fix(gcpsm): SecretExists should check for regional secrets when store location is specified by tokiwong · Pull Request #5708 · external-secrets/external-secrets

tokiwong · 2025-12-08T21:10:09Z

Problem Statement

What is the problem you're trying to solve?

Regional PushSecrets are failing with

status:
  conditions:
  - lastTransitionTime: "2025-12-08T20:28:41Z"
    message: 'set secret failed: could not verify if secret exists in store: rpc error:
      code = InvalidArgument desc = The provided Secret ID [projects/my-project/secrets/my-secret-key]
      does not match the expected format [projects/*/locations/*/secrets/*]'

specifying store.Location points the GSM client to regional endpoints: https://github.com/tokiwong/external-secrets/blob/a9b233b6936f9d1a08383cb8d26dd701acaa8d82/providers/v1/gcp/secretmanager/provider.go#L105-L111

failure starts when the reconciler pushes secrets to the gcpsm provider: https://github.com/tokiwong/external-secrets/blob/a9b233b6936f9d1a08383cb8d26dd701acaa8d82/pkg/controllers/pushsecret/pushsecret_controller.go#L394
then the reconciler checks for the secret when updatePolicy is IfNotExists: https://github.com/tokiwong/external-secrets/blob/a9b233b6936f9d1a08383cb8d26dd701acaa8d82/pkg/controllers/pushsecret/pushsecret_controller.go#L429
but the gcpsm SecretExists method only checks for the global path: https://github.com/tokiwong/external-secrets/blob/cd51fce9ff40935e48df0970881123f3ba957ee2/providers/v1/gcp/secretmanager/client.go#L150

Proposed Changes

Include a check for a given GCPSM secret store's Location to determine global vs regional secret paths for the secret FQDN

This follows a similar pattern defined in the following places:

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Skarlso · 2025-12-09T06:48:49Z

providers/v1/gcp/secretmanager/client.go

 // It verifies the existence of a secret in Google Cloud Secret Manager AND that it has at least one version.
 func (c *Client) SecretExists(ctx context.Context, ref esv1.PushSecretRemoteRef) (bool, error) {
 	secretName := fmt.Sprintf(globalSecretPath, c.store.ProjectID, ref.GetRemoteKey())
+	if c.store.Location != "" {


Sounds good. Please also update the tests to reflect this new behavior. Thanks!

Signed-off-by: Alvin Wong <alvin.wong@forgerock.com>

github-actions · 2025-12-09T18:24:43Z

This PR exceeds the recommended size of 10000 lines. Please make sure you are NOT addressing multiple issues with one PR. Note this PR might be rejected due to its size.

Signed-off-by: Alvin Wong <alvin.wong@forgerock.com>

Skarlso · 2025-12-10T06:27:29Z

Thanks for the test update. 🙇

Skarlso · 2025-12-10T06:47:09Z

/ok-to-test sha=cd2e8afc7fdb4e160863c1dba581398100eb9505

eso-service-account-app · 2025-12-10T07:04:33Z

[Bot] - ✅ e2e for cd2e8afc7fdb4e160863c1dba581398100eb9505 passed

sonarqubecloud · 2025-12-10T07:08:36Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.1.1` -> `1.2.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](external-secrets/external-secrets@v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump 1.1.1 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5687](external-secrets/external-secrets#5687) - chore: fix the argocd e2e test case by [@Skarlso](https://github.com/Skarlso) in [#5688](external-secrets/external-secrets#5688) - feat(provider): add Barbican provider support by [@rkferreira](https://github.com/rkferreira) in [#5398](external-secrets/external-secrets#5398) - docs(secretserver): promote secretserver provider to beta by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5668](external-secrets/external-secrets#5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@Ilhan-Personal](https://github.com/Ilhan-Personal) in [#5653](external-secrets/external-secrets#5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@iypetrov](https://github.com/iypetrov) in [#5685](external-secrets/external-secrets#5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@tokiwong](https://github.com/tokiwong) in [#5708](external-secrets/external-secrets#5708) - feat: introduce store deprecation by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5711](external-secrets/external-secrets#5711) - feat(charts): add global values for common deployment configurations by [@Gabryel8818](https://github.com/Gabryel8818) in [#5652](external-secrets/external-secrets#5652) - feat: add Doppler OIDC-based authentication by [@mikesellitto](https://github.com/mikesellitto) in [#5475](external-secrets/external-secrets#5475) - fix: make custom configuration available regardless of environment by [@Skarlso](https://github.com/Skarlso) in [#5713](external-secrets/external-secrets#5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@Skarlso](https://github.com/Skarlso) in [#5719](external-secrets/external-secrets#5719) - docs(templating): update rbac for generic targets by [@lostick](https://github.com/lostick) in [#5736](external-secrets/external-secrets#5736) - fix(testing): Breaking changes should not break ci by [@evrardjp](https://github.com/evrardjp) in [#5739](external-secrets/external-secrets#5739) - fix(security): Get rid of getSecretKey by [@evrardjp](https://github.com/evrardjp) in [#5738](external-secrets/external-secrets#5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@cmoscofian](https://github.com/cmoscofian) in [#5622](external-secrets/external-secrets#5622) - docs: Fix example in GCP documentation by [@headcr4sh](https://github.com/headcr4sh) in [#5745](external-secrets/external-secrets#5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5742](external-secrets/external-secrets#5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@tosih](https://github.com/tosih) in [#5610](external-secrets/external-secrets#5610) - chore(docs): add clarification to helm values being disabled by [@Skarlso](https://github.com/Skarlso) in [#5746](external-secrets/external-secrets#5746) - fix(release): apply [`64dc681`](external-secrets/external-secrets@64dc681) to release by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5749](external-secrets/external-secrets#5749) - docs(release): 1.2 stability-support.md by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5750](external-secrets/external-secrets#5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5693](external-secrets/external-secrets#5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5702](external-secrets/external-secrets#5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@dependabot](https://github.com/dependabot)\[bot] in [#5655](external-secrets/external-secrets#5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5695](external-secrets/external-secrets#5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#5696](external-secrets/external-secrets#5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5697](external-secrets/external-secrets#5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5700](external-secrets/external-secrets#5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5698](external-secrets/external-secrets#5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5699](external-secrets/external-secrets#5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5705](external-secrets/external-secrets#5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@dependabot](https://github.com/dependabot)\[bot] in [#5692](external-secrets/external-secrets#5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5703](external-secrets/external-secrets#5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5704](external-secrets/external-secrets#5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5706](external-secrets/external-secrets#5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5701](external-secrets/external-secrets#5701) - chore(deps): bump golang from `2611181` to `2611181` by [@dependabot](https://github.com/dependabot)\[bot] in [#5721](external-secrets/external-secrets#5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5725](external-secrets/external-secrets#5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5730](external-secrets/external-secrets#5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#5726](external-secrets/external-secrets#5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5724](external-secrets/external-secrets#5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5732](external-secrets/external-secrets#5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@dependabot](https://github.com/dependabot)\[bot] in [#5722](external-secrets/external-secrets#5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5729](external-secrets/external-secrets#5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@dependabot](https://github.com/dependabot)\[bot] in [#5694](external-secrets/external-secrets#5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](external-secrets/external-secrets@712b439) to [`071811a`](external-secrets/external-secrets@071811a) by [@dependabot](https://github.com/dependabot)\[bot] in [#5727](external-secrets/external-secrets#5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5731](external-secrets/external-secrets#5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5728](external-secrets/external-secrets#5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5723](external-secrets/external-secrets#5723) #### New Contributors - [@iypetrov](https://github.com/iypetrov) made their first contribution in [#5685](external-secrets/external-secrets#5685) - [@tokiwong](https://github.com/tokiwong) made their first contribution in [#5708](external-secrets/external-secrets#5708) - [@Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#5652](external-secrets/external-secrets#5652) - [@mikesellitto](https://github.com/mikesellitto) made their first contribution in [#5475](external-secrets/external-secrets#5475) - [@lostick](https://github.com/lostick) made their first contribution in [#5736](external-secrets/external-secrets#5736) - [@cmoscofian](https://github.com/cmoscofian) made their first contribution in [#5622](external-secrets/external-secrets#5622) - [@headcr4sh](https://github.com/headcr4sh) made their first contribution in [#5745](external-secrets/external-secrets#5745) - [@tosih](https://github.com/tosih) made their first contribution in [#5610](external-secrets/external-secrets#5610) **Full Changelog**: <external-secrets/external-secrets@v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/2737 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

github-project-automation bot added this to External Secrets Dec 8, 2025

github-actions bot added area/gcpsm kind/bug Categorizes issue or PR as related to a bug. size/xs labels Dec 8, 2025

tokiwong force-pushed the fix-secret-exists-check branch from cd51fce to fa52e37 Compare December 8, 2025 21:30

Skarlso reviewed Dec 9, 2025

View reviewed changes

github-actions bot added the size/s label Dec 9, 2025

check for store.Location for secretExists

89a93c5

Signed-off-by: Alvin Wong <alvin.wong@forgerock.com>

tokiwong force-pushed the fix-secret-exists-check branch from c377a93 to 9efef74 Compare December 9, 2025 18:24

github-actions bot added size/xl kind/documentation Categorizes issue or PR as related to documentation. and removed size/xl labels Dec 9, 2025

github-actions bot added kind/dependency dependabot and upgrades component/github-actions labels Dec 9, 2025

test

cd2e8af

Signed-off-by: Alvin Wong <alvin.wong@forgerock.com>

tokiwong force-pushed the fix-secret-exists-check branch from 9efef74 to cd2e8af Compare December 9, 2025 18:30

tokiwong requested a review from Skarlso December 9, 2025 18:36

Skarlso approved these changes Dec 10, 2025

View reviewed changes

Merge branch 'main' into fix-secret-exists-check

f16981d

Skarlso merged commit 35f235a into external-secrets:main Dec 10, 2025
29 checks passed

github-project-automation bot moved this to Done in External Secrets Dec 10, 2025

H3mul mentioned this pull request Mar 26, 2026

Update Helm release external-secrets to v2 H3mul/homelab-k3s-flux#2040

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(gcpsm): SecretExists should check for regional secrets when store location is specified#5708

fix(gcpsm): SecretExists should check for regional secrets when store location is specified#5708
Skarlso merged 3 commits intoexternal-secrets:mainfrom
tokiwong:fix-secret-exists-check

tokiwong commented Dec 8, 2025 •

edited

Loading

Uh oh!

Skarlso Dec 9, 2025

Uh oh!

github-actions bot commented Dec 9, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

eso-service-account-app bot commented Dec 10, 2025

Uh oh!

sonarqubecloud bot commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

tokiwong commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Proposed Changes

Checklist

Uh oh!

Skarlso Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 9, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

Skarlso commented Dec 10, 2025

Uh oh!

eso-service-account-app bot commented Dec 10, 2025

Uh oh!

sonarqubecloud bot commented Dec 10, 2025

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tokiwong commented Dec 8, 2025 •

edited

Loading