docs(templating): update rbac for generic targets by lostick · Pull Request #5736 · external-secrets/external-secrets

lostick · 2025-12-16T09:46:41Z

Problem Statement

Doc for custom resources does not match helm chart.

Proposed Changes

Use same struct for generic targets as what's defined in the helm chart.

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Summary by CodeRabbit

Refactor
- Updated Helm chart configuration schema for targeting custom resources. The nonSecretTargets section is now genericTargets with a new resources list format for specifying RBAC permissions via apiGroups, resources, and verbs arrays.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Signed-off-by: lostick <mevoyasf@gmail.com>

coderabbitai · 2025-12-16T09:46:55Z

Walkthrough

Helm chart documentation updated to reflect schema changes in custom resource targeting configuration. The top-level nonSecretTargets section renamed to genericTargets, and RBAC permission declaration restructured from per-resource flags to a consolidated resources list format specifying API groups, resource types, and verb arrays.

Changes

Cohort / File(s)	Change Summary
Configuration Schema Documentation `docs/guides/targeting-custom-resources.md`	Updated documentation to reflect Helm chart schema changes: renamed `nonSecretTargets` to `genericTargets`, replaced per-resource RBAC flags with unified `resources` list structure containing `apiGroups`, `resources`, and `verbs` arrays.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Single documentation file update with clear schema mapping
Verify the new schema structure is accurately documented and examples are correct

Poem

🐰✨ The schema hops anew, from old to fresh,
Non-secrets now generic, a tidy mesh,
Resources list where RBAC once lay,
Verbs and groups in harmony play! 🎯

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly describes the main change: updating RBAC documentation for generic targets, which aligns with the changeset's purpose of synchronizing docs with Helm chart structure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The PR description addresses the problem and proposed solution but lacks a Related Issue reference and PR title format verification.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sonarqubecloud · 2025-12-16T09:47:19Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docs/guides/targeting-custom-resources.md (1)
74-86: Fix incorrect field name in RBAC configuration example.

The YAML example uses apiGroups (plural), but the Helm chart schema and template use apiGroup (singular). The field value should also be a string, not an array. The correct structure is:
genericTargets:
  enabled: true
  resources:
  - apiGroup: "config.example.com"
    resources: ["appconfigs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

🧹 Nitpick comments (1)

docs/guides/targeting-custom-resources.md (1)
79-85: Consider adding a ConfigMap example to illustrate built-in resources.

The current RBAC example uses a custom resource, but the documentation emphasizes ConfigMaps as a primary use case (lines 21–29). Adding a ConfigMap example here would help users understand how to configure RBAC for both built-in and custom resources.

Optional improvement to include alongside the custom resource example:
genericTargets:
  enabled: true
  resources:
  - apiGroups: [""]  # core API group for built-in resources
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["config.example.com"]
    resources: ["appconfigs"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
This demonstrates how to target both Kubernetes built-in resources and custom resources in a single configuration.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8513f88 and f1d6a79.

📒 Files selected for processing (1)

docs/guides/targeting-custom-resources.md (1 hunks)

Skarlso · 2025-12-16T12:08:04Z

docs/guides/targeting-custom-resources.md


 ```yaml
-nonSecretTargets:
+genericTargets:


Oh nice. Thanks for spotting it!

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.1.1` -> `1.2.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v1.2.0) [Compare Source](external-secrets/external-secrets@v1.1.1...v1.2.0) Image: `ghcr.io/external-secrets/external-secrets:v1.2.0` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: bump 1.1.1 by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5687](external-secrets/external-secrets#5687) - chore: fix the argocd e2e test case by [@Skarlso](https://github.com/Skarlso) in [#5688](external-secrets/external-secrets#5688) - feat(provider): add Barbican provider support by [@rkferreira](https://github.com/rkferreira) in [#5398](external-secrets/external-secrets#5398) - docs(secretserver): promote secretserver provider to beta by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5668](external-secrets/external-secrets#5668) - feat(controller): add flag to enable/disable secretstore reconcile by [@Ilhan-Personal](https://github.com/Ilhan-Personal) in [#5653](external-secrets/external-secrets#5653) - fix(aws-secrets-manager): Apply filtering based on both name and tags if provided by [@iypetrov](https://github.com/iypetrov) in [#5685](external-secrets/external-secrets#5685) - fix(gcpsm): SecretExists should check for regional secrets when store location is specified by [@tokiwong](https://github.com/tokiwong) in [#5708](external-secrets/external-secrets#5708) - feat: introduce store deprecation by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5711](external-secrets/external-secrets#5711) - feat(charts): add global values for common deployment configurations by [@Gabryel8818](https://github.com/Gabryel8818) in [#5652](external-secrets/external-secrets#5652) - feat: add Doppler OIDC-based authentication by [@mikesellitto](https://github.com/mikesellitto) in [#5475](external-secrets/external-secrets#5475) - fix: make custom configuration available regardless of environment by [@Skarlso](https://github.com/Skarlso) in [#5713](external-secrets/external-secrets#5713) - chore(chart): update bitwarden dependency to v0.5.2 by [@Skarlso](https://github.com/Skarlso) in [#5719](external-secrets/external-secrets#5719) - docs(templating): update rbac for generic targets by [@lostick](https://github.com/lostick) in [#5736](external-secrets/external-secrets#5736) - fix(testing): Breaking changes should not break ci by [@evrardjp](https://github.com/evrardjp) in [#5739](external-secrets/external-secrets#5739) - fix(security): Get rid of getSecretKey by [@evrardjp](https://github.com/evrardjp) in [#5738](external-secrets/external-secrets#5738) - fix(aws): parse resource policies into canonical JSON (sorted) before comparing by [@cmoscofian](https://github.com/cmoscofian) in [#5622](external-secrets/external-secrets#5622) - docs: Fix example in GCP documentation by [@headcr4sh](https://github.com/headcr4sh) in [#5745](external-secrets/external-secrets#5745) - chore(secretserver): update dependencies to accept new DelineaXPM/tss-sdk-go by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5742](external-secrets/external-secrets#5742) - fix(gcpsm): Improve SecretExists method in GCP secret manager provider by [@tosih](https://github.com/tosih) in [#5610](external-secrets/external-secrets#5610) - chore(docs): add clarification to helm values being disabled by [@Skarlso](https://github.com/Skarlso) in [#5746](external-secrets/external-secrets#5746) - fix(release): apply [`64dc681`](external-secrets/external-secrets@64dc681) to release by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5749](external-secrets/external-secrets#5749) - docs(release): 1.2 stability-support.md by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5750](external-secrets/external-secrets#5750) ##### Dependencies - chore(deps): bump golang from 1.25.4 to 1.25.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5693](external-secrets/external-secrets#5693) - chore(deps): bump golang from 1.25.4-bookworm to 1.25.5-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5702](external-secrets/external-secrets#5702) - chore(deps): bump ubi9/ubi from `dcd8128` to `75937d9` by [@dependabot](https://github.com/dependabot)\[bot] in [#5655](external-secrets/external-secrets#5655) - chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5695](external-secrets/external-secrets#5695) - chore(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#5696](external-secrets/external-secrets#5696) - chore(deps): bump actions/stale from 10.1.0 to 10.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5697](external-secrets/external-secrets#5697) - chore(deps): bump actions/create-github-app-token from 2.2.0 to 2.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5700](external-secrets/external-secrets#5700) - chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5698](external-secrets/external-secrets#5698) - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5699](external-secrets/external-secrets#5699) - chore(deps): bump platformdirs from 4.5.0 to 4.5.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5705](external-secrets/external-secrets#5705) - chore(deps): bump distroless/static from `87bce11` to `4b2a093` by [@dependabot](https://github.com/dependabot)\[bot] in [#5692](external-secrets/external-secrets#5692) - chore(deps): bump alpine from 3.22 to 3.23 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5703](external-secrets/external-secrets#5703) - chore(deps): bump urllib3 from 2.5.0 to 2.6.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5704](external-secrets/external-secrets#5704) - chore(deps): bump pymdown-extensions from 10.17.2 to 10.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5706](external-secrets/external-secrets#5706) - chore(deps): bump alpine from 3.22.2 to 3.23.0 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5701](external-secrets/external-secrets#5701) - chore(deps): bump golang from `2611181` to `2611181` by [@dependabot](https://github.com/dependabot)\[bot] in [#5721](external-secrets/external-secrets#5721) - chore(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5725](external-secrets/external-secrets#5725) - chore(deps): bump urllib3 from 2.6.0 to 2.6.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5730](external-secrets/external-secrets#5730) - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#5726](external-secrets/external-secrets#5726) - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5724](external-secrets/external-secrets#5724) - chore(deps): bump tornado from 6.5.2 to 6.5.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5732](external-secrets/external-secrets#5732) - chore(deps): bump ubi9/ubi from `75937d9` to `d4feb57` by [@dependabot](https://github.com/dependabot)\[bot] in [#5722](external-secrets/external-secrets#5722) - chore(deps): bump golang from `5117d68` to `09f53de` in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5729](external-secrets/external-secrets#5729) - chore(deps): bump alpine from `4b7ce07` to `51183f2` by [@dependabot](https://github.com/dependabot)\[bot] in [#5694](external-secrets/external-secrets#5694) - chore(deps): bump hashicorp/setup-terraform from [`712b439`](external-secrets/external-secrets@712b439) to [`071811a`](external-secrets/external-secrets@071811a) by [@dependabot](https://github.com/dependabot)\[bot] in [#5727](external-secrets/external-secrets#5727) - chore(deps): bump pymdown-extensions from 10.18 to 10.19.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5731](external-secrets/external-secrets#5731) - chore(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5728](external-secrets/external-secrets#5728) - chore(deps): bump actions/cache from 4.3.0 to 5.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5723](external-secrets/external-secrets#5723) #### New Contributors - [@iypetrov](https://github.com/iypetrov) made their first contribution in [#5685](external-secrets/external-secrets#5685) - [@tokiwong](https://github.com/tokiwong) made their first contribution in [#5708](external-secrets/external-secrets#5708) - [@Gabryel8818](https://github.com/Gabryel8818) made their first contribution in [#5652](external-secrets/external-secrets#5652) - [@mikesellitto](https://github.com/mikesellitto) made their first contribution in [#5475](external-secrets/external-secrets#5475) - [@lostick](https://github.com/lostick) made their first contribution in [#5736](external-secrets/external-secrets#5736) - [@cmoscofian](https://github.com/cmoscofian) made their first contribution in [#5622](external-secrets/external-secrets#5622) - [@headcr4sh](https://github.com/headcr4sh) made their first contribution in [#5745](external-secrets/external-secrets#5745) - [@tosih](https://github.com/tosih) made their first contribution in [#5610](external-secrets/external-secrets#5610) **Full Changelog**: <external-secrets/external-secrets@v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/2737 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

docs: update rbac for generic targets

f1d6a79

Signed-off-by: lostick <mevoyasf@gmail.com>

github-project-automation bot added this to External Secrets Dec 16, 2025

github-actions bot added area/templating Issues / Pull Requests related to templating engines kind/documentation Categorizes issue or PR as related to documentation. and removed area/templating Issues / Pull Requests related to templating engines labels Dec 16, 2025

github-actions bot added size/s area/templating Issues / Pull Requests related to templating engines labels Dec 16, 2025

coderabbitai bot reviewed Dec 16, 2025

View reviewed changes

Skarlso reviewed Dec 16, 2025

View reviewed changes

Skarlso approved these changes Dec 16, 2025

View reviewed changes

Skarlso merged commit 4473156 into external-secrets:main Dec 16, 2025
16 checks passed

github-project-automation bot moved this to Done in External Secrets Dec 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs(templating): update rbac for generic targets#5736

docs(templating): update rbac for generic targets#5736
Skarlso merged 1 commit intoexternal-secrets:mainfrom
lostick:fix/update-rbac-doc-for-generic-targets

lostick commented Dec 16, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Dec 16, 2025 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Dec 16, 2025

Uh oh!

coderabbitai bot left a comment

Uh oh!

Skarlso Dec 16, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

lostick commented Dec 16, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Proposed Changes

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

sonarqubecloud bot commented Dec 16, 2025

Quality Gate passed

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Skarlso Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lostick commented Dec 16, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Dec 16, 2025 •

edited

Loading