feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by matheusmazzoni · Pull Request #5163 · external-secrets/external-secrets

matheusmazzoni · 2025-08-19T17:51:37Z

Problem Statement

This PR implements the finalizer mechanism for SecretStores and ClusterSecretStores to prevent premature deletion when there are PushSecrets with DeletionPolicy=Delete that reference them. This ensures that secrets are properly cleaned up from external providers before the stores are removed.

How it works

Finalizer Addition

When a SecretStore/ClusterSecretStore is created/updated, the controller checks for PushSecrets with DeletionPolicy=Delete
If such PushSecrets exist, a finalizer is automatically added
The finalizer prevents deletion until all dependent PushSecrets are handled

Finalizer Removal

When PushSecrets are deleted or change their DeletionPolicy, the finalizer is automatically removed
The store can then be safely deleted
This ensures proper cleanup order and prevents orphaned secrets

Index-Based Lookups

PushSecrets are indexed by stores they reference and their deletion policy
This makes finalizer checks extremely efficient even with thousands of resources

Breaking Changes

None - This is a purely additive feature that enhances existing functionality without changing current behavior.

Future Considerations

The indexing system can be extended to support other PushSecret-based finalizer scenarios
Similar patterns can be applied to other resource types that need coordinated deletion
Performance monitoring can be added to track index efficiency

Related Issue

Fixes #3411

It was used the #3411 (comment) comment to create this PR. Thanks @thesuperzapper for context :)

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

pkg/controllers/pushsecret/pushsecret_controller.go

pkg/controllers/secretstore/clustersecretstore_controller.go

pkg/controllers/secretstore/secretstore_controller.go

…ith DeletionPolicy=Delete Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

…ecrets#5087) Signed-off-by: Pat Riehecky <riehecky@fnal.gov> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

* Added release notes configuration Signed-off-by: Dmytro Bondar <git@bonddim.dev> * Rename title for default category Signed-off-by: Dmytro Bondar <git@bonddim.dev> --------- Signed-off-by: Dmytro Bondar <git@bonddim.dev> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

SAP is an active and collaborating company in the ESO ecosystem. I have the admission of the company to admit us as Adopter. Disclaimer: I work at SAP Signed-off-by: Jakob Möller <jakob.moeller@sap.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

…on ps controller Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

matheusmazzoni · 2025-08-22T04:56:49Z

@gusfcarvalho and @jakobmoellerdev could you take a look again? I'm happy about my PR now ;)

…er CSS/SS Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

pkg/controllers/secretstore/secretstore_controller.go

pkg/controllers/secretstore/suite_test.go

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

jakobmoellerdev

have to do another pass through the shared logic. @Skarlso PTAL here as well

apis/externalsecrets/v1/generic_store.go

pkg/controllers/pushsecret/pushsecret_controller.go

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

…dPushSecrets index to use the entire storeKey Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

Skarlso · 2025-08-23T07:35:57Z

I ignored two of the complexity increases to preserve readability, but please refactor hasPushSecretsWithDeletePolicy a but as it's rather hard to parse. :)

…tion and add some new comments Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

matheusmazzoni · 2025-08-23T14:36:47Z

I ignored two of the complexity increases to preserve readability, but please refactor hasPushSecretsWithDeletePolicy a but as it's rather hard to parse. :)

Thanks @Skarlso for the feedback! I'll definitely prioritize readability for hasPushSecretsWithDeletePolicy. I did try to make it more performant, but I ended up adding complexity and two paradigms to the same function 😅. I believe this will be possible with my new commit, where I've separated it into two more comprehensive and easier-to-understand functions.

P.S.: This PR was bigger than I expected 🥲.

…go file Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

matheusmazzoni · 2025-08-26T11:44:14Z

@Skarlso @gusfcarvalho @jakobmoellerdev could you take a look one more time? :)

jakobmoellerdev

thanks for all this work man! 🥳 still have to go for one more pass because of size, so stick with us :D

pkg/controllers/secretstore/clustersecretstore_controller.go

pkg/controllers/secretstore/common.go

Co-authored-by: Jakob Möller <contact@jakob-moeller.com> Signed-off-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com>

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

jakobmoellerdev

from my side LGTM, waiting for second reviews. cool stuff 🥳

Skarlso · 2025-09-03T06:21:09Z

nice work! 🙇

sonarqubecloud · 2025-09-03T07:32:04Z

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…ith DeletionPolicy=Delete (external-secrets#5163) * feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * docs: Fix provider stability and support table (external-secrets#5161) Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * feat(helm): Add control of response to missing prometheus (external-secrets#5087) Signed-off-by: Pat Riehecky <riehecky@fnal.gov> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * chore: Added release notes configuration (external-secrets#5148) * Added release notes configuration Signed-off-by: Dmytro Bondar <git@bonddim.dev> * Rename title for default category Signed-off-by: Dmytro Bondar <git@bonddim.dev> --------- Signed-off-by: Dmytro Bondar <git@bonddim.dev> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * refactor: update fmt after make fmt Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * fix: adjust css and ss watches ps Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * test: using manager instead of k8s client for get the ps index correctly Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * chore: bump bitwarden helm chart version (external-secrets#5044) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * chore(docs): update `ADOPTERS.md` to include SAP (external-secrets#5165) SAP is an active and collaborating company in the ESO ecosystem. I have the admission of the company to admit us as Adopter. Disclaimer: I work at SAP Signed-off-by: Jakob Möller <jakob.moeller@sap.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * feat: use cmd.Context for index the syncedSecrets and deletionPolicy on ps controller Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * chore: using a single finalizer handler for all secret stores Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * docs: remove TODO comment from pushsecret controller test Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * chore: update the handlerFinalizer logic turnig more readable Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * test: create secretstore finalizer management suite Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * refactor: remove findForPushSecret code duplication on SetupWithManager CSS/SS Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * docs: update suite_test comments Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * fix: skip finalizer management when pushsecret feature is disable Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * fix: remove handle finalizers from generic_store and update the syncedPushSecrets index to use the entire storeKey Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * refactor: improves readability of hasPushSecretsWithDeletePolicy function and add some new comments Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * fix: update the code fmt, lint and move some util functions for util.go file Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> * Apply suggestions from code review Co-authored-by: Jakob Möller <contact@jakob-moeller.com> Signed-off-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com> * refactor: update the watcher based if the pushsecrets is enabled Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> --------- Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com> Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> Signed-off-by: Pat Riehecky <riehecky@fnal.gov> Signed-off-by: Dmytro Bondar <git@bonddim.dev> Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Jakob Möller <jakob.moeller@sap.com> Signed-off-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com> Co-authored-by: Jonathan Stacks <jonstacks@users.noreply.github.com> Co-authored-by: Pat Riehecky <3534830+jcpunk@users.noreply.github.com> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Co-authored-by: Dmytro Bondar <git@bonddim.dev> Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Co-authored-by: Jakob Möller <jakob.moeller@sap.com> Co-authored-by: Jakob Möller <contact@jakob-moeller.com> Signed-off-by: Niels ten Boom <nielstenboom@gmail.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `0.19.2` -> `0.20.1` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v0.20.1`](https://github.com/external-secrets/external-secrets/releases/tag/v0.20.1) [Compare Source](external-secrets/external-secrets@v0.19.2...v0.20.1) Image: `ghcr.io/external-secrets/external-secrets:v0.20.1` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl`  #### What's Changed ##### General - chore: release 0.19.2 by [@moolen](https://github.com/moolen) in [#5136](external-secrets/external-secrets#5136) - chore: update readme by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5137](external-secrets/external-secrets#5137) - fix(kubernetes): make auth field optional by [@mhrabovcin](https://github.com/mhrabovcin) in [#5064](external-secrets/external-secrets#5064) - chore: Fix Markdown spelling issues found by codespell by [@mjtrangoni](https://github.com/mjtrangoni) in [#5139](external-secrets/external-secrets#5139) - Fix yaml codeblock for oracle-vault provider docs by [@muckelba](https://github.com/muckelba) in [#5146](external-secrets/external-secrets#5146) - feat: add liveness probe to eso controller by [@Skarlso](https://github.com/Skarlso) in [#4930](external-secrets/external-secrets#4930) - fix(helm): add boolean for processClusterGenerator by [@DrummyFloyd](https://github.com/DrummyFloyd) in [#5144](external-secrets/external-secrets#5144) - chore: add Cisco to ADOPTERS.md by [@sriaradhyula](https://github.com/sriaradhyula) in [#5159](external-secrets/external-secrets#5159) - docs: Fix provider stability and support table by [@jonstacks](https://github.com/jonstacks) in [#5161](external-secrets/external-secrets#5161) - feat(helm): Add control of response to missing prometheus CRDs by [@jcpunk](https://github.com/jcpunk) in [#5087](external-secrets/external-secrets#5087) - chore: Added release notes configuration by [@bonddim](https://github.com/bonddim) in [#5148](external-secrets/external-secrets#5148) - chore: bump bitwarden helm chart version by [@Skarlso](https://github.com/Skarlso) in [#5044](external-secrets/external-secrets#5044) - chore(docs): update `ADOPTERS.md` to include SAP by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5165](external-secrets/external-secrets#5165) - feat: add externalsecret namespace for webhook provider by [@matheusmazzoni](https://github.com/matheusmazzoni) in [#5155](external-secrets/external-secrets#5155) - fix: add unknown status for secret store by [@alvin-rw](https://github.com/alvin-rw) in [#5070](external-secrets/external-secrets#5070) - Fix pushing to an AWS Secrets Manager Secret when there are no secret values by [@nirajsapkota](https://github.com/nirajsapkota) in [#4878](external-secrets/external-secrets#4878) - add extralabels for dashboard to be scraped by multiple grafana instances by [@L1ghtman2k](https://github.com/L1ghtman2k) in [#5138](external-secrets/external-secrets#5138) - fix: the api docs are not referencing sshkey generator by [@Skarlso](https://github.com/Skarlso) in [#5170](external-secrets/external-secrets#5170) - Update github.md by [@gecube](https://github.com/gecube) in [#5171](external-secrets/external-secrets#5171) - Update anchore-engine-credentials.md by [@gecube](https://github.com/gecube) in [#5172](external-secrets/external-secrets#5172) - docs: update infisical docs to clarify missing system:auth-delegator need by [@Skarlso](https://github.com/Skarlso) in [#5174](external-secrets/external-secrets#5174) - Adding support different type auth sources by [@preved911](https://github.com/preved911) in [#4877](external-secrets/external-secrets#4877) - fix: stability update document did not update the stability table correctly by [@Skarlso](https://github.com/Skarlso) in [#5176](external-secrets/external-secrets#5176) - Add esv1.AnnotationForceSync for CES and ES by [@ntnn](https://github.com/ntnn) in [#5156](external-secrets/external-secrets#5156) - fix: helm build failing by [@Skarlso](https://github.com/Skarlso) in [#5178](external-secrets/external-secrets#5178) - fix: remove release- branch automation by [@moolen](https://github.com/moolen) in [#5182](external-secrets/external-secrets#5182) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5181](external-secrets/external-secrets#5181) - docs: update bitwarden documentation for dataFrom field usage by [@Skarlso](https://github.com/Skarlso) in [#5196](external-secrets/external-secrets#5196) - feat: add contributor ladder by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5150](external-secrets/external-secrets#5150) - feat: support vault provider check and set for push secrets by [@webstradev](https://github.com/webstradev) in [#5197](external-secrets/external-secrets#5197) - chore(docs): update helm charts by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5203](external-secrets/external-secrets#5203) - chore(ci): fix sonarqube security warnings in helm.yml by [@webstradev](https://github.com/webstradev) in [#5202](external-secrets/external-secrets#5202) - chore: add pull request maintenance auto labelling and sizes by [@Skarlso](https://github.com/Skarlso) in [#5200](external-secrets/external-secrets#5200) - fix: update the label verification step by [@Skarlso](https://github.com/Skarlso) in [#5209](external-secrets/external-secrets#5209) - feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by [@tuxtof](https://github.com/tuxtof) in [#5168](external-secrets/external-secrets#5168) - feat: improve error message for json marshalling/unmarshalling by [@webstradev](https://github.com/webstradev) in [#5211](external-secrets/external-secrets#5211) - chore: enhance `helm-values-schema-json` schema plugin management logic by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5212](external-secrets/external-secrets#5212) - fix(aws): stop incrementing the UUID for versions by [@Skarlso](https://github.com/Skarlso) in [#5175](external-secrets/external-secrets#5175) - feat: enable secure serving for metrics \[issue 4614] by [@rkferreira](https://github.com/rkferreira) in [#5169](external-secrets/external-secrets#5169) - fix(infisical): fix TokenAuth auth method by escaping the token revocation by [@arthlr](https://github.com/arthlr) in [#5217](external-secrets/external-secrets#5217) - fix: tilt build was failing to rebuild by [@Skarlso](https://github.com/Skarlso) in [#5225](external-secrets/external-secrets#5225) - feat: add selectable fields to the CRDs by [@Skarlso](https://github.com/Skarlso) in [#5226](external-secrets/external-secrets#5226) - ref: removing Yandex Cloud specific common types declaration duplication by [@preved911](https://github.com/preved911) in [#4905](external-secrets/external-secrets#4905) - fix: missing codeowners file from .github folder by [@Skarlso](https://github.com/Skarlso) in [#5228](external-secrets/external-secrets#5228) - feat: add setting remote namespace to metadata for kubernetes provider by [@Skarlso](https://github.com/Skarlso) in [#5224](external-secrets/external-secrets#5224) - feat: add support for certs only in pkcs12 by [@devnopt](https://github.com/devnopt) in [#4875](external-secrets/external-secrets#4875) - docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by [@ionicsolutions](https://github.com/ionicsolutions) in [#5208](external-secrets/external-secrets#5208) - feat: Allow adding finalizers from template by [@malovme](https://github.com/malovme) in [#5140](external-secrets/external-secrets#5140) - fix: controller-runtime update by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5239](external-secrets/external-secrets#5239) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5229](external-secrets/external-secrets#5229) - fix: Prevent secretstore reconcile loop when provider error response is dynamic by [@dakotaharden](https://github.com/dakotaharden) in [#5247](external-secrets/external-secrets#5247) - feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by [@matheusmazzoni](https://github.com/matheusmazzoni) in [#5163](external-secrets/external-secrets#5163) - fix: keepersecurity support for shortcuts by [@pepordev](https://github.com/pepordev) in [#5245](external-secrets/external-secrets#5245) - feat: add support for GCP Workload Identity Federation by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#4654](external-secrets/external-secrets#4654) - feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by [@alliseeisgold](https://github.com/alliseeisgold) in [#5022](external-secrets/external-secrets#5022) - chore(charts): Adds new make target for installing unittest plugin by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#5250](external-secrets/external-secrets#5250) - docs(templating): added clarifying comments to Github generator example by [@nielstenboom](https://github.com/nielstenboom) in [#5248](external-secrets/external-secrets#5248) - feat(release): add new workflow to label first time contributor issues by [@mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#5243](external-secrets/external-secrets#5243) - feat(security): Adds an option to make HTTP2 configurable by [@siddhibhor-56](https://github.com/siddhibhor-56) in [#5231](external-secrets/external-secrets#5231) - feat: add retry for onepassword on authorization error by [@Skarlso](https://github.com/Skarlso) in [#5253](external-secrets/external-secrets#5253) - fix: handle namespace deletion race conditions with finalizers by [@framsouza](https://github.com/framsouza) in [#5154](external-secrets/external-secrets#5154) - docs: update stability and support by [@anders-swanson](https://github.com/anders-swanson) in [#5257](external-secrets/external-secrets#5257) - fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by [@kgal-akl](https://github.com/kgal-akl) in [#5263](external-secrets/external-secrets#5263) - feat: support Pod Identity authentication for Vault Provider by [@webstradev](https://github.com/webstradev) in [#5201](external-secrets/external-secrets#5201) - feat: add domain field to secretserver provider by [@rkferreira](https://github.com/rkferreira) in [#5258](external-secrets/external-secrets#5258) - chore(release): Migrate to actions/create-github-app-token action by [@mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#5264](external-secrets/external-secrets#5264) - chore: just updating the crd conformance tests by [@Skarlso](https://github.com/Skarlso) in [#5265](external-secrets/external-secrets#5265) - chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by [@Skarlso](https://github.com/Skarlso) in [#5269](external-secrets/external-secrets#5269) - chore: azure sdk update by [@hauswio](https://github.com/hauswio) in [#5162](external-secrets/external-secrets#5162) - feat: add support for fetching Secret by Path on Delinea Secret Server provider by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5270](external-secrets/external-secrets#5270) - feat: migrate from tibdex to actions/create-github-app-token by [@rkferreira](https://github.com/rkferreira) in [#5286](external-secrets/external-secrets#5286) - fix: license headers across all Go files - standardize format, add missing copyright, fix typos by [@Copilot](https://github.com/Copilot) in [#5288](external-secrets/external-secrets#5288) - fix: the boilerplate was missing the right license format by [@Skarlso](https://github.com/Skarlso) in [#5289](external-secrets/external-secrets#5289) - chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by [@Copilot](https://github.com/Copilot) in [#5290](external-secrets/external-secrets#5290) - chore(docs): remove GitHub Discussions references and update support channels by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5292](external-secrets/external-secrets#5292) - docs: updated the ladder with two new tracks: documentation and community by [@Skarlso](https://github.com/Skarlso) in [#5298](external-secrets/external-secrets#5298) - docs(release): create upgrading section by [@rkferreira](https://github.com/rkferreira) in [#5310](external-secrets/external-secrets#5310) - docs: readme update for health of the project by [@Skarlso](https://github.com/Skarlso) in [#5309](external-secrets/external-secrets#5309) - fix: validate namespace in secretRef by [@moolen](https://github.com/moolen) in [#5311](external-secrets/external-secrets#5311) - docs: add burnout prevention strategies and mitigation policy document by [@Skarlso](https://github.com/Skarlso) in [#5307](external-secrets/external-secrets#5307) - feat: add missing go sbom by [@moolen](https://github.com/moolen) in [#5313](external-secrets/external-secrets#5313) - feat: make vault e2e tests run locally by [@moolen](https://github.com/moolen) in [#5246](external-secrets/external-secrets#5246) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5324](external-secrets/external-secrets#5324) - feat: add Cloudsmith generator for container registry authentication by [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) in [#5267](external-secrets/external-secrets#5267) - feat: Add lgtm review automation step to ci workflows. by [@webstradev](https://github.com/webstradev) in [#5251](external-secrets/external-secrets#5251) - feat(provider): add Volcengine provider support by [@kevinyancn](https://github.com/kevinyancn) in [#5306](external-secrets/external-secrets#5306) - test: add more information to potentially flaky test by [@Skarlso](https://github.com/Skarlso) in [#5330](external-secrets/external-secrets#5330) - fix(docs): Fix typo in controller options doc by [@tspearconquest](https://github.com/tspearconquest) in [#5299](external-secrets/external-secrets#5299) - chore(testing): Add licence.check make target by [@jonstacks](https://github.com/jonstacks) in [#5335](external-secrets/external-secrets#5335) - docs(gitlab-variables): document environment scope fallback by [@s1nyx](https://github.com/s1nyx) in [#5300](external-secrets/external-secrets#5300) ##### Dependencies - chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5190](external-secrets/external-secrets#5190) - chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5191](external-secrets/external-secrets#5191) - chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5189](external-secrets/external-secrets#5189) - chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5188](external-secrets/external-secrets#5188) - chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5187](external-secrets/external-secrets#5187) - chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5186](external-secrets/external-secrets#5186) - chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5184](external-secrets/external-secrets#5184) - chore(deps): bump golang from 1.24.6 to 1.25.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5194](external-secrets/external-secrets#5194) - chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5195](external-secrets/external-secrets#5195) - chore(deps): bump ubi8/ubi from `4f0a4e4` to `7010e70` by [@dependabot](https://github.com/dependabot)\[bot] in [#5193](external-secrets/external-secrets#5193) - chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5192](external-secrets/external-secrets#5192) - chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5198](external-secrets/external-secrets#5198) - chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5199](external-secrets/external-secrets#5199) - chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5234](external-secrets/external-secrets#5234) - chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5236](external-secrets/external-secrets#5236) - chore(deps): bump ubi8/ubi from `7010e70` to `534c2c0` by [@dependabot](https://github.com/dependabot)\[bot] in [#5237](external-secrets/external-secrets#5237) - chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5238](external-secrets/external-secrets#5238) - chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5242](external-secrets/external-secrets#5242) - chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5241](external-secrets/external-secrets#5241) - chore(deps): bump distroless/static from `2e114d2` to `f2ff10a` by [@dependabot](https://github.com/dependabot)\[bot] in [#5240](external-secrets/external-secrets#5240) - chore(deps): bump golang from 1.25.0 to 1.25.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5275](external-secrets/external-secrets#5275) - chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5274](external-secrets/external-secrets#5274) - chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5273](external-secrets/external-secrets#5273) - chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5276](external-secrets/external-secrets#5276) - chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5279](external-secrets/external-secrets#5279) - chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5278](external-secrets/external-secrets#5278) - chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5277](external-secrets/external-secrets#5277) - chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5281](external-secrets/external-secrets#5281) - chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5280](external-secrets/external-secrets#5280) - chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5282](external-secrets/external-secrets#5282) - chore(deps): bump golang from `b6ed3fd` to `b6ed3fd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5318](external-secrets/external-secrets#5318) - chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5317](external-secrets/external-secrets#5317) - chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5319](external-secrets/external-secrets#5319) - chore(deps): bump distroless/static from `f2ff10a` to `87bce11` by [@dependabot](https://github.com/dependabot)\[bot] in [#5320](external-secrets/external-secrets#5320) - chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5323](external-secrets/external-secrets#5323) - chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5321](external-secrets/external-secrets#5321) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5322](external-secrets/external-secrets#5322) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5339](external-secrets/external-secrets#5339) - chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5344](external-secrets/external-secrets#5344) - chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5345](external-secrets/external-secrets#5345) - chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5343](external-secrets/external-secrets#5343) - chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5340](external-secrets/external-secrets#5340) - chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#5341](external-secrets/external-secrets#5341) - chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5346](external-secrets/external-secrets#5346) - chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5342](external-secrets/external-secrets#5342) #### New Contributors - [@mjtrangoni](https://github.com/mjtrangoni) made their first contribution in [#5139](external-secrets/external-secrets#5139) - [@muckelba](https://github.com/muckelba) made their first contribution in [#5146](external-secrets/external-secrets#5146) - [@DrummyFloyd](https://github.com/DrummyFloyd) made their first contribution in [#5144](external-secrets/external-secrets#5144) - [@sriaradhyula](https://github.com/sriaradhyula) made their first contribution in [#5159](external-secrets/external-secrets#5159) - [@jonstacks](https://github.com/jonstacks) made their first contribution in [#5161](external-secrets/external-secrets#5161) - [@matheusmazzoni](https://github.com/matheusmazzoni) made their first contribution in [#5155](external-secrets/external-secrets#5155) - [@nirajsapkota](https://github.com/nirajsapkota) made their first contribution in [#4878](external-secrets/external-secrets#4878) - [@L1ghtman2k](https://github.com/L1ghtman2k) made their first contribution in [#5138](external-secrets/external-secrets#5138) - [@gecube](https://github.com/gecube) made their first contribution in [#5171](external-secrets/external-secrets#5171) - [@preved911](https://github.com/preved911) made their first contribution in [#4877](external-secrets/external-secrets#4877) - [@ntnn](https://github.com/ntnn) made their first contribution in [#5156](external-secrets/external-secrets#5156) - [@webstradev](https://github.com/webstradev) made their first contribution in [#5197](external-secrets/external-secrets#5197) - [@rkferreira](https://github.com/rkferreira) made their first contribution in [#5169](external-secrets/external-secrets#5169) - [@arthlr](https://github.com/arthlr) made their first contribution in [#5217](external-secrets/external-secrets#5217) - [@devnopt](https://github.com/devnopt) made their first contribution in [#4875](external-secrets/external-secrets#4875) - [@dakotaharden](https://github.com/dakotaharden) made their first contribution in [#5247](external-secrets/external-secrets#5247) - [@bharath-b-rh](https://github.com/bharath-b-rh) made their first contribution in [#4654](external-secrets/external-secrets#4654) - [@alliseeisgold](https://github.com/alliseeisgold) made their first contribution in [#5022](external-secrets/external-secrets#5022) - [@nielstenboom](https://github.com/nielstenboom) made their first contribution in [#5248](external-secrets/external-secrets#5248) - [@siddhibhor-56](https://github.com/siddhibhor-56) made their first contribution in [#5231](external-secrets/external-secrets#5231) - [@framsouza](https://github.com/framsouza) made their first contribution in [#5154](external-secrets/external-secrets#5154) - [@kgal-akl](https://github.com/kgal-akl) made their first contribution in [#5263](external-secrets/external-secrets#5263) - [@hauswio](https://github.com/hauswio) made their first contribution in [#5162](external-secrets/external-secrets#5162) - [@Copilot](https://github.com/Copilot) made their first contribution in [#5288](external-secrets/external-secrets#5288) - [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) made their first contribution in [#5267](external-secrets/external-secrets#5267) - [@kevinyancn](https://github.com/kevinyancn) made their first contribution in [#5306](external-secrets/external-secrets#5306) - [@s1nyx](https://github.com/s1nyx) made their first contribution in [#5300](external-secrets/external-secrets#5300) **Full Changelog**: <external-secrets/external-secrets@v0.19.2...v0.20.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1555 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

github-project-automation bot added this to External Secrets Aug 19, 2025

matheusmazzoni force-pushed the add-fnz-ss-to-ps branch from 7e5cba8 to 2c4c448 Compare August 19, 2025 17:52

jakobmoellerdev reviewed Aug 20, 2025

View reviewed changes

Skarlso mentioned this pull request Aug 20, 2025

Interim maintainer admission: Jakob Moeller #5164

Closed

matheusmazzoni force-pushed the add-fnz-ss-to-ps branch from 7019928 to 320b378 Compare August 20, 2025 12:39

matheusmazzoni requested review from gusfcarvalho and jakobmoellerdev August 20, 2025 20:04

matheusmazzoni and others added 14 commits August 22, 2025 01:41

feat: add finalizers to SecretStores when referenced by PushSecrets w…

db2846f

…ith DeletionPolicy=Delete Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

docs: Fix provider stability and support table (external-secrets#5161)

abd8ae2

Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

feat(helm): Add control of response to missing prometheus (external-s…

c95debb

…ecrets#5087) Signed-off-by: Pat Riehecky <riehecky@fnal.gov> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

refactor: update fmt after make fmt

185a958

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

fix: adjust css and ss watches ps

72fd0ff

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

test: using manager instead of k8s client for get the ps index correctly

eff2535

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

chore: bump bitwarden helm chart version (external-secrets#5044)

07bdcc9

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

feat: use cmd.Context for index the syncedSecrets and deletionPolicy …

57b132c

…on ps controller Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

chore: using a single finalizer handler for all secret stores

1d77abd

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

docs: remove TODO comment from pushsecret controller test

8c07a0a

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

chore: update the handlerFinalizer logic turnig more readable

4993461

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

test: create secretstore finalizer management suite

9203779

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

matheusmazzoni force-pushed the add-fnz-ss-to-ps branch from 10b2dc7 to 9203779 Compare August 22, 2025 04:41

Merge branch 'main' into add-fnz-ss-to-ps

5f95e9e

matheusmazzoni marked this pull request as ready for review August 22, 2025 04:55

matheusmazzoni requested a review from a team as a code owner August 22, 2025 04:55

Skarlso moved this to In Progress in External Secrets Aug 22, 2025

refactor: remove findForPushSecret code duplication on SetupWithManag…

e7dff96

…er CSS/SS Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

gusfcarvalho reviewed Aug 22, 2025

View reviewed changes

pkg/controllers/secretstore/secretstore_controller.go Outdated Show resolved Hide resolved

gusfcarvalho reviewed Aug 22, 2025

View reviewed changes

pkg/controllers/secretstore/suite_test.go Outdated Show resolved Hide resolved

docs: update suite_test comments

bda3abd

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

jakobmoellerdev reviewed Aug 22, 2025

View reviewed changes

matheusmazzoni added 2 commits August 22, 2025 11:33

fix: skip finalizer management when pushsecret feature is disable

57da84f

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

fix: remove handle finalizers from generic_store and update the synce…

cb373e0

…dPushSecrets index to use the entire storeKey Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

matheusmazzoni requested review from gusfcarvalho and jakobmoellerdev August 22, 2025 16:06

refactor: improves readability of hasPushSecretsWithDeletePolicy func…

766a4a9

…tion and add some new comments Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

fix: update the code fmt, lint and move some util functions for util.…

ab8d442

…go file Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

Merge branch 'main' into add-fnz-ss-to-ps

d2981cb

github-actions bot added kind/feature Categorizes issue or PR as related to a new feature. size/l labels Sep 2, 2025

jakobmoellerdev reviewed Sep 2, 2025

View reviewed changes

matheusmazzoni and others added 2 commits September 2, 2025 14:09

Apply suggestions from code review

9844315

Co-authored-by: Jakob Möller <contact@jakob-moeller.com> Signed-off-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com>

refactor: update the watcher based if the pushsecrets is enabled

3f9b069

Signed-off-by: Matheus Mazzoni <matheusdiasmazzoni@gmail.com>

matheusmazzoni force-pushed the add-fnz-ss-to-ps branch from b1c63d1 to 3f9b069 Compare September 2, 2025 18:39

matheusmazzoni requested a review from jakobmoellerdev September 2, 2025 18:40

Skarlso moved this from In Progress to In Review in External Secrets Sep 3, 2025

jakobmoellerdev reviewed Sep 3, 2025

View reviewed changes

Skarlso approved these changes Sep 3, 2025

View reviewed changes

Merge branch 'main' into add-fnz-ss-to-ps

d0a2566

Skarlso merged commit 8ed902d into external-secrets:main Sep 3, 2025
6 checks passed

github-project-automation bot moved this from In Review to Done in External Secrets Sep 3, 2025

matheusmazzoni deleted the add-fnz-ss-to-ps branch September 3, 2025 11:22

Uh oh!

Conversation

matheusmazzoni commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

How it works

Finalizer Addition

Finalizer Removal

Index-Based Lookups

Breaking Changes

Future Considerations

Related Issue

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matheusmazzoni commented Aug 22, 2025

Uh oh!

Uh oh!

Uh oh!

jakobmoellerdev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Skarlso commented Aug 23, 2025

Uh oh!

matheusmazzoni commented Aug 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matheusmazzoni commented Aug 26, 2025

Uh oh!

jakobmoellerdev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jakobmoellerdev left a comment

Choose a reason for hiding this comment

Uh oh!

Skarlso commented Sep 3, 2025

Uh oh!

Uh oh!

sonarqubecloud bot commented Sep 3, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

matheusmazzoni commented Aug 19, 2025 •

edited

Loading

matheusmazzoni commented Aug 23, 2025 •

edited

Loading