chore: Get validating webhook failurePolicy for Secretstore dynamically by LochanRn · Pull Request #5605 · external-secrets/external-secrets

LochanRn · 2025-11-17T11:46:50Z

Problem Statement

What is the problem you're trying to solve?

Webhook Timeout Issue: The Kubernetes API server was unable to reach the External Secrets
Operator validation webhook, causing a timeout error:
Post "https://external-secrets-webhook.uipath.svc:443/validate-external-secrets-io-v1-secret
store?timeout=5s": context deadline exceeded

This is a known issue in EKS clusters where the API server (which runs on the control plane
outside the VPC) cannot resolve cluster DNS names for webhook services.

Related Issue

Fixes #956

Proposed Changes

I want to Ignore failurePolicy even for secretstore when i disable it for external secrets.

How do you like to solve the issue and why?

I have updated the templates in validating webhook.

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

charts
templating

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

This PR makes the validating webhook failurePolicy configurable via Helm values for the SecretStore (namespaced) and ExternalSecret validating webhooks by adding failurePolicy: {{ .Values.webhook.failurePolicy }} to their webhook definitions in deploy/charts/external-secrets/templates/validatingwebhook.yaml. The ClusterSecretStore webhook was not modified.

gusfcarvalho · 2025-11-17T12:55:02Z

hi @LochanRn . #956 was not caused by this issue. It was a problem on the port related to external-secrets-webhook when using EKS.

If you want to ignore the webhook because you expect it to fail everytime, I'd suggest you to instead just disable it. You'll earn a lot when it comes to APIServer responses due to avoiding the whole timeout checks.

gusfcarvalho · 2025-11-17T12:55:30Z

(Though, I could see this contribution by itself could be useful for tricky upgrades within the user base).

Signed-off-by: LochanRn <rn.lochan@gmail.com>

sonarqubecloud · 2025-11-18T07:33:10Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

LochanRn · 2025-11-18T10:28:10Z

hi @LochanRn . #956 was not caused by this issue. It was a problem on the port related to external-secrets-webhook when using EKS.

If you want to ignore the webhook because you expect it to fail everytime, I'd suggest you to instead just disable it. You'll earn a lot when it comes to APIServer responses due to avoiding the whole timeout checks.

makes sense, but i think this PR might still helpfull.

Skarlso · 2025-11-24T07:51:28Z

Can you please fix the sonar issue for formatting. Then please add a test for this under the helm tests to see that nothing is being messed up. Thanks.

coderabbitai · 2026-01-09T13:10:24Z

Walkthrough

Adds a failurePolicy field to the first webhook (validate.secretstore.external-secrets.io) in the ValidatingWebhookConfiguration template of the external-secrets Helm chart, sourcing the value from .Values.webhook.failurePolicy.

Changes

Cohort / File(s)	Summary
Webhook Configuration `deploy/charts/external-secrets/templates/validatingwebhook.yaml`	Adds a `failurePolicy` field to the first ValidatingWebhookConfiguration webhook (`validate.secretstore.external-secrets.io`), populated from `.Values.webhook.failurePolicy`.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR makes a targeted change to add dynamic failurePolicy configuration to the SecretStore validating webhook, which aligns with the intent to resolve webhook timeout issues on EKS by allowing failurePolicy to be controlled via Helm values.
Out of Scope Changes check	✅ Passed	The change is narrowly scoped to add the failurePolicy field to one validating webhook configuration in the Helm template, directly addressing the linked issue without introducing unrelated modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

deploy/charts/external-secrets/templates/validatingwebhook.yaml (1)
36-50: Missing failurePolicy for ClusterSecretStore webhook.

According to the PR description, both SecretStore and ClusterSecretStore should have failurePolicy configured dynamically. However, the ClusterSecretStore webhook is missing this field. This creates an inconsistency where only SecretStore respects the failurePolicy setting, while ClusterSecretStore operations could still fail due to webhook timeouts in environments with connectivity issues (like the EKS scenario described in issue #956).
🔧 Proposed fix to add failurePolicy
   admissionReviewVersions: ["v1", "v1beta1"]
   sideEffects: None
   timeoutSeconds: 5
+  failurePolicy: {{ .Values.webhook.failurePolicy }}
 ---

🤖 Fix all issues with AI agents

In @deploy/charts/external-secrets/templates/validatingwebhook.yaml:
- Line 34: The Helm template for the validating webhook sets failurePolicy using
the expression {{ .Values.webhook.failurePolicy}} which lacks a space before the
closing braces; update the template expression to include a space before the
closing braces (e.g., use {{ .Values.webhook.failurePolicy }}) and make the same
spacing correction for the matching occurrence on line 84 to resolve the
formatting inconsistency.

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7b160ce and b62a70c.

📒 Files selected for processing (1)

deploy/charts/external-secrets/templates/validatingwebhook.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)

GitHub Check: publish-artifacts (Dockerfile.ubi, CGO_ENABLED=0 GOEXPERIMENT=boringcrypto, amd64 ppc64le, linux/... / Build and Publish
GitHub Check: publish-artifacts (Dockerfile.ubi, CGO_ENABLED=0, amd64 arm64 ppc64le, linux/amd64,linux/arm64,li... / Build and Publish
GitHub Check: publish-artifacts (Dockerfile, CGO_ENABLED=0, amd64 arm64 s390x ppc64le, linux/amd64,linux/arm64,... / Build and Publish
GitHub Check: unit-tests
GitHub Check: check-diff
GitHub Check: Analyze project (actions, none)
GitHub Check: Analyze project (go, autobuild)
GitHub Check: lint-and-test

🔇 Additional comments (1)

deploy/charts/external-secrets/templates/validatingwebhook.yaml (1)

34-34: No action needed — the webhook.failurePolicy value is already defined in values.yaml, and helm tests for webhook functionality already exist.

The template reference to .Values.webhook.failurePolicy is properly supported by the values.yaml file (line 402, set to Fail by default). Additionally, helm tests are already present in the repository at deploy/charts/external-secrets/tests/webhook_test.yaml and related test files, so the maintainer's requirement for test coverage is already satisfied.

Likely an incorrect or invalid review comment.

deploy/charts/external-secrets/templates/validatingwebhook.yaml

Skarlso · 2026-01-09T13:27:32Z

@LochanRn if you take care of the formatting and run make check-diff we can merge this. :)

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com>

Skarlso · 2026-02-06T12:41:48Z

/ok-to-test sha=34e20e15c990e90cf6b52edf459faa50e5037f87

eso-service-account-app · 2026-02-06T12:59:50Z

[Bot] - ✅ e2e for 34e20e15c990e90cf6b52edf459faa50e5037f87 passed

sonarqubecloud · 2026-02-06T13:02:39Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…2 (#3782) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | major | `v1.3.2` → `v2.0.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.0.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.0) [Compare Source](external-secrets/external-secrets@v1.3.2...v2.0.0) ### BREAKING CHANGE Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42. Image: `ghcr.io/external-secrets/external-secrets:v2.0.0` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump charts to 1.3.2 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5923](external-secrets/external-secrets#5923) - feat(charts): add hostAliases support by [@janlauber](https://github.com/janlauber) in [#5866](external-secrets/external-secrets#5866) - chore: remove unmaintained secret stores by [@Skarlso](https://github.com/Skarlso) in [#5918](external-secrets/external-secrets#5918) - docs(infisical): document al provider auth methods by [@varonix0](https://github.com/varonix0) in [#5929](external-secrets/external-secrets#5929) - chore: Get validating webhook failurePolicy for Secretstore dynamically by [@LochanRn](https://github.com/LochanRn) in [#5605](external-secrets/external-secrets#5605) #### New Contributors - [@LochanRn](https://github.com/LochanRn) made their first contribution in [#5605](external-secrets/external-secrets#5605) **Full Changelog**: <external-secrets/external-secrets@v1.3.2...v2.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3782 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | major | `1.3.2` → `2.0.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.0.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.0) [Compare Source](external-secrets/external-secrets@v1.3.2...v2.0.0) ### BREAKING CHANGE Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42. Image: `ghcr.io/external-secrets/external-secrets:v2.0.0` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump charts to 1.3.2 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5923](external-secrets/external-secrets#5923) - feat(charts): add hostAliases support by [@janlauber](https://github.com/janlauber) in [#5866](external-secrets/external-secrets#5866) - chore: remove unmaintained secret stores by [@Skarlso](https://github.com/Skarlso) in [#5918](external-secrets/external-secrets#5918) - docs(infisical): document al provider auth methods by [@varonix0](https://github.com/varonix0) in [#5929](external-secrets/external-secrets#5929) - chore: Get validating webhook failurePolicy for Secretstore dynamically by [@LochanRn](https://github.com/LochanRn) in [#5605](external-secrets/external-secrets#5605) #### New Contributors - [@LochanRn](https://github.com/LochanRn) made their first contribution in [#5605](external-secrets/external-secrets#5605) **Full Changelog**: <external-secrets/external-secrets@v1.3.2...v2.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3788 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…ly (external-secrets#5605) * Get validating webhook failurePolicy for Secretstore dynamically Signed-off-by: LochanRn <rn.lochan@gmail.com> * fix the formatting Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com> --------- Signed-off-by: LochanRn <rn.lochan@gmail.com> Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | major | `1.3.2` → `2.0.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.0.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.0.0) [Compare Source](external-secrets/external-secrets@v1.3.2...v2.0.0) ### BREAKING CHANGE Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42. Image: `ghcr.io/external-secrets/external-secrets:v2.0.0` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump charts to 1.3.2 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5923](external-secrets/external-secrets#5923) - feat(charts): add hostAliases support by [@janlauber](https://github.com/janlauber) in [#5866](external-secrets/external-secrets#5866) - chore: remove unmaintained secret stores by [@Skarlso](https://github.com/Skarlso) in [#5918](external-secrets/external-secrets#5918) - docs(infisical): document al provider auth methods by [@varonix0](https://github.com/varonix0) in [#5929](external-secrets/external-secrets#5929) - chore: Get validating webhook failurePolicy for Secretstore dynamically by [@LochanRn](https://github.com/LochanRn) in [#5605](external-secrets/external-secrets#5605) #### New Contributors - [@LochanRn](https://github.com/LochanRn) made their first contribution in [#5605](external-secrets/external-secrets#5605) **Full Changelog**: <external-secrets/external-secrets@v1.3.2...v2.0.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://kubara.git.onstackit.cloud/STACKIT/kubara/pulls/283

…ly (external-secrets#5605) * Get validating webhook failurePolicy for Secretstore dynamically Signed-off-by: LochanRn <rn.lochan@gmail.com> * fix the formatting Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com> --------- Signed-off-by: LochanRn <rn.lochan@gmail.com> Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

github-project-automation bot added this to External Secrets Nov 17, 2025

github-actions bot added kind/chore Categorizes Pull Requests for chore activities (like bumping versions) size/xs labels Nov 17, 2025

LochanRn force-pushed the lochan/update-external-secrets-helm-charts branch 2 times, most recently from 583b741 to e2f9571 Compare November 17, 2025 12:34

Get validating webhook failurePolicy for Secretstore dynamically

621cd38

Signed-off-by: LochanRn <rn.lochan@gmail.com>

LochanRn force-pushed the lochan/update-external-secrets-helm-charts branch from e2f9571 to 621cd38 Compare November 18, 2025 07:32

Merge branch 'main' into lochan/update-external-secrets-helm-charts

b62a70c

coderabbitai bot reviewed Jan 9, 2026

View reviewed changes

deploy/charts/external-secrets/templates/validatingwebhook.yaml Outdated Show resolved Hide resolved

Skarlso and others added 2 commits February 6, 2026 13:40

fix the formatting

bd6dfa1

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com>

Merge branch 'main' into lochan/update-external-secrets-helm-charts

34e20e1

Merge branch 'main' into lochan/update-external-secrets-helm-charts

da76ee6

Skarlso approved these changes Feb 6, 2026

View reviewed changes

Skarlso merged commit 7aa2fd7 into external-secrets:main Feb 6, 2026
9 checks passed

github-project-automation bot moved this to Done in External Secrets Feb 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: Get validating webhook failurePolicy for Secretstore dynamically#5605

chore: Get validating webhook failurePolicy for Secretstore dynamically#5605
Skarlso merged 5 commits intoexternal-secrets:mainfrom
LochanRn:lochan/update-external-secrets-helm-charts

LochanRn commented Nov 17, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

gusfcarvalho commented Nov 17, 2025

Uh oh!

gusfcarvalho commented Nov 17, 2025

Uh oh!

sonarqubecloud bot commented Nov 18, 2025

Uh oh!

LochanRn commented Nov 18, 2025 •

edited

Loading

Uh oh!

Skarlso commented Nov 24, 2025

Uh oh!

coderabbitai bot commented Jan 9, 2026 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Skarlso commented Jan 9, 2026

Uh oh!

Skarlso commented Feb 6, 2026

Uh oh!

eso-service-account-app bot commented Feb 6, 2026

Uh oh!

sonarqubecloud bot commented Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

LochanRn commented Nov 17, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Format

Checklist

Uh oh!

gusfcarvalho commented Nov 17, 2025

Uh oh!

gusfcarvalho commented Nov 17, 2025

Uh oh!

sonarqubecloud bot commented Nov 18, 2025

Quality Gate passed

Uh oh!

LochanRn commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Nov 24, 2025

Uh oh!

coderabbitai bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Skarlso commented Jan 9, 2026

Uh oh!

Skarlso commented Feb 6, 2026

Uh oh!

eso-service-account-app bot commented Feb 6, 2026

Uh oh!

sonarqubecloud bot commented Feb 6, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

LochanRn commented Nov 17, 2025 •

edited by coderabbitai bot

Loading

LochanRn commented Nov 18, 2025 •

edited

Loading

coderabbitai bot commented Jan 9, 2026 •

edited

Loading