z

Apologies for the delay. I'll prioritize this work this week.

bharath-b-rh · 2025-07-22T18:41:39Z

@gusfcarvalho During a discussion about this issue in a community call, suggestion I received was to extend GCPWorkloadIdentity to include PoolID, PoolProvider and Audience params, but I think with that we will be able to support only Kubernetes WIF provider and other scenarios like @y4ri , @alexandrst88 has mentioned wouldn't be supported.
I think adding new GCPWorkloadIdentityFederation with a param to configure the credentials config would cover most WIF providers. I have updated the PR with new changes, please take a look and let me know what you think.

Makefile

hack/api-docs/Makefile

pkg/provider/gcp/secretmanager/workload_identity.go

bharath-b-rh · 2025-07-23T07:56:54Z

apis/externalsecrets/v1/secretstore_gcpsm_types.go

+	// credential_source.url in the provided credConfig. This field is merely to double-check the external token source
+	// URL is having the expected value.
+	// +kubebuilder:validation:Optional
+	ExternalTokenEndpoint string `json:"externalTokenEndpoint,omitempty"`


When credentials config has a URL configured in credential_source, which could be self created service to issue tokens, I thought to make use of ExternalTokenEndpoint to assert user knows about the configuration. I am not sure if it's really required though :)

gusfcarvalho · 2025-08-21T09:57:57Z

@bharath-b-rh - can you make sure the CI tests pass? 😄 I think there are no other changes aside from making sure everything works

apis/externalsecrets/v1/secretstore_gcpsm_types.go

bharath-b-rh · 2025-08-25T13:44:59Z

@bharath-b-rh - can you make sure the CI tests pass? 😄 I think there are no other changes aside from making sure everything works

@gusfcarvalho I have captured list of test scenarios with the outputs in a github gist here. PTAL. Thank you!

pkg/provider/gcp/secretmanager/workload_identity_federation.go

…upport Signed-off-by: Bharath B <bhb@redhat.com>

…port Signed-off-by: Bharath B <bhb@redhat.com>

hack/api-docs/Makefile

Skarlso

Just initial thoughts and comments for now. :)

apis/externalsecrets/v1/secretstore_gcpsm_types.go

Skarlso · 2025-08-28T05:41:39Z

apis/externalsecrets/v1/secretstore_gcpsm_types.go

+	// +kubebuilder:validation:Optional
+	Namespace string `json:"namespace,omitempty"`
+
+	// key name holding the external account credential config. If empty, a key in the configmap will be used.


I'm not sure I understand this comment about if empty a configmap key will be used. Could you add an example please?

I had a condition in code, when a key is not provided, to use the first key read in map, just with the intention not fix the name for key or user must have to provide it. I will word it better.

Is that a good thing? Shouldn't rather the key be mandatory? Like, this is behind the scenes behaviour that might catch people off guard when suddenly, by default, the first key is used without warning. WDYT?

Yeah, I agree, will update it make it mandatory.

apis/externalsecrets/v1/secretstore_gcpsm_types.go

bharath-b-rh · 2025-08-28T14:59:32Z

@Skarlso In case of ClusterGenerator, only in GCPSM we are reusing method for obtaining the TokenSource, unlike other providers where the logic for obtaining token is defined in the generator package. And the checks for if not cluster scoped resource look for referenced resources in same ExternalSecret namespace isn't used.
In GCPSM this check will not match for ClusterGenerators and we have to create the referenced objects in the same namespace as of ExternalSecrets, and this is not expected, correct?

gusfcarvalho · 2025-08-28T15:46:35Z

@Skarlso In case of ClusterGenerator, only in GCPSM we are reusing method for obtaining the TokenSource, unlike other providers where the logic for obtaining token is defined in the generator package.

I think both AWS and Azure registry token generators are leveraging common auth with their providers.

I would expect this to be the way to go when generators are driven from a common provider

Or did you mean something else I failed to understand? 😄

Skarlso · 2025-08-29T05:08:13Z

@bharath-b-rh Technically, the Generator should not be aware that it is in fact a ClusterGenerator, because it creates a virtual Generator that is effectively a Generator. :) Basically, a ClusterGenerator type is never asserted anywhere because it should always be just a Generator if that makes sense?

bharath-b-rh · 2025-08-29T07:59:57Z

@Skarlso Ah ok, I get it now. When I read the code and the comments, I thought it was mainly for extracting the embedded generator type, it makes sense now.

@gusfcarvalho I should have worded it better, what I meant to say was the GCPSM implementation we can't distinguish for what scenario auth is invoked, like though SecretStore, GCRAccessToken or ClusterGenerator. Basically I was looking if we could make that. Because I read this limitation on ClusterGenerator and I was thinking does it apply for reading the referenced objects too, like Secrets, ServiceAccounts etc...
And I was looking if there is a way to solve it, and my comment was coming from code changes pov :) Sorry for the confusions.

So ClusterGenerators are cluster scoped in existence terms, but the embedded generators are all namespaced variants, and hence every behavior should align with it.

Do we need an update to the limitation section in the docs? To mention referenced objects in the embedded types should also reside in the ExternalSecrets namespace.

Skarlso · 2025-08-29T18:35:33Z

@bharath-b-rh we can if it's not already mentioned.

apis/externalsecrets/v1/secretstore_gcpsm_types.go

…ecrets into issue-1038

Signed-off-by: Bharath B <bhb@redhat.com>

Skarlso · 2025-09-03T05:23:01Z

Please run make helm.test.update and commit the diff. :) 🙇

Skarlso · 2025-09-03T05:41:44Z

Looks okay to me now after the make targets are run this can be merged. :)

Skarlso · 2025-09-03T05:42:13Z

Oh, and also, could you show a successful run using this feature please? 🙇
Edit: #4654 (comment)

This should be good enough.

sonarqubecloud · 2025-09-03T15:44:38Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `0.19.2` -> `0.20.1` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v0.20.1`](https://github.com/external-secrets/external-secrets/releases/tag/v0.20.1) [Compare Source](external-secrets/external-secrets@v0.19.2...v0.20.1) Image: `ghcr.io/external-secrets/external-secrets:v0.20.1` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl`  #### What's Changed ##### General - chore: release 0.19.2 by [@moolen](https://github.com/moolen) in [#5136](external-secrets/external-secrets#5136) - chore: update readme by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5137](external-secrets/external-secrets#5137) - fix(kubernetes): make auth field optional by [@mhrabovcin](https://github.com/mhrabovcin) in [#5064](external-secrets/external-secrets#5064) - chore: Fix Markdown spelling issues found by codespell by [@mjtrangoni](https://github.com/mjtrangoni) in [#5139](external-secrets/external-secrets#5139) - Fix yaml codeblock for oracle-vault provider docs by [@muckelba](https://github.com/muckelba) in [#5146](external-secrets/external-secrets#5146) - feat: add liveness probe to eso controller by [@Skarlso](https://github.com/Skarlso) in [#4930](external-secrets/external-secrets#4930) - fix(helm): add boolean for processClusterGenerator by [@DrummyFloyd](https://github.com/DrummyFloyd) in [#5144](external-secrets/external-secrets#5144) - chore: add Cisco to ADOPTERS.md by [@sriaradhyula](https://github.com/sriaradhyula) in [#5159](external-secrets/external-secrets#5159) - docs: Fix provider stability and support table by [@jonstacks](https://github.com/jonstacks) in [#5161](external-secrets/external-secrets#5161) - feat(helm): Add control of response to missing prometheus CRDs by [@jcpunk](https://github.com/jcpunk) in [#5087](external-secrets/external-secrets#5087) - chore: Added release notes configuration by [@bonddim](https://github.com/bonddim) in [#5148](external-secrets/external-secrets#5148) - chore: bump bitwarden helm chart version by [@Skarlso](https://github.com/Skarlso) in [#5044](external-secrets/external-secrets#5044) - chore(docs): update `ADOPTERS.md` to include SAP by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5165](external-secrets/external-secrets#5165) - feat: add externalsecret namespace for webhook provider by [@matheusmazzoni](https://github.com/matheusmazzoni) in [#5155](external-secrets/external-secrets#5155) - fix: add unknown status for secret store by [@alvin-rw](https://github.com/alvin-rw) in [#5070](external-secrets/external-secrets#5070) - Fix pushing to an AWS Secrets Manager Secret when there are no secret values by [@nirajsapkota](https://github.com/nirajsapkota) in [#4878](external-secrets/external-secrets#4878) - add extralabels for dashboard to be scraped by multiple grafana instances by [@L1ghtman2k](https://github.com/L1ghtman2k) in [#5138](external-secrets/external-secrets#5138) - fix: the api docs are not referencing sshkey generator by [@Skarlso](https://github.com/Skarlso) in [#5170](external-secrets/external-secrets#5170) - Update github.md by [@gecube](https://github.com/gecube) in [#5171](external-secrets/external-secrets#5171) - Update anchore-engine-credentials.md by [@gecube](https://github.com/gecube) in [#5172](external-secrets/external-secrets#5172) - docs: update infisical docs to clarify missing system:auth-delegator need by [@Skarlso](https://github.com/Skarlso) in [#5174](external-secrets/external-secrets#5174) - Adding support different type auth sources by [@preved911](https://github.com/preved911) in [#4877](external-secrets/external-secrets#4877) - fix: stability update document did not update the stability table correctly by [@Skarlso](https://github.com/Skarlso) in [#5176](external-secrets/external-secrets#5176) - Add esv1.AnnotationForceSync for CES and ES by [@ntnn](https://github.com/ntnn) in [#5156](external-secrets/external-secrets#5156) - fix: helm build failing by [@Skarlso](https://github.com/Skarlso) in [#5178](external-secrets/external-secrets#5178) - fix: remove release- branch automation by [@moolen](https://github.com/moolen) in [#5182](external-secrets/external-secrets#5182) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5181](external-secrets/external-secrets#5181) - docs: update bitwarden documentation for dataFrom field usage by [@Skarlso](https://github.com/Skarlso) in [#5196](external-secrets/external-secrets#5196) - feat: add contributor ladder by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5150](external-secrets/external-secrets#5150) - feat: support vault provider check and set for push secrets by [@webstradev](https://github.com/webstradev) in [#5197](external-secrets/external-secrets#5197) - chore(docs): update helm charts by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5203](external-secrets/external-secrets#5203) - chore(ci): fix sonarqube security warnings in helm.yml by [@webstradev](https://github.com/webstradev) in [#5202](external-secrets/external-secrets#5202) - chore: add pull request maintenance auto labelling and sizes by [@Skarlso](https://github.com/Skarlso) in [#5200](external-secrets/external-secrets#5200) - fix: update the label verification step by [@Skarlso](https://github.com/Skarlso) in [#5209](external-secrets/external-secrets#5209) - feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by [@tuxtof](https://github.com/tuxtof) in [#5168](external-secrets/external-secrets#5168) - feat: improve error message for json marshalling/unmarshalling by [@webstradev](https://github.com/webstradev) in [#5211](external-secrets/external-secrets#5211) - chore: enhance `helm-values-schema-json` schema plugin management logic by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5212](external-secrets/external-secrets#5212) - fix(aws): stop incrementing the UUID for versions by [@Skarlso](https://github.com/Skarlso) in [#5175](external-secrets/external-secrets#5175) - feat: enable secure serving for metrics \[issue 4614] by [@rkferreira](https://github.com/rkferreira) in [#5169](external-secrets/external-secrets#5169) - fix(infisical): fix TokenAuth auth method by escaping the token revocation by [@arthlr](https://github.com/arthlr) in [#5217](external-secrets/external-secrets#5217) - fix: tilt build was failing to rebuild by [@Skarlso](https://github.com/Skarlso) in [#5225](external-secrets/external-secrets#5225) - feat: add selectable fields to the CRDs by [@Skarlso](https://github.com/Skarlso) in [#5226](external-secrets/external-secrets#5226) - ref: removing Yandex Cloud specific common types declaration duplication by [@preved911](https://github.com/preved911) in [#4905](external-secrets/external-secrets#4905) - fix: missing codeowners file from .github folder by [@Skarlso](https://github.com/Skarlso) in [#5228](external-secrets/external-secrets#5228) - feat: add setting remote namespace to metadata for kubernetes provider by [@Skarlso](https://github.com/Skarlso) in [#5224](external-secrets/external-secrets#5224) - feat: add support for certs only in pkcs12 by [@devnopt](https://github.com/devnopt) in [#4875](external-secrets/external-secrets#4875) - docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by [@ionicsolutions](https://github.com/ionicsolutions) in [#5208](external-secrets/external-secrets#5208) - feat: Allow adding finalizers from template by [@malovme](https://github.com/malovme) in [#5140](external-secrets/external-secrets#5140) - fix: controller-runtime update by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5239](external-secrets/external-secrets#5239) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5229](external-secrets/external-secrets#5229) - fix: Prevent secretstore reconcile loop when provider error response is dynamic by [@dakotaharden](https://github.com/dakotaharden) in [#5247](external-secrets/external-secrets#5247) - feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by [@matheusmazzoni](https://github.com/matheusmazzoni) in [#5163](external-secrets/external-secrets#5163) - fix: keepersecurity support for shortcuts by [@pepordev](https://github.com/pepordev) in [#5245](external-secrets/external-secrets#5245) - feat: add support for GCP Workload Identity Federation by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#4654](external-secrets/external-secrets#4654) - feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by [@alliseeisgold](https://github.com/alliseeisgold) in [#5022](external-secrets/external-secrets#5022) - chore(charts): Adds new make target for installing unittest plugin by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#5250](external-secrets/external-secrets#5250) - docs(templating): added clarifying comments to Github generator example by [@nielstenboom](https://github.com/nielstenboom) in [#5248](external-secrets/external-secrets#5248) - feat(release): add new workflow to label first time contributor issues by [@mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#5243](external-secrets/external-secrets#5243) - feat(security): Adds an option to make HTTP2 configurable by [@siddhibhor-56](https://github.com/siddhibhor-56) in [#5231](external-secrets/external-secrets#5231) - feat: add retry for onepassword on authorization error by [@Skarlso](https://github.com/Skarlso) in [#5253](external-secrets/external-secrets#5253) - fix: handle namespace deletion race conditions with finalizers by [@framsouza](https://github.com/framsouza) in [#5154](external-secrets/external-secrets#5154) - docs: update stability and support by [@anders-swanson](https://github.com/anders-swanson) in [#5257](external-secrets/external-secrets#5257) - fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by [@kgal-akl](https://github.com/kgal-akl) in [#5263](external-secrets/external-secrets#5263) - feat: support Pod Identity authentication for Vault Provider by [@webstradev](https://github.com/webstradev) in [#5201](external-secrets/external-secrets#5201) - feat: add domain field to secretserver provider by [@rkferreira](https://github.com/rkferreira) in [#5258](external-secrets/external-secrets#5258) - chore(release): Migrate to actions/create-github-app-token action by [@mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#5264](external-secrets/external-secrets#5264) - chore: just updating the crd conformance tests by [@Skarlso](https://github.com/Skarlso) in [#5265](external-secrets/external-secrets#5265) - chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by [@Skarlso](https://github.com/Skarlso) in [#5269](external-secrets/external-secrets#5269) - chore: azure sdk update by [@hauswio](https://github.com/hauswio) in [#5162](external-secrets/external-secrets#5162) - feat: add support for fetching Secret by Path on Delinea Secret Server provider by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5270](external-secrets/external-secrets#5270) - feat: migrate from tibdex to actions/create-github-app-token by [@rkferreira](https://github.com/rkferreira) in [#5286](external-secrets/external-secrets#5286) - fix: license headers across all Go files - standardize format, add missing copyright, fix typos by [@Copilot](https://github.com/Copilot) in [#5288](external-secrets/external-secrets#5288) - fix: the boilerplate was missing the right license format by [@Skarlso](https://github.com/Skarlso) in [#5289](external-secrets/external-secrets#5289) - chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by [@Copilot](https://github.com/Copilot) in [#5290](external-secrets/external-secrets#5290) - chore(docs): remove GitHub Discussions references and update support channels by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5292](external-secrets/external-secrets#5292) - docs: updated the ladder with two new tracks: documentation and community by [@Skarlso](https://github.com/Skarlso) in [#5298](external-secrets/external-secrets#5298) - docs(release): create upgrading section by [@rkferreira](https://github.com/rkferreira) in [#5310](external-secrets/external-secrets#5310) - docs: readme update for health of the project by [@Skarlso](https://github.com/Skarlso) in [#5309](external-secrets/external-secrets#5309) - fix: validate namespace in secretRef by [@moolen](https://github.com/moolen) in [#5311](external-secrets/external-secrets#5311) - docs: add burnout prevention strategies and mitigation policy document by [@Skarlso](https://github.com/Skarlso) in [#5307](external-secrets/external-secrets#5307) - feat: add missing go sbom by [@moolen](https://github.com/moolen) in [#5313](external-secrets/external-secrets#5313) - feat: make vault e2e tests run locally by [@moolen](https://github.com/moolen) in [#5246](external-secrets/external-secrets#5246) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5324](external-secrets/external-secrets#5324) - feat: add Cloudsmith generator for container registry authentication by [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) in [#5267](external-secrets/external-secrets#5267) - feat: Add lgtm review automation step to ci workflows. by [@webstradev](https://github.com/webstradev) in [#5251](external-secrets/external-secrets#5251) - feat(provider): add Volcengine provider support by [@kevinyancn](https://github.com/kevinyancn) in [#5306](external-secrets/external-secrets#5306) - test: add more information to potentially flaky test by [@Skarlso](https://github.com/Skarlso) in [#5330](external-secrets/external-secrets#5330) - fix(docs): Fix typo in controller options doc by [@tspearconquest](https://github.com/tspearconquest) in [#5299](external-secrets/external-secrets#5299) - chore(testing): Add licence.check make target by [@jonstacks](https://github.com/jonstacks) in [#5335](external-secrets/external-secrets#5335) - docs(gitlab-variables): document environment scope fallback by [@s1nyx](https://github.com/s1nyx) in [#5300](external-secrets/external-secrets#5300) ##### Dependencies - chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5190](external-secrets/external-secrets#5190) - chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5191](external-secrets/external-secrets#5191) - chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5189](external-secrets/external-secrets#5189) - chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5188](external-secrets/external-secrets#5188) - chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5187](external-secrets/external-secrets#5187) - chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5186](external-secrets/external-secrets#5186) - chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5184](external-secrets/external-secrets#5184) - chore(deps): bump golang from 1.24.6 to 1.25.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5194](external-secrets/external-secrets#5194) - chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5195](external-secrets/external-secrets#5195) - chore(deps): bump ubi8/ubi from `4f0a4e4` to `7010e70` by [@dependabot](https://github.com/dependabot)\[bot] in [#5193](external-secrets/external-secrets#5193) - chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5192](external-secrets/external-secrets#5192) - chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5198](external-secrets/external-secrets#5198) - chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5199](external-secrets/external-secrets#5199) - chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5234](external-secrets/external-secrets#5234) - chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5236](external-secrets/external-secrets#5236) - chore(deps): bump ubi8/ubi from `7010e70` to `534c2c0` by [@dependabot](https://github.com/dependabot)\[bot] in [#5237](external-secrets/external-secrets#5237) - chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5238](external-secrets/external-secrets#5238) - chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5242](external-secrets/external-secrets#5242) - chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5241](external-secrets/external-secrets#5241) - chore(deps): bump distroless/static from `2e114d2` to `f2ff10a` by [@dependabot](https://github.com/dependabot)\[bot] in [#5240](external-secrets/external-secrets#5240) - chore(deps): bump golang from 1.25.0 to 1.25.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5275](external-secrets/external-secrets#5275) - chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5274](external-secrets/external-secrets#5274) - chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5273](external-secrets/external-secrets#5273) - chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5276](external-secrets/external-secrets#5276) - chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5279](external-secrets/external-secrets#5279) - chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5278](external-secrets/external-secrets#5278) - chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5277](external-secrets/external-secrets#5277) - chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5281](external-secrets/external-secrets#5281) - chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5280](external-secrets/external-secrets#5280) - chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5282](external-secrets/external-secrets#5282) - chore(deps): bump golang from `b6ed3fd` to `b6ed3fd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5318](external-secrets/external-secrets#5318) - chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5317](external-secrets/external-secrets#5317) - chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5319](external-secrets/external-secrets#5319) - chore(deps): bump distroless/static from `f2ff10a` to `87bce11` by [@dependabot](https://github.com/dependabot)\[bot] in [#5320](external-secrets/external-secrets#5320) - chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5323](external-secrets/external-secrets#5323) - chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5321](external-secrets/external-secrets#5321) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5322](external-secrets/external-secrets#5322) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5339](external-secrets/external-secrets#5339) - chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5344](external-secrets/external-secrets#5344) - chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5345](external-secrets/external-secrets#5345) - chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5343](external-secrets/external-secrets#5343) - chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5340](external-secrets/external-secrets#5340) - chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#5341](external-secrets/external-secrets#5341) - chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5346](external-secrets/external-secrets#5346) - chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5342](external-secrets/external-secrets#5342) #### New Contributors - [@mjtrangoni](https://github.com/mjtrangoni) made their first contribution in [#5139](external-secrets/external-secrets#5139) - [@muckelba](https://github.com/muckelba) made their first contribution in [#5146](external-secrets/external-secrets#5146) - [@DrummyFloyd](https://github.com/DrummyFloyd) made their first contribution in [#5144](external-secrets/external-secrets#5144) - [@sriaradhyula](https://github.com/sriaradhyula) made their first contribution in [#5159](external-secrets/external-secrets#5159) - [@jonstacks](https://github.com/jonstacks) made their first contribution in [#5161](external-secrets/external-secrets#5161) - [@matheusmazzoni](https://github.com/matheusmazzoni) made their first contribution in [#5155](external-secrets/external-secrets#5155) - [@nirajsapkota](https://github.com/nirajsapkota) made their first contribution in [#4878](external-secrets/external-secrets#4878) - [@L1ghtman2k](https://github.com/L1ghtman2k) made their first contribution in [#5138](external-secrets/external-secrets#5138) - [@gecube](https://github.com/gecube) made their first contribution in [#5171](external-secrets/external-secrets#5171) - [@preved911](https://github.com/preved911) made their first contribution in [#4877](external-secrets/external-secrets#4877) - [@ntnn](https://github.com/ntnn) made their first contribution in [#5156](external-secrets/external-secrets#5156) - [@webstradev](https://github.com/webstradev) made their first contribution in [#5197](external-secrets/external-secrets#5197) - [@rkferreira](https://github.com/rkferreira) made their first contribution in [#5169](external-secrets/external-secrets#5169) - [@arthlr](https://github.com/arthlr) made their first contribution in [#5217](external-secrets/external-secrets#5217) - [@devnopt](https://github.com/devnopt) made their first contribution in [#4875](external-secrets/external-secrets#4875) - [@dakotaharden](https://github.com/dakotaharden) made their first contribution in [#5247](external-secrets/external-secrets#5247) - [@bharath-b-rh](https://github.com/bharath-b-rh) made their first contribution in [#4654](external-secrets/external-secrets#4654) - [@alliseeisgold](https://github.com/alliseeisgold) made their first contribution in [#5022](external-secrets/external-secrets#5022) - [@nielstenboom](https://github.com/nielstenboom) made their first contribution in [#5248](external-secrets/external-secrets#5248) - [@siddhibhor-56](https://github.com/siddhibhor-56) made their first contribution in [#5231](external-secrets/external-secrets#5231) - [@framsouza](https://github.com/framsouza) made their first contribution in [#5154](external-secrets/external-secrets#5154) - [@kgal-akl](https://github.com/kgal-akl) made their first contribution in [#5263](external-secrets/external-secrets#5263) - [@hauswio](https://github.com/hauswio) made their first contribution in [#5162](external-secrets/external-secrets#5162) - [@Copilot](https://github.com/Copilot) made their first contribution in [#5288](external-secrets/external-secrets#5288) - [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) made their first contribution in [#5267](external-secrets/external-secrets#5267) - [@kevinyancn](https://github.com/kevinyancn) made their first contribution in [#5306](external-secrets/external-secrets#5306) - [@s1nyx](https://github.com/s1nyx) made their first contribution in [#5300](external-secrets/external-secrets#5300) **Full Changelog**: <external-secrets/external-secrets@v0.19.2...v0.20.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1555 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

bharath-b-rh requested a review from a team as a code owner April 14, 2025 11:34

bharath-b-rh requested a review from gusfcarvalho April 14, 2025 11:34

bharath-b-rh force-pushed the issue-1038 branch from e5c7119 to f2ca2ea Compare July 22, 2025 18:32

bharath-b-rh changed the title ~~WIP: Issue-1038: Adds support for GCP Workload Identity Federation~~ Issue-1038: Adds support for GCP Workload Identity Federation Jul 22, 2025

bharath-b-rh commented Jul 22, 2025

View reviewed changes

Makefile Show resolved Hide resolved

bharath-b-rh commented Jul 22, 2025

View reviewed changes

hack/api-docs/Makefile Outdated Show resolved Hide resolved

bharath-b-rh commented Jul 22, 2025

View reviewed changes

pkg/provider/gcp/secretmanager/workload_identity.go Show resolved Hide resolved

bharath-b-rh commented Jul 22, 2025

View reviewed changes

pkg/provider/gcp/secretmanager/workload_identity.go Show resolved Hide resolved

bharath-b-rh commented Jul 23, 2025

View reviewed changes

bharath-b-rh force-pushed the issue-1038 branch from 3b28798 to 2328a63 Compare July 29, 2025 09:27

gusfcarvalho self-assigned this Jul 30, 2025

bharath-b-rh force-pushed the issue-1038 branch from 2328a63 to 4014e46 Compare August 25, 2025 13:31

bharath-b-rh commented Aug 25, 2025

View reviewed changes

apis/externalsecrets/v1/secretstore_gcpsm_types.go Outdated Show resolved Hide resolved

github-advanced-security bot found potential problems Aug 25, 2025

View reviewed changes

pkg/provider/gcp/secretmanager/workload_identity_federation.go Fixed Show fixed Hide fixed

bharath-b-rh added 2 commits August 26, 2025 12:23

1038: Updates SecretStore API with GCP Workload Identity Federation s…

ad89cd1

…upport Signed-off-by: Bharath B <bhb@redhat.com>

1038: Updates GCP generator with GCP Workload Identity Federation sup…

ee99add

…port Signed-off-by: Bharath B <bhb@redhat.com>

bharath-b-rh commented Aug 26, 2025

View reviewed changes

hack/api-docs/Makefile Show resolved Hide resolved

Skarlso reviewed Aug 28, 2025

View reviewed changes

Skarlso changed the title ~~Issue-1038: Adds support for GCP Workload Identity Federation~~ feat: add support for GCP Workload Identity Federation Aug 29, 2025

github-project-automation bot added this to External Secrets Aug 29, 2025

Skarlso moved this to In Progress in External Secrets Aug 29, 2025

github-actions bot added kind/feature Categorizes issue or PR as related to a new feature. kind/documentation Categorizes issue or PR as related to documentation. size/l labels Aug 29, 2025

Skarlso reviewed Aug 29, 2025

View reviewed changes

apis/externalsecrets/v1/secretstore_gcpsm_types.go Show resolved Hide resolved

bharath-b-rh added 4 commits September 1, 2025 14:11

Merge branch 'main' of https://github.com/external-secrets/external-s…

75f00e0

…ecrets into issue-1038

incorporate review suggestions on the API changes

3785f21

Signed-off-by: Bharath B <bhb@redhat.com>

fmt tool suggested changes

597fb80

Signed-off-by: Bharath B <bhb@redhat.com>

updates ClusterGenerator limitation on referenced objects

f5b6ae6

Signed-off-by: Bharath B <bhb@redhat.com>

bharath-b-rh force-pushed the issue-1038 branch from cf8660c to f5b6ae6 Compare September 1, 2025 08:49

Skarlso moved this from In Progress to Waiting for External in External Secrets Sep 3, 2025

Merge branch 'main' into issue-1038

6c500c2

Skarlso approved these changes Sep 3, 2025

View reviewed changes

Skarlso merged commit 6ec15bd into external-secrets:main Sep 3, 2025
27 checks passed

github-project-automation bot moved this from Waiting for External to Done in External Secrets Sep 3, 2025

bharath-b-rh deleted the issue-1038 branch September 4, 2025 02:26

Uh oh!

Conversation

bharath-b-rh commented Apr 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Checklist

Uh oh!

sonarqubecloud bot commented Apr 14, 2025

Quality Gate passed

Uh oh!

torfjor commented Apr 21, 2025

Uh oh!

dronenb commented Apr 21, 2025

Uh oh!

gusfcarvalho commented Apr 21, 2025

Uh oh!

bharath-b-rh commented Apr 25, 2025

Uh oh!

gusfcarvalho commented Apr 27, 2025

Uh oh!

sonarqubecloud bot commented May 21, 2025

Quality Gate passed

Uh oh!

bharath-b-rh commented May 21, 2025

Uh oh!

y4ri commented May 28, 2025

Uh oh!

alexandrst88 commented Jul 10, 2025

Uh oh!

bharath-b-rh commented Jul 10, 2025

Uh oh!

bharath-b-rh commented Jul 22, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bharath-b-rh Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gusfcarvalho commented Aug 21, 2025

Uh oh!

Uh oh!

bharath-b-rh commented Aug 25, 2025

Uh oh!

Uh oh!

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Skarlso Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

bharath-b-rh Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Skarlso Aug 30, 2025

Choose a reason for hiding this comment

Uh oh!

bharath-b-rh Sep 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bharath-b-rh commented Aug 28, 2025

Uh oh!

gusfcarvalho commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Aug 29, 2025

Uh oh!

bharath-b-rh commented Aug 29, 2025

Uh oh!

bharath-b-rh commented Apr 14, 2025 •

edited

Loading

bharath-b-rh Jul 23, 2025 •

edited

Loading

gusfcarvalho commented Aug 28, 2025 •

edited

Loading

Skarlso commented Sep 3, 2025 •

edited

Loading