chore: Cleanup flags by evrardj-roche · Pull Request #5845 · external-secrets/external-secrets

evrardj-roche · 2026-01-19T10:59:14Z

Without this, the flags are not really useful.

This is not a big problem, but it is debt that I would like
to get rid in the future.

This fixes it by getting rid or making accessible flags for
aws and doppler, respectively.

To be worth noting that exposing doppler directly would mean
the cache would be enabled by default with a non-null value.
To ensure no behaviour change, I gated by another variable.
This behaviour is in line with vault provider's cache handling.

Signed-off-by: Jean-Philippe Evrard jean-philippe.evrard+rochepub@external.roche.com

Problem Statement

What is the problem you're trying to solve?

Related Issue

Fixes #...

Proposed Changes

How do you like to solve the issue and why?

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

charts
release
testing
security
templating

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Summary

This PR cleans up unused and ineffective flags for AWS and Doppler providers to reduce technical debt:

AWS (providers/v1/aws/auth/auth.go):

Removed the experimental AWS session cache flag and its initialization infrastructure (pflag imports, enableSessionCache variable, and feature registration wiring)

Doppler (providers/v1/doppler/provider.go):

Removed the public InitializeFlags() function
Moved flag setup to a non-exported init() function for experimental OIDC cache flags (experimental-enable-doppler-oidc-cache and experimental-doppler-oidc-cache-size)
Added a conditional gate in initCache() to only enable the OIDC cache when explicitly flagged, preserving the prior default behavior (cache disabled by default)
Aligned with the Vault provider's cache-handling approach

Impact: Eliminates technical debt while maintaining backward compatibility and preventing unintended behavioral changes.

coderabbitai · 2026-01-19T10:59:23Z

Walkthrough

AWS session cache flag support has been removed from the auth module. The Doppler provider flag initialization has been refactored from a public function to a private init() function, introducing conditional cache setup based on newly added experimental flags.

Changes

Cohort / File(s)	Summary
AWS auth flag removal `providers/v1/aws/auth/auth.go`	Removed pflag import, enableSessionCache variable, flag registration, and feature flag wiring that exposed the experimental AWS session cache flag. Public APIs unchanged.
Doppler provider flag refactoring `providers/v1/doppler/provider.go`	Removed public InitializeFlags() function; introduced non-exported init() with experimental OIDC cache flags (experimental-enable-doppler-oidc-cache, experimental-doppler-oidc-cache-size). Added conditional cache creation gate in initCache() based on enableCache flag.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

evrardj-roche · 2026-01-20T12:21:21Z

Interestingly that make tests did not test this check-diff failure.

Without this, the flags are not really useful. This is not a big problem, but it is debt that I would like to get rid in the future. This fixes it by getting rid or making accessible flags for aws and doppler, respectively. To be worth noting that exposing doppler directly would mean the cache would be enabled by default with a non-null value. To ensure no behaviour change, I gated by another variable. This behaviour is in line with vault provider's cache handling. Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>

Skarlso · 2026-01-22T06:12:34Z

providers/v1/doppler/provider.go

+// Gating on enableCache to not enable cache out of the blue for new releases.
 func initCache(cacheSize int) {
-	if oidcClientCache == nil && cacheSize > 0 {
+	if oidcClientCache == nil && cacheSize > 0 && enableCache {


Doesn't this change the logic slightly?

Please read the commit message AND L79.

sonarqubecloud · 2026-02-02T11:32:02Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `1.2.1` → `1.3.2` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v1.3.2`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.2) [Compare Source](external-secrets/external-secrets@v1.3.1...v1.3.2) Image: `ghcr.io/external-secrets/external-secrets:v1.3.2` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl`  #### What's Changed ##### General - chore: release helm chart for v1.3.1 by [@Skarlso](https://github.com/Skarlso) in [#5860](external-secrets/external-secrets#5860) - chore(chart): Add missing tests for readinessProbe by [@jcpunk](https://github.com/jcpunk) in [#5769](external-secrets/external-secrets#5769) - docs: Update FluxCD example by [@umizoom](https://github.com/umizoom) in [#5862](external-secrets/external-secrets#5862) - fix(ci): Removed the unused check for Windows in Makefile by [@HauptJ](https://github.com/HauptJ) in [#5870](external-secrets/external-secrets#5870) - docs(release): Add actual dates for EOL of 1.x releases in stability and support page by [@n4zukker](https://github.com/n4zukker) in [#5889](external-secrets/external-secrets#5889) - docs: Passbolt provider maintenance ownership by [@stripthis](https://github.com/stripthis) in [#5886](external-secrets/external-secrets#5886) - chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by [@stripthis](https://github.com/stripthis) in [#5887](external-secrets/external-secrets#5887) - fix(security): sanitize json.Unmarshal errors to prevent secret data … by [@moolen](https://github.com/moolen) in [#5884](external-secrets/external-secrets#5884) - fix: webhook initialization order by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5901](external-secrets/external-secrets#5901) - chore: Cleanup flags by [@evrardj-roche](https://github.com/evrardj-roche) in [#5845](external-secrets/external-secrets#5845) - fix: onepasswordsdk shared tenant by altering the provider in the client cache by [@Skarlso](https://github.com/Skarlso) in [#5921](external-secrets/external-secrets#5921) ##### Dependencies - chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5873](external-secrets/external-secrets#5873) - chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5877](external-secrets/external-secrets#5877) - chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5880](external-secrets/external-secrets#5880) - chore(deps): bump ubi9/ubi from `22e9573` to `1f84f5c` by [@dependabot](https://github.com/dependabot)\[bot] in [#5871](external-secrets/external-secrets#5871) - chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5872](external-secrets/external-secrets#5872) - chore(deps): bump hashicorp/setup-terraform from [`93d5a27`](external-secrets/external-secrets@93d5a27) to [`dcc3150`](external-secrets/external-secrets@dcc3150) by [@dependabot](https://github.com/dependabot)\[bot] in [#5875](external-secrets/external-secrets#5875) - chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5876](external-secrets/external-secrets#5876) - chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5878](external-secrets/external-secrets#5878) - chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5874](external-secrets/external-secrets#5874) - chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5879](external-secrets/external-secrets#5879) - chore(deps): bump golang from `d9b2e14` to `98e6cff` by [@dependabot](https://github.com/dependabot)\[bot] in [#5907](external-secrets/external-secrets#5907) - chore(deps): bump alpine from `865b95f` to `2510918` in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5914](external-secrets/external-secrets#5914) - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5909](external-secrets/external-secrets#5909) - chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5912](external-secrets/external-secrets#5912) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5910](external-secrets/external-secrets#5910) - chore(deps): bump hashicorp/setup-terraform from [`dcc3150`](external-secrets/external-secrets@dcc3150) to [`ce70bcf`](external-secrets/external-secrets@ce70bcf) by [@dependabot](https://github.com/dependabot)\[bot] in [#5911](external-secrets/external-secrets#5911) - chore(deps): bump ubi9/ubi from `1f84f5c` to `c8df11b` by [@dependabot](https://github.com/dependabot)\[bot] in [#5908](external-secrets/external-secrets#5908) - chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5915](external-secrets/external-secrets#5915) - chore(deps): bump alpine from `865b95f` to `2510918` by [@dependabot](https://github.com/dependabot)\[bot] in [#5906](external-secrets/external-secrets#5906) - chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5916](external-secrets/external-secrets#5916) - chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5917](external-secrets/external-secrets#5917) - chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5913](external-secrets/external-secrets#5913) #### New Contributors - [@umizoom](https://github.com/umizoom) made their first contribution in [#5862](external-secrets/external-secrets#5862) - [@HauptJ](https://github.com/HauptJ) made their first contribution in [#5870](external-secrets/external-secrets#5870) - [@n4zukker](https://github.com/n4zukker) made their first contribution in [#5889](external-secrets/external-secrets#5889) - [@stripthis](https://github.com/stripthis) made their first contribution in [#5886](external-secrets/external-secrets#5886) **Full Changelog**: <external-secrets/external-secrets@v1.3.1...v1.3.2> ### [`v1.3.1`](https://github.com/external-secrets/external-secrets/releases/tag/v1.3.1) [Compare Source](external-secrets/external-secrets@v1.2.1...v1.3.1) Image: `ghcr.io/external-secrets/external-secrets:v1.3.1` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl`  For a Full release please referre to <https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0>. This is a fix build for the docker publish flow. #### What's Changed ##### General - fix: ignore the in-toto manifest when promoting the docker build by [@Skarlso](https://github.com/Skarlso) in [#5859](external-secrets/external-secrets#5859) **Full Changelog**: <external-secrets/external-secrets@v1.3.0...v1.3.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://kubara.git.onstackit.cloud/STACKIT/kubara/pulls/250

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com>

github-project-automation bot added this to External Secrets Jan 19, 2026

github-actions bot added kind/chore Categorizes Pull Requests for chore activities (like bumping versions) size/s labels Jan 19, 2026

evrardj-roche force-pushed the cleanup-flags branch from 919109d to 9eaa13c Compare January 20, 2026 12:40

Skarlso approved these changes Jan 22, 2026

View reviewed changes

Skarlso reviewed Jan 22, 2026

View reviewed changes

Skarlso added 2 commits January 22, 2026 07:24

Merge branch 'main' into cleanup-flags

e887275

Merge branch 'main' into cleanup-flags

55c8a16

Skarlso merged commit 1483117 into external-secrets:main Feb 2, 2026
14 checks passed

github-project-automation bot moved this to Done in External Secrets Feb 2, 2026

nutmos pushed a commit to nutmos/external-secrets that referenced this pull request Feb 11, 2026

chore: Cleanup flags (external-secrets#5845)

b8f8e2e

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

nutmos pushed a commit to nutmos/external-secrets that referenced this pull request Feb 18, 2026

chore: Cleanup flags (external-secrets#5845)

325c567

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

dsp0x4 pushed a commit to dsp0x4/external-secrets that referenced this pull request Mar 22, 2026

chore: Cleanup flags (external-secrets#5845)

03fc9ff

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: Cleanup flags#5845

chore: Cleanup flags#5845
Skarlso merged 3 commits intoexternal-secrets:mainfrom
evrardj-roche:cleanup-flags

evrardj-roche commented Jan 19, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Jan 19, 2026 •

edited

Loading

Uh oh!

evrardj-roche commented Jan 20, 2026

Uh oh!

Skarlso Jan 22, 2026

Uh oh!

evrardj-roche Jan 27, 2026

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

evrardj-roche commented Jan 19, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Format

Checklist

Summary

Uh oh!

coderabbitai bot commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

evrardj-roche commented Jan 20, 2026

Uh oh!

Skarlso Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

evrardj-roche Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 2, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

evrardj-roche commented Jan 19, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jan 19, 2026 •

edited

Loading