feat(charts): add global values for common deployment configurations by Gabryel8818 · Pull Request #5652 · external-secrets/external-secrets

Gabryel8818 · 2025-11-27T22:02:39Z

Problem Statement

Currently, when users need to apply common configurations like podLabels, podAnnotations, imagePullSecrets, or use a custom repository across all three deployments (controller, webhook, and cert-controller), they must declare these values separately for each deployment. This leads to repetitive configuration and makes it harder to maintain consistency across the chart.

Proposed Changes

This PR introduces global configuration values that can be used across all deployments in the external-secrets Helm chart. The implementation follows a simple precedence model: local values take priority over global values when defined, otherwise global values are used.

Changes Made:

Added Global Values (values.yaml):
- global.podLabels: Global pod labels applied to all deployments
- global.podAnnotations: Global pod annotations applied to all deployments
- global.imagePullSecrets: Global image pull secrets applied to all deployments
- global.repository: Global image repository applied to all deployments
Updated Deployment Templates:
- Modified deployment.yaml, webhook-deployment.yaml, and cert-controller-deployment.yaml to use if/else logic
- If local value is defined → use local value
- Else if global value is defined → use global value
- No merging strategy to keep the logic simple and predictable
Updated Helper Functions (_helpers.tpl):
- Modified external-secrets.image template to support global.repository
- Falls back to local repository when global is not set
Comprehensive Test Coverage:
- Created global_values_test.yaml with 26 tests covering:
  - Global values used when local values not set (for all 3 deployments)
  - Local values take precedence over global values (for all 3 deployments)
  - All 4 global configuration options (podLabels, podAnnotations, imagePullSecrets, repository)
  - Combined scenarios with multiple global values
Documentation:
- README automatically updated via make helm.docs to reflect new global values

Why This Approach:

Simplicity: Clear if/else logic without complex merging strategies
Predictability: Easy to understand which value will be used
Backward Compatibility: Existing configurations continue to work without changes
DRY Principle: Reduces configuration duplication across deployments
Flexibility: Users can still override global values per deployment when needed

Format

feat(charts): add global values for common deployment configurations

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage (26 tests added)
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Deployment Commands

1. Create Namespace

kubectl create namespace external-secrets-test

Output:

namespace/external-secrets-test created

2. Install Helm Chart with Global Values

cd deploy/charts/external-secrets
helm install external-secrets-test . \
  --namespace external-secrets-test \
  --set global.podLabels.team=platform \
  --set global.podLabels.environment=production \
  --set global.podAnnotations.owner=platform-team \
  --set global.podAnnotations.monitoring=prometheus \
  --set global.repository="ghcr.io/external-secrets/external-secrets"

Output:

I1210 14:07:31.354700  466151 warnings.go:110] "Warning: unrecognized format \"int32\""
I1210 14:07:31.378952  466151 warnings.go:110] "Warning: unrecognized format \"int64\""
I1210 14:07:31.378985  466151 warnings.go:110] "Warning: unrecognized format \"int32\""
I1210 14:07:31.431406  466151 warnings.go:110] "Warning: unrecognized format \"int64\""
I1210 14:07:31.431476  466151 warnings.go:110] "Warning: unrecognized format \"int32\""
I1210 14:07:31.496899  466151 warnings.go:110] "Warning: unrecognized format \"int64\""
I1210 14:07:31.496947  466151 warnings.go:110] "Warning: unrecognized format \"int32\""
I1210 14:07:31.497271  466151 warnings.go:110] "Warning: unrecognized format \"int64\""
I1210 14:07:31.497290  466151 warnings.go:110] "Warning: unrecognized format \"int32\""
NAME: external-secrets-test
LAST DEPLOYED: Wed Dec 10 14:07:30 2025
NAMESPACE: external-secrets-test
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
external-secrets has been deployed successfully in namespace external-secrets-test!

In order to begin using ExternalSecrets, you will need to set up a SecretStore
or ClusterSecretStore resource (for example, by creating a 'vault' SecretStore).

More information on the different types of SecretStores and how to configure them
can be found in our Github: https://github.com/external-secrets/external-secrets

Note: The "unrecognized format" warnings are from CRD schema definitions and are expected. They don't affect functionality.

✅ Installation successful!

Verification

3. Check Deployment Status

kubectl get deployments -n external-secrets-test

Output:

NAME                                    READY   UP-TO-DATE   AVAILABLE   AGE
external-secrets-test                   1/1     1            1           3m
external-secrets-test-cert-controller   1/1     1            1           3m
external-secrets-test-webhook           1/1     1            1           3m

✅ All 3 deployments are running and available (1/1)

4. Check Pod Status

kubectl get pods -n external-secrets-test

Output:

NAME                                                     READY   STATUS    RESTARTS   AGE
external-secrets-test-5bbbcc4978-5lfpb                   1/1     Running   0          3m10s
external-secrets-test-cert-controller-67d7b9ff6c-xjxnn   1/1     Running   0          3m10s
external-secrets-test-webhook-76cfd9b48d-snd7p           1/1     Running   0          3m10s

✅ All 3 pods are running successfully

5. Verify Global podLabels and podAnnotations Applied

kubectl get pod -n external-secrets-test -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{.metadata.labels}{"\n\n"}{end}'

Output:

external-secrets-test-5bbbcc4978-5lfpb
{
  "app.kubernetes.io/instance": "external-secrets-test",
  "app.kubernetes.io/managed-by": "Helm",
  "app.kubernetes.io/name": "external-secrets",
  "app.kubernetes.io/version": "v1.1.1",
  "environment": "production",
  "helm.sh/chart": "external-secrets-1.1.1",
  "pod-template-hash": "5bbbcc4978",
  "team": "platform"
}

external-secrets-test-cert-controller-67d7b9ff6c-xjxnn
{
  "app.kubernetes.io/instance": "external-secrets-test",
  "app.kubernetes.io/managed-by": "Helm",
  "app.kubernetes.io/name": "external-secrets-cert-controller",
  "app.kubernetes.io/version": "v1.1.1",
  "environment": "production",
  "helm.sh/chart": "external-secrets-1.1.1",
  "pod-template-hash": "67d7b9ff6c",
  "team": "platform"
}

external-secrets-test-webhook-76cfd9b48d-snd7p
{
  "app.kubernetes.io/instance": "external-secrets-test",
  "app.kubernetes.io/managed-by": "Helm",
  "app.kubernetes.io/name": "external-secrets-webhook",
  "app.kubernetes.io/version": "v1.1.1",
  "environment": "production",
  "helm.sh/chart": "external-secrets-1.1.1",
  "pod-template-hash": "76cfd9b48d",
  "team": "platform"
}

✅ Global labels present in ALL pods:

team: platform ✓
environment: production ✓

Check Pod Annotations

kubectl get pod -n external-secrets-test -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{.metadata.annotations}{"\n\n"}{end}'

Output:

external-secrets-test-5bbbcc4978-5lfpb
{
  "monitoring": "prometheus",
  "owner": "platform-team"
}

external-secrets-test-cert-controller-67d7b9ff6c-xjxnn
{
  "monitoring": "prometheus",
  "owner": "platform-team"
}

external-secrets-test-webhook-76cfd9b48d-snd7p
{
  "monitoring": "prometheus",
  "owner": "platform-team"
}

✅ Global annotations present in ALL pods:

owner: platform-team ✓
monitoring: prometheus ✓

6. Verify Controller Deployment Template

kubectl get deployment external-secrets-test -n external-secrets-test -o yaml | grep -A 15 "template:" | grep -A 12 "metadata:"

Output:

    metadata:
      annotations:
        monitoring: prometheus
        owner: platform-team
      labels:
        app.kubernetes.io/instance: external-secrets-test
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: external-secrets
        app.kubernetes.io/version: v1.1.1
        environment: production
        helm.sh/chart: external-secrets-1.1.1
        team: platform

✅ Global labels and annotations in controller deployment template

7. Verify Webhook Deployment Template

kubectl get deployment external-secrets-test-webhook -n external-secrets-test -o yaml | grep -A 15 "template:" | grep -A 12 "metadata:"

Output:

    metadata:
      annotations:
        monitoring: prometheus
        owner: platform-team
      labels:
        app.kubernetes.io/instance: external-secrets-test
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: external-secrets-webhook
        app.kubernetes.io/version: v1.1.1
        environment: production
        helm.sh/chart: external-secrets-1.1.1
        team: platform

✅ Global labels and annotations in webhook deployment template

8. Verify Cert-Controller Deployment Template

kubectl get deployment external-secrets-test-cert-controller -n external-secrets-test -o yaml | grep -A 15 "template:" | grep -A 12 "metadata:"

Output:

    metadata:
      annotations:
        monitoring: prometheus
        owner: platform-team
      labels:
        app.kubernetes.io/instance: external-secrets-test
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: external-secrets-cert-controller
        app.kubernetes.io/version: v1.1.1
        environment: production
        helm.sh/chart: external-secrets-1.1.1
        team: platform

✅ Global labels and annotations in cert-controller deployment template

9. Verify Global Repository Applied

kubectl get deployment external-secrets-test -n external-secrets-test -o jsonpath='{.spec.template.spec.containers[0].image}'

Output:

ghcr.io/external-secrets/external-secrets:v1.1.1

✅ Global repository applied: ghcr.io/external-secrets/external-secrets

10. Check Controller Logs

kubectl logs -n external-secrets-test -l app.kubernetes.io/name=external-secrets --tail=10

Output:

{"level":"info","ts":1765386499.905142,"msg":"Starting Controller","controller":"secretstore","controllerGroup":"external-secrets.io","controllerKind":"SecretStore"}
{"level":"info","ts":1765386499.9051476,"msg":"Starting workers","controller":"secretstore","controllerGroup":"external-secrets.io","controllerKind":"SecretStore","worker count":1}
{"level":"info","ts":1765386499.9052277,"msg":"Starting Controller","controller":"pushsecret","controllerGroup":"external-secrets.io","controllerKind":"PushSecret"}
{"level":"info","ts":1765386499.9052436,"msg":"Starting workers","controller":"pushsecret","controllerGroup":"external-secrets.io","controllerKind":"PushSecret","worker count":1}
{"level":"info","ts":1765386499.9062235,"msg":"Starting Controller","controller":"clusterexternalsecret","controllerGroup":"external-secrets.io","controllerKind":"ClusterExternalSecret"}
{"level":"info","ts":1765386499.9062366,"msg":"Starting workers","controller":"clusterexternalsecret","controllerGroup":"external-secrets.io","controllerKind":"ClusterExternalSecret","worker count":1}
{"level":"info","ts":1765386499.906286,"msg":"Starting Controller","controller":"clusterpushsecret","controllerGroup":"external-secrets.io","controllerKind":"ClusterPushSecret"}
{"level":"info","ts":1765386499.9062984,"msg":"Starting workers","controller":"clusterpushsecret","controllerGroup":"external-secrets.io","controllerKind":"ClusterPushSecret","worker count":1}
{"level":"info","ts":1765386499.9063685,"msg":"Starting Controller","controller":"externalsecret","controllerGroup":"external-secrets.io","controllerKind":"ExternalSecret"}
{"level":"info","ts":1765386499.906376,"msg":"Starting workers","controller":"externalsecret","controllerGroup":"external-secrets.io","controllerKind":"ExternalSecret","worker count":1}

✅ Controller is running and all workers started successfully

Summary

✅ Deployment Successful

All components deployed and running:

✅ Controller deployment: 1/1 ready
✅ Webhook deployment: 1/1 ready
✅ Cert-Controller deployment: 1/1 ready

✅ Global Values Applied Successfully

Global podLabels:

team: platform → Present in all 3 deployments ✓
environment: production → Present in all 3 deployments ✓

Global podAnnotations:

owner: platform-team → Present in all 3 deployments ✓
monitoring: prometheus → Present in all 3 deployments ✓

Global repository:

ghcr.io/external-secrets/external-secrets → Applied to all containers ✓

✅ Functionality Verified

All pods running: 3/3 pods in Running state with 0 restarts
Controllers started: All external-secrets controllers initialized successfully
No errors: Clean logs with successful worker initialization
Labels propagated: Global labels visible in pod metadata and deployment templates
Annotations propagated: Global annotations visible in pod metadata and deployment templates
Repository applied: Global image repository used across all deployments

Skarlso · 2025-12-10T06:19:29Z

This looks reasonable to me. After test fixes ofc. And can you please show some manual testing as well since this is a rather significant update to our helm charts.

Skarlso · 2025-12-10T15:11:29Z

/ok-to-test sha=bfd23b854ab5f87a6bdc11fef86d098770ac2bba

eso-service-account-app · 2025-12-10T15:30:05Z

[Bot] - ❌ e2e for bfd23b854ab5f87a6bdc11fef86d098770ac2bba failed

Gabryel8818 · 2025-12-10T16:52:09Z

This looks reasonable to me. After test fixes ofc. And can you please show some manual testing as well since this is a rather significant update to our helm charts.

I've included the manual tests in the PR description. Is this format okay for you?

Skarlso · 2025-12-10T17:04:01Z

I meant actually installing it and seeing that the variables are working and installation isn't broken :)

Gabryel8818 · 2025-12-10T17:19:53Z

I meant actually installing it and seeing that the variables are working and installation isn't broken :)

oh ok, sorry

I installed it on my local Kind cluster and the installation was successful. The logs and controller status are correct, and the labels were also deployed. The commands and logs are in PR description now

Skarlso · 2025-12-10T17:20:32Z

No worries, I wasn't really clear on that one. :D

Skarlso · 2025-12-10T17:21:18Z

/ok-to-test sha=909ca731e6d895ad69d01a7b70f9d7531be0fc22

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

sonarqubecloud · 2025-12-10T17:26:24Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

eso-service-account-app · 2025-12-10T17:39:06Z

[Bot] - ❌ e2e for 909ca731e6d895ad69d01a7b70f9d7531be0fc22 failed

Gabryel8818 · 2025-12-10T17:56:07Z

[Bot] - ❌ e2e for 909ca731e6d895ad69d01a7b70f9d7531be0fc22 failed

Hmm, how can I fix this error? I confess I didn't quite understand it.

Skarlso · 2025-12-10T20:49:43Z

Hmmm, it doesn't seem to be related, but sadly pops up frequently now-a-days. I'll restart it, let's see if it persists.

eso-service-account-app · 2025-12-10T21:05:19Z

[Bot] - ✅ e2e for 909ca731e6d895ad69d01a7b70f9d7531be0fc22 passed

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.1.1` -> `1.2.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](external-secrets/external-secrets@v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump 1.1.1 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5687](external-secrets/external-secrets#5687) - chore: fix the argocd e2e test case by [@Skarlso](https://github.com/Skarlso) in [#5688](external-secrets/external-secrets#5688) - feat(provider): add Barbican provider support by [@rkferreira](https://github.com/rkferreira) in [#5398](external-secrets/external-secrets#5398) - docs(secretserver): promote secretserver provider to beta by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5668](external-secrets/external-secrets#5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@Ilhan-Personal](https://github.com/Ilhan-Personal) in [#5653](external-secrets/external-secrets#5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@iypetrov](https://github.com/iypetrov) in [#5685](external-secrets/external-secrets#5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@tokiwong](https://github.com/tokiwong) in [#5708](external-secrets/external-secrets#5708) - feat: introduce store deprecation by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5711](external-secrets/external-secrets#5711) - feat(charts): add global values for common deployment configurations by [@Gabryel8818](https://github.com/Gabryel8818) in [#5652](external-secrets/external-secrets#5652) - feat: add Doppler OIDC-based authentication by [@mikesellitto](https://github.com/mikesellitto) in [#5475](external-secrets/external-secrets#5475) - fix: make custom configuration available regardless of environment by [@Skarlso](https://github.com/Skarlso) in [#5713](external-secrets/external-secrets#5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@Skarlso](https://github.com/Skarlso) in [#5719](external-secrets/external-secrets#5719) - docs(templating): update rbac for generic targets by [@lostick](https://github.com/lostick) in [#5736](external-secrets/external-secrets#5736) - fix(testing): Breaking changes should not break ci by [@evrardjp](https://github.com/evrardjp) in [#5739](external-secrets/external-secrets#5739) - fix(security): Get rid of getSecretKey by [@evrardjp](https://github.com/evrardjp) in [#5738](external-secrets/external-secrets#5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@cmoscofian](https://github.com/cmoscofian) in [#5622](external-secrets/external-secrets#5622) - docs: Fix example in GCP documentation by [@headcr4sh](https://github.com/headcr4sh) in [#5745](external-secrets/external-secrets#5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5742](external-secrets/external-secrets#5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@tosih](https://github.com/tosih) in [#5610](external-secrets/external-secrets#5610) - chore(docs): add clarification to helm values being disabled by [@Skarlso](https://github.com/Skarlso) in [#5746](external-secrets/external-secrets#5746) - fix(release): apply [`64dc681`](external-secrets/external-secrets@64dc681) to release by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5749](external-secrets/external-secrets#5749) - docs(release): 1.2 stability-support.md by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5750](external-secrets/external-secrets#5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5693](external-secrets/external-secrets#5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5702](external-secrets/external-secrets#5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@dependabot](https://github.com/dependabot)\[bot] in [#5655](external-secrets/external-secrets#5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5695](external-secrets/external-secrets#5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#5696](external-secrets/external-secrets#5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5697](external-secrets/external-secrets#5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5700](external-secrets/external-secrets#5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5698](external-secrets/external-secrets#5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5699](external-secrets/external-secrets#5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5705](external-secrets/external-secrets#5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@dependabot](https://github.com/dependabot)\[bot] in [#5692](external-secrets/external-secrets#5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5703](external-secrets/external-secrets#5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5704](external-secrets/external-secrets#5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5706](external-secrets/external-secrets#5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5701](external-secrets/external-secrets#5701) - chore(deps): bump golang from `2611181` to `2611181` by [@dependabot](https://github.com/dependabot)\[bot] in [#5721](external-secrets/external-secrets#5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5725](external-secrets/external-secrets#5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5730](external-secrets/external-secrets#5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#5726](external-secrets/external-secrets#5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5724](external-secrets/external-secrets#5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5732](external-secrets/external-secrets#5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@dependabot](https://github.com/dependabot)\[bot] in [#5722](external-secrets/external-secrets#5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5729](external-secrets/external-secrets#5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@dependabot](https://github.com/dependabot)\[bot] in [#5694](external-secrets/external-secrets#5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](external-secrets/external-secrets@712b439) to [`071811a`](external-secrets/external-secrets@071811a) by [@dependabot](https://github.com/dependabot)\[bot] in [#5727](external-secrets/external-secrets#5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5731](external-secrets/external-secrets#5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5728](external-secrets/external-secrets#5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5723](external-secrets/external-secrets#5723) #### New Contributors - [@iypetrov](https://github.com/iypetrov) made their first contribution in [#5685](external-secrets/external-secrets#5685) - [@tokiwong](https://github.com/tokiwong) made their first contribution in [#5708](external-secrets/external-secrets#5708) - [@Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#5652](external-secrets/external-secrets#5652) - [@mikesellitto](https://github.com/mikesellitto) made their first contribution in [#5475](external-secrets/external-secrets#5475) - [@lostick](https://github.com/lostick) made their first contribution in [#5736](external-secrets/external-secrets#5736) - [@cmoscofian](https://github.com/cmoscofian) made their first contribution in [#5622](external-secrets/external-secrets#5622) - [@headcr4sh](https://github.com/headcr4sh) made their first contribution in [#5745](external-secrets/external-secrets#5745) - [@tosih](https://github.com/tosih) made their first contribution in [#5610](external-secrets/external-secrets#5610) **Full Changelog**: <external-secrets/external-secrets@v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/2737 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

github-project-automation bot added this to External Secrets Nov 27, 2025

github-actions bot added the size/l label Nov 27, 2025

Gabryel8818 changed the title ~~Add new helm chart global values~~ feat: add new helm chart global values Nov 27, 2025

github-actions bot added the kind/feature Categorizes issue or PR as related to a new feature. label Nov 27, 2025

Gabryel8818 marked this pull request as ready for review November 27, 2025 22:04

igoritos22 approved these changes Nov 28, 2025

View reviewed changes

Gabryel8818 changed the title ~~feat: add new helm chart global values~~ feat(helm-chart): add new helm chart global values Nov 28, 2025

github-actions bot added the area/helm-chart label Nov 28, 2025

Gabryel8818 changed the title ~~feat(helm-chart): add new helm chart global values~~ feat(charts): add new helm chart global values Nov 28, 2025

github-actions bot added the area/charts Issues / Pull Requests related to our helm charts label Nov 28, 2025

Gabryel8818 changed the title ~~feat(charts): add new helm chart global values~~ feat(charts): add global values for common deployment configurations Nov 28, 2025

Gabryel8818 force-pushed the feat/add-new-helm-chart-global-values branch 3 times, most recently from b39aa07 to cb8bc31 Compare December 5, 2025 18:03

Gabryel8818 force-pushed the feat/add-new-helm-chart-global-values branch from 3d29520 to 909ca73 Compare December 10, 2025 17:03

Gabryel8818 added 7 commits December 10, 2025 14:25

feat: add repository variable for global repository

9a04234

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: add certController global values

c75ef56

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: add global values for eso principal deployment

c1450b2

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: add global values for webhook deployment

659aa2b

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: add helm tests

0c7242c

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: add new global values

d886115

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: add new global values for schema

509a477

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

Gabryel8818 added 4 commits December 10, 2025 14:25

feat: update helm docs

094a8ba

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feat: update schema

04ead52

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

feaet: update values default

e67671e

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

fix: indentation for podLabels and podAnnotations in deployments

fe00d29

Signed-off-by: gabryel8818 <gabriel@gmn.dev.br>

Gabryel8818 force-pushed the feat/add-new-helm-chart-global-values branch from 909ca73 to fe00d29 Compare December 10, 2025 17:25

Skarlso approved these changes Dec 10, 2025

View reviewed changes

psilva310 approved these changes Dec 10, 2025

View reviewed changes

Skarlso merged commit 0e22d74 into external-secrets:main Dec 11, 2025
22 checks passed

github-project-automation bot moved this to Done in External Secrets Dec 11, 2025

Uh oh!

Conversation

Gabryel8818 commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Proposed Changes

Changes Made:

Why This Approach:

Format

Checklist

Deployment Commands

1. Create Namespace

2. Install Helm Chart with Global Values

Verification

3. Check Deployment Status

4. Check Pod Status

5. Verify Global podLabels and podAnnotations Applied

Check Pod Annotations

6. Verify Controller Deployment Template

7. Verify Webhook Deployment Template

8. Verify Cert-Controller Deployment Template

9. Verify Global Repository Applied

10. Check Controller Logs

Summary

✅ Deployment Successful

✅ Global Values Applied Successfully

✅ Functionality Verified

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

eso-service-account-app bot commented Dec 10, 2025

Uh oh!

Gabryel8818 commented Dec 10, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

Gabryel8818 commented Dec 10, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

sonarqubecloud bot commented Dec 10, 2025

Quality Gate passed

Uh oh!

eso-service-account-app bot commented Dec 10, 2025

Uh oh!

Gabryel8818 commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

eso-service-account-app bot commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Gabryel8818 commented Nov 27, 2025 •

edited

Loading

Gabryel8818 commented Dec 10, 2025 •

edited

Loading