feat: add Doppler OIDC-based authentication by mikesellitto · Pull Request #5475 · external-secrets/external-secrets

mikesellitto · 2025-10-16T22:22:33Z

Problem Statement

The Doppler provider in ESO currently only supports token-based authentication. Doppler has added OIDC authentication functionality to the product, but ESO currently has no simple way to utilize it.

Related Issue

Fixes #4352

Proposed Changes

This PR adds OIDC authentication support to the Doppler provider, allowing ESO to authenticate with Doppler without using static credentials.

Specifically, it:

Adds a new oidcConfig field to the Doppler provider's auth config (mutually exclusive with the existing secretRef auth).
Adds a new --doppler-oidc-cache-size flag, which controls the LRU cache size for OIDC-authenticated Doppler clients.

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

mikesellitto · 2025-10-17T15:50:51Z

The latest force-push correctly the regenerates tests/__snapshot__/secretstore-v1.yaml and tests/__snapshot__/clustersecretstore-v1.yaml resolving the check-diff run.

Skarlso · 2025-10-20T05:09:47Z

Hi! Could you please take care of the 2 Sonar issues? 🙇 Thanks!

providers/v1/doppler/auth_oidc.go

jakobmoellerdev · 2025-10-20T07:41:13Z

providers/v1/doppler/auth_oidc.go

+	dopplerOIDCPath = "/v3/auth/oidc"
+)
+
+type OIDCTokenManager struct {


I love that you wrote an OIDC handler. I dont love that its only for doppler. I think we should support well-known lookup via OIDC config. @Skarlso wdyt about this whole ordeal?

I think that's a great idea, and will certainly be something to look at once I see another OIDC setup. :))

sonarqubecloud · 2025-10-20T21:57:05Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

pkg/provider/doppler/auth_oidc.go

providers/v1/doppler/client.go

mikesellitto · 2025-12-02T20:06:49Z

This new Sonar issue should be accepted/ignored, since fixing it would require changing the SecretsClient interface.

providers/v1/doppler/auth_oidc.go

Skarlso · 2025-12-03T06:55:01Z

I don't know why the sonar stuff suddenly started to pop up everywhere. I'll see if I can ignore it globally.

Could you please fix the client issue though? ( GitHub security bot issue ).

mikesellitto · 2025-12-04T22:35:49Z

Could you please fix the client issue though? ( GitHub security bot issue ).

@Skarlso This issue (The URL of this request depends on a user-provided value) actually appears to be another which should be ignored, as many providers including Doppler have historically allowed for URL configuration via env var and/or CRD spec.

mikesellitto · 2025-12-04T23:05:39Z

@Skarlso @jakobmoellerdev The latest force-push rebases onto the latest main and fixes a linting issue.

Skarlso · 2025-12-08T06:49:04Z

I can't fix your branch for some reason. Maybe you disallowed edits from maintainers ( which is weird because I can see it on the right side ).

Anyways, you need to sort the imports on a couple of files in the doppler folder and also run go mod tidy. And then run make check-diff and commit it. That should fix your linter problem.

mikesellitto · 2025-12-09T23:37:49Z

I can't fix your branch for some reason. Maybe you disallowed edits from maintainers ( which is weird because I can see it on the right side ).

Anyways, you need to sort the imports on a couple of files in the doppler folder and also run go mod tidy. And then run make check-diff and commit it. That should fix your linter problem.

@Skarlso Strange, I didn't disallow edits and I also see it enabled on the right.

No worries though, I've done so and fixed the linter issue.

Signed-off-by: Mike Sellitto <mike.sellitto@doppler.com>

Skarlso · 2025-12-10T06:29:24Z

@mikesellitto Perfect! Thanks very much. :)

sonarqubecloud · 2025-12-11T06:04:58Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.1.1` -> `1.2.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](external-secrets/external-secrets@v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump 1.1.1 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5687](external-secrets/external-secrets#5687) - chore: fix the argocd e2e test case by [@Skarlso](https://github.com/Skarlso) in [#5688](external-secrets/external-secrets#5688) - feat(provider): add Barbican provider support by [@rkferreira](https://github.com/rkferreira) in [#5398](external-secrets/external-secrets#5398) - docs(secretserver): promote secretserver provider to beta by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5668](external-secrets/external-secrets#5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@Ilhan-Personal](https://github.com/Ilhan-Personal) in [#5653](external-secrets/external-secrets#5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@iypetrov](https://github.com/iypetrov) in [#5685](external-secrets/external-secrets#5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@tokiwong](https://github.com/tokiwong) in [#5708](external-secrets/external-secrets#5708) - feat: introduce store deprecation by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5711](external-secrets/external-secrets#5711) - feat(charts): add global values for common deployment configurations by [@Gabryel8818](https://github.com/Gabryel8818) in [#5652](external-secrets/external-secrets#5652) - feat: add Doppler OIDC-based authentication by [@mikesellitto](https://github.com/mikesellitto) in [#5475](external-secrets/external-secrets#5475) - fix: make custom configuration available regardless of environment by [@Skarlso](https://github.com/Skarlso) in [#5713](external-secrets/external-secrets#5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@Skarlso](https://github.com/Skarlso) in [#5719](external-secrets/external-secrets#5719) - docs(templating): update rbac for generic targets by [@lostick](https://github.com/lostick) in [#5736](external-secrets/external-secrets#5736) - fix(testing): Breaking changes should not break ci by [@evrardjp](https://github.com/evrardjp) in [#5739](external-secrets/external-secrets#5739) - fix(security): Get rid of getSecretKey by [@evrardjp](https://github.com/evrardjp) in [#5738](external-secrets/external-secrets#5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@cmoscofian](https://github.com/cmoscofian) in [#5622](external-secrets/external-secrets#5622) - docs: Fix example in GCP documentation by [@headcr4sh](https://github.com/headcr4sh) in [#5745](external-secrets/external-secrets#5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5742](external-secrets/external-secrets#5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@tosih](https://github.com/tosih) in [#5610](external-secrets/external-secrets#5610) - chore(docs): add clarification to helm values being disabled by [@Skarlso](https://github.com/Skarlso) in [#5746](external-secrets/external-secrets#5746) - fix(release): apply [`64dc681`](external-secrets/external-secrets@64dc681) to release by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5749](external-secrets/external-secrets#5749) - docs(release): 1.2 stability-support.md by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5750](external-secrets/external-secrets#5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5693](external-secrets/external-secrets#5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5702](external-secrets/external-secrets#5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@dependabot](https://github.com/dependabot)\[bot] in [#5655](external-secrets/external-secrets#5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5695](external-secrets/external-secrets#5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#5696](external-secrets/external-secrets#5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5697](external-secrets/external-secrets#5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5700](external-secrets/external-secrets#5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5698](external-secrets/external-secrets#5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5699](external-secrets/external-secrets#5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5705](external-secrets/external-secrets#5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@dependabot](https://github.com/dependabot)\[bot] in [#5692](external-secrets/external-secrets#5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5703](external-secrets/external-secrets#5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5704](external-secrets/external-secrets#5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5706](external-secrets/external-secrets#5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5701](external-secrets/external-secrets#5701) - chore(deps): bump golang from `2611181` to `2611181` by [@dependabot](https://github.com/dependabot)\[bot] in [#5721](external-secrets/external-secrets#5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5725](external-secrets/external-secrets#5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5730](external-secrets/external-secrets#5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#5726](external-secrets/external-secrets#5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5724](external-secrets/external-secrets#5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5732](external-secrets/external-secrets#5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@dependabot](https://github.com/dependabot)\[bot] in [#5722](external-secrets/external-secrets#5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5729](external-secrets/external-secrets#5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@dependabot](https://github.com/dependabot)\[bot] in [#5694](external-secrets/external-secrets#5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](external-secrets/external-secrets@712b439) to [`071811a`](external-secrets/external-secrets@071811a) by [@dependabot](https://github.com/dependabot)\[bot] in [#5727](external-secrets/external-secrets#5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5731](external-secrets/external-secrets#5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5728](external-secrets/external-secrets#5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5723](external-secrets/external-secrets#5723) #### New Contributors - [@iypetrov](https://github.com/iypetrov) made their first contribution in [#5685](external-secrets/external-secrets#5685) - [@tokiwong](https://github.com/tokiwong) made their first contribution in [#5708](external-secrets/external-secrets#5708) - [@Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#5652](external-secrets/external-secrets#5652) - [@mikesellitto](https://github.com/mikesellitto) made their first contribution in [#5475](external-secrets/external-secrets#5475) - [@lostick](https://github.com/lostick) made their first contribution in [#5736](external-secrets/external-secrets#5736) - [@cmoscofian](https://github.com/cmoscofian) made their first contribution in [#5622](external-secrets/external-secrets#5622) - [@headcr4sh](https://github.com/headcr4sh) made their first contribution in [#5745](external-secrets/external-secrets#5745) - [@tosih](https://github.com/tosih) made their first contribution in [#5610](external-secrets/external-secrets#5610) **Full Changelog**: <external-secrets/external-secrets@v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/2737 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This commit adds OIDC authentication support to the Pulumi provider, allowing External Secrets Operator to authenticate with Pulumi ESC using Kubernetes ServiceAccount tokens instead of static access tokens. Changes: - Add PulumiAuth type with support for both accessToken and oidcConfig - Add PulumiOIDCAuth type for OIDC configuration - Implement OIDCTokenManager for token exchange with Pulumi API - Add caching support for OIDC-authenticated clients - Add InitializeFlags function for cache configuration - Update provider to support both authentication methods - Maintain backward compatibility with deprecated accessToken field - Add comprehensive tests for OIDC functionality - Update CRDs with new authentication options - Add documentation and example YAML snippets The implementation follows the same pattern as the Doppler provider (PR external-secrets#5475) for consistency across the codebase. Key features: - Token caching with automatic refresh - Support for both SecretStore and ClusterSecretStore - Configurable token expiration (default 10 minutes) - Proper error handling and validation - LRU cache for OIDC clients Signed-off-by: Matt Johnston <mattjo@supabase.io>

github-project-automation bot added this to External Secrets Oct 16, 2025

github-actions bot added kind/feature Categorizes issue or PR as related to a new feature. size/l kind/documentation Categorizes issue or PR as related to documentation. and removed size/l labels Oct 16, 2025

mikesellitto force-pushed the doppler-oidc-auth branch from 59cda82 to 31c9317 Compare October 16, 2025 22:37

github-actions bot added the size/l label Oct 16, 2025

mikesellitto force-pushed the doppler-oidc-auth branch from 31c9317 to 6e4ea65 Compare October 17, 2025 15:47

jakobmoellerdev reviewed Oct 20, 2025

View reviewed changes

Skarlso mentioned this pull request Oct 20, 2025

feat(generator): add OIDC generator for authentication #5315

Closed

5 tasks

mikesellitto force-pushed the doppler-oidc-auth branch 2 times, most recently from 0c56601 to fcae74d Compare October 20, 2025 21:55

mikesellitto requested a review from jakobmoellerdev October 20, 2025 22:50

jakobmoellerdev reviewed Dec 1, 2025

View reviewed changes

pkg/provider/doppler/auth_oidc.go Outdated Show resolved Hide resolved

jakobmoellerdev reviewed Dec 1, 2025

View reviewed changes

providers/v1/doppler/client.go Show resolved Hide resolved

mikesellitto force-pushed the doppler-oidc-auth branch 3 times, most recently from da0bec2 to 0b0d312 Compare December 2, 2025 19:55

mikesellitto requested a review from jakobmoellerdev December 2, 2025 20:06

jakobmoellerdev previously approved these changes Dec 2, 2025

View reviewed changes

jakobmoellerdev requested a review from Skarlso December 2, 2025 23:15

jakobmoellerdev moved this to In Review in External Secrets Dec 2, 2025

github-advanced-security bot found potential problems Dec 2, 2025

View reviewed changes

providers/v1/doppler/auth_oidc.go Dismissed Show dismissed Hide dismissed

providers/v1/doppler/auth_oidc.go Dismissed Show dismissed Hide dismissed

mikesellitto dismissed jakobmoellerdev’s stale review via 8e59609 December 4, 2025 23:03

mikesellitto force-pushed the doppler-oidc-auth branch from 0b0d312 to 8e59609 Compare December 4, 2025 23:03

mikesellitto requested a review from jakobmoellerdev December 4, 2025 23:04

mikesellitto force-pushed the doppler-oidc-auth branch 2 times, most recently from c0d594c to ab8a80f Compare December 8, 2025 18:33

mikesellitto added 4 commits December 9, 2025 18:38

feat: add OIDC authentication API types for Doppler provider

50105c4

Signed-off-by: Mike Sellitto <mike.sellitto@doppler.com>

feat: implement OIDC token manager for Doppler provider

266048f

Signed-off-by: Mike Sellitto <mike.sellitto@doppler.com>

feat: integrate OIDC authentication into Doppler provider

7ecaa98

Signed-off-by: Mike Sellitto <mike.sellitto@doppler.com>

docs: add Doppler OIDC authentication documentation

77e1ea2

Signed-off-by: Mike Sellitto <mike.sellitto@doppler.com>

mikesellitto force-pushed the doppler-oidc-auth branch from ab8a80f to 77e1ea2 Compare December 9, 2025 23:38

Merge branch 'main' into doppler-oidc-auth

0a8552c

Skarlso approved these changes Dec 11, 2025

View reviewed changes

Skarlso merged commit 7125163 into external-secrets:main Dec 11, 2025
30 checks passed

github-project-automation bot moved this from In Review to Done in External Secrets Dec 11, 2025

This was referenced Jan 28, 2026

feat: add Pulumi OIDC-based authentication #5893

Open

Add OIDC-based authentication support for Pulumi provider #5897

Open

Uh oh!

Conversation

mikesellitto commented Oct 16, 2025

Problem Statement

Related Issue

Proposed Changes

Checklist

Uh oh!

mikesellitto commented Oct 17, 2025

Uh oh!

Skarlso commented Oct 20, 2025

Uh oh!

Uh oh!

jakobmoellerdev Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Skarlso Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Oct 20, 2025

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

mikesellitto commented Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

Skarlso commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mikesellitto commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mikesellitto commented Dec 4, 2025

Uh oh!

Skarlso commented Dec 8, 2025

Uh oh!

mikesellitto commented Dec 9, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

sonarqubecloud bot commented Dec 11, 2025

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Skarlso commented Dec 3, 2025 •

edited

Loading

mikesellitto commented Dec 4, 2025 •

edited

Loading