feat(charts): add new flag enable leader for cert-manager by nutmos · Pull Request #5863 · external-secrets/external-secrets

nutmos · 2026-01-25T02:57:22Z

Problem Statement

Nowadays, cert-manager's Helm chart doesn't have an enable-leader-election flag setup.

This PR adds the capability to set --enable-leader-election=true flag when .Values.leaderElect is true.

Related Issue

Fixes #5737

Proposed Changes

This PR adds the capability to set --enable-leader-election=true flag when .Values.leaderElect is true.

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

charts
release
testing
security
templating

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Description

Adds support for the --enable-leader-election flag in the cert-controller Helm chart deployment template, controlled via the .Values.leaderElect configuration value. This enables leader election for cert-controller when multiple replicas are deployed, matching the behavior of the core controller.

Changes

cert-controller-deployment.yaml: Adds conditional logic to include --enable-leader-election=true in the container args when .Values.leaderElect is enabled. Also retains hostAliases block support with fallback to global configuration.
cert_controller_test.yaml: Adds two test cases verifying that:
- The --enable-leader-election flag is not present by default
- The flag is properly applied when leaderElect is set to true

Fixes

#5737

coderabbitai · 2026-01-25T02:57:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8355df0 and b009455.

📒 Files selected for processing (2)

deploy/charts/external-secrets/templates/cert-controller-deployment.yaml
deploy/charts/external-secrets/tests/cert_controller_test.yaml

Walkthrough

Adds conditional leader-election flag support to the cert-controller Helm deployment args and corresponding tests that assert flag presence/absence based on .Values.leaderElect.

Changes

Cohort / File(s)	Summary
Cert-controller Deployment Template `deploy/charts/external-secrets/templates/cert-controller-deployment.yaml`	Adds conditional container arg: `--enable-leader-election=true` when `.Values.leaderElect` is enabled.
Cert-controller Deployment Tests `deploy/charts/external-secrets/tests/cert_controller_test.yaml`	Adds two tests: one asserting the flag is absent by default, and one asserting the flag is present when `leaderElect: true`.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The pull request successfully implements all coding requirements from linked issue `#5737`: adds --enable-leader-election flag support to cert-controller template via .Values.leaderElect attribute and includes comprehensive test coverage.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the linked issue objectives. The modifications add leader election support to the cert-controller Helm template and corresponding tests without introducing unrelated alterations.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Skarlso · 2026-01-25T08:49:26Z

Sorry, fat fingered the ready for review button.

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@deploy/charts/external-secrets/templates/cert-controller-deployment.yaml`:
- Around line 92-94: Remove the trailing spaces in the Helm template conditional
that renders the --enable-leader-election flag: update the block that checks
.Values.leaderElect and emits "- --enable-leader-election=true" so the emitted
lines have no trailing whitespace (match the style used in the core-controller
deployment template); specifically trim the spaces after the closing markers in
the conditional lines that produce the flag.

deploy/charts/external-secrets/templates/cert-controller-deployment.yaml

coderabbitai

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

deploy/charts/external-secrets/templates/validatingwebhook.yaml (1)
36-50: ⚠️ Potential issue | 🟠 Major

Missing failurePolicy on the clustersecretstore webhook.

The validate.secretstore (line 34) and validate.externalsecret (line 84) webhooks both received the new failurePolicy field, but the validate.clustersecretstore webhook here does not. This looks like an oversight — all three webhooks should behave consistently.
Proposed fix
   sideEffects: None
   timeoutSeconds: 5
+  failurePolicy: {{ .Values.webhook.failurePolicy }}
 ---
docs/introduction/stability-support.md (1)

47-61: ⚠️ Potential issue | 🟡 Minor

Stale documentation: "has not reached stable 1.0 yet" is no longer accurate.

Line 47 states the operator hasn't reached 1.0, but the version table now lists releases up to 2.0. This entire section about treating minor bumps as breaking changes and upgrading cautiously may need revision for the post-1.0 era (or at minimum the opening sentence needs updating).

🤖 Fix all issues with AI agents

In @.github/workflows/pull-request-label.yml:
- Line 115: Update the stale inline comment on the actions checkout step: find
the line containing "uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" and change the
trailing comment from "# v5" to "# v6.0.2" so it accurately reflects the
referenced release (actions/checkout v6.0.2).

In `@deploy/charts/external-secrets/tests/cert_controller_test.yaml`:
- Around line 317-375: Add two unit tests to cert_controller_test.yaml
validating the new leader election flag: one that asserts the container args do
NOT contain "--enable-leader-election=true" by default, and one that sets
leaderElect: true and asserts the container args DO contain
"--enable-leader-election=true". Target the same template
cert-controller-deployment.yaml and use notContains on path
spec.template.spec.containers[0].args for the default case and contains on the
same path when leaderElect: true; name the tests accordingly (e.g., "should not
have enable-leader-election flag by default" and "should have
enable-leader-election flag when leaderElect is true").

🧹 Nitpick comments (4)

Makefile (1)
410-417: Inconsistent indentation: spaces vs tab in conditional blocks.

Line 412 (real_OS := darwin) uses spaces for indentation, while Line 416 (real_OS := linux) uses a tab. While both work inside ifeq blocks, mixing them reduces readability and can confuse contributors.
🔧 Suggested fix: use consistent indentation
 ifeq ($(detected_OS),Darwin)
         detected_OS := mac
         real_OS := darwin
 endif
 ifeq ($(detected_OS),Linux)
         detected_OS := linux
-	real_OS := linux
+        real_OS := linux
 endif
deploy/charts/external-secrets/templates/validatingwebhook.yaml (1)
84-84: Minor formatting inconsistency: missing space before }}.

Line 34 uses {{ .Values.webhook.failurePolicy }} (with trailing space), while line 84 uses {{ .Values.webhook.failurePolicy}} (no trailing space). Helm handles both, but keeping consistent template style is preferable.
Fix
-  failurePolicy: {{ .Values.webhook.failurePolicy}}
+  failurePolicy: {{ .Values.webhook.failurePolicy }}
.github/workflows/dlc.yml (1)

28-28: fossas/fossa-action is pinned to a main branch commit, not a release tag.

The SHA pin ensures immutability, but the # main comment makes it harder to track which release version this corresponds to. Other actions in this repo use versioned tag comments (e.g., # v2.14.2). Consider identifying the corresponding release tag for the comment, if one exists.

Also applies to: 34-34
docs/provider/infisical.md (1)
313-363: Consider clarifying service account key file mounting.

The GCP IAM Auth section documents the serviceAccountKeyFilePath parameter but doesn't explain how users should make this file available in the Kubernetes environment. Consider adding a brief note or example about mounting the service account key file (e.g., via a Secret volume mount or init container).
📝 Example guidance that could be added

After the "Storing Credentials" section, consider adding:
!!! note
    The service account key file must be available at the specified path in the operator's pod. You can mount it using a Secret volume:
    
    ```yaml
    # First, create a secret with the key file content
    kubectl create secret generic gcp-sa-key --from-file=key.json=/path/to/local/key.json
    
    # Then mount it in the operator deployment
    # (This typically requires modifying the operator's deployment to add the volume mount)
    ```

coderabbitai · 2026-02-11T03:37:37Z

.github/workflows/pull-request-label.yml

    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5


⚠️ Potential issue | 🟡 Minor

Stale version comment: # v5 should be # v6.0.2.

The commit SHA de0fac2e… corresponds to actions/checkout v6.0.2 (as used in all other workflow files in this PR), but the inline comment still says v5.

Proposed fix

- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

🤖 Prompt for AI Agents

In @.github/workflows/pull-request-label.yml at line 115, Update the stale inline comment on the actions checkout step: find the line containing "uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" and change the trailing comment from "# v5" to "# v6.0.2" so it accurately reflects the referenced release (actions/checkout v6.0.2).

deploy/charts/external-secrets/tests/cert_controller_test.yaml

coderabbitai

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@deploy/charts/external-secrets/tests/cert_controller_test.yaml`:
- Around line 376-391: The review comment includes duplicate reviewer markers
("[approve_code_changes]" and "[duplicate_comment]") appended to the test
description block for the two test cases ("should not have
enable-leader-election flag by default" and "should have enable-leader-election
flag when leaderElect is true"); remove the redundant marker so only the
intended approval token remains (or remove both markers if no token is needed),
leaving the YAML test assertions unchanged for cert-controller-deployment.yaml
and keeping the two test cases as-is.

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…secrets#5769)" This reverts commit 824da30. Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…-secrets#5769)" This reverts commit b4e4aa3. Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…nal-secrets#5873) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.10 to 4.31.11. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdefb33...19b2f06) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.31.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…ets#5877) Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.20 to 10.20.1. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](https://github.com/facelessuser/pymdown-extensions/commits) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: 10.20.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…ernal-secrets#5880) Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.10 to 3.10.1. - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.10.0...3.10.1) --- updated-dependencies: - dependency-name: markdown dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…ets#5871) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…rets#5947) Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 5.1.1 to 6.0.0. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@61815dc...8df5847) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…secrets#5931) Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

* fix: attempt to fix ci pipeline Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: e2e tests with old docker buildx Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: coderabbit issues -- thanks coderabbit Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: force old bundle format for verify-attestation Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: typo Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: use-signing-config to false Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: verify attestation does not use signing config Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: readd arm64 for -ubi-boringssl Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: remove bundle format from verify attestation Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: cosign regression on 3.0.4 prevents old pipelines from working (despite flags) Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: ci bloat and provenance version Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> * fix: replace slsa-provenance-action with custom bash Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> --------- Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…l-secrets#5965) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.2 to 4.32.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@45cbd0c...9e907b5) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…xternal-secrets#5968) Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.10.1 to 3.10.2. - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](Python-Markdown/markdown@3.10.1...3.10.2) --- updated-dependencies: - dependency-name: markdown dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…ternal-secrets#5964) Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.33.1 to 0.34.0. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@b6643a2...c1824fd) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: 0.34.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…xternal-secrets#5967) Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.5.1 to 4.9.2. - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.5.1...4.9.2) --- updated-dependencies: - dependency-name: platformdirs dependency-version: 4.9.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

…ets#5969) Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.20.1 to 10.21. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](https://github.com/facelessuser/pymdown-extensions/commits/10.21) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: '10.21' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Signed-off-by: Nutmos <nutmos@users.noreply.github.com>

sonarqubecloud · 2026-02-26T06:07:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…2.1.0 (#4491) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.0.1` → `v2.1.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.1.0) [Compare Source](external-secrets/external-secrets@v2.0.1...v2.1.0) Image: `ghcr.io/external-secrets/external-secrets:v2.1.0` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl`  #### What's Changed ##### General - chore(release): Update helm chart by [@evrardj-roche](https://github.com/evrardj-roche) in [#5981](external-secrets/external-secrets#5981) - fix: cosign verify does not use signing config by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5982](external-secrets/external-secrets#5982) - docs: Update release process by [@evrardj-roche](https://github.com/evrardj-roche) in [#5980](external-secrets/external-secrets#5980) - fix: allow cross-namespace push with ClusterSecretStore objects by [@Skarlso](https://github.com/Skarlso) in [#5998](external-secrets/external-secrets#5998) - feat(charts): add new flag enable leader for cert-manager by [@nutmos](https://github.com/nutmos) in [#5863](external-secrets/external-secrets#5863) - feat(kubernetes): fall back to system CA roots when no CA is configured by [@rajsinghtech](https://github.com/rajsinghtech) in [#5961](external-secrets/external-secrets#5961) - feat: dedup sbom but keep it monolithic by [@moolen](https://github.com/moolen) in [#6004](external-secrets/external-secrets#6004) - fix: add missing metrics and fundamentally fix the caching logic by [@Skarlso](https://github.com/Skarlso) in [#5894](external-secrets/external-secrets#5894) - docs: designate Oracle Vault provider as 'stable' by [@anders-swanson](https://github.com/anders-swanson) in [#6020](external-secrets/external-secrets#6020) - docs: Oracle Vault provider capabilities by [@anders-swanson](https://github.com/anders-swanson) in [#6023](external-secrets/external-secrets#6023) - docs(azurekv): cert-manager pushsecret example and cleanups by [@illrill](https://github.com/illrill) in [#5972](external-secrets/external-secrets#5972) - feat(kubernetes): implement SecretExists by [@Saku2](https://github.com/Saku2) in [#5973](external-secrets/external-secrets#5973) - fix(charts): Fix wrongly set annotations for cert-controller metrics service by [@josemaia](https://github.com/josemaia) in [#6029](external-secrets/external-secrets#6029) - feat(providers): Nebius MysteryBox integration by [@greenmapc](https://github.com/greenmapc) in [#5868](external-secrets/external-secrets#5868) ##### Dependencies - chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5986](external-secrets/external-secrets#5986) - chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5992](external-secrets/external-secrets#5992) - chore(deps): bump ubi9/ubi from `b8923f5` to `cecb1cd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5984](external-secrets/external-secrets#5984) - chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5985](external-secrets/external-secrets#5985) - chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5990](external-secrets/external-secrets#5990) - chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5989](external-secrets/external-secrets#5989) - chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5987](external-secrets/external-secrets#5987) - chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5991](external-secrets/external-secrets#5991) - chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5988](external-secrets/external-secrets#5988) - chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6012](external-secrets/external-secrets#6012) - chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6014](external-secrets/external-secrets#6014) - chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6015](external-secrets/external-secrets#6015) - chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6016](external-secrets/external-secrets#6016) - chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6013](external-secrets/external-secrets#6013) - chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6010](external-secrets/external-secrets#6010) - chore(deps): bump hashicorp/setup-terraform from [`ce70bcf`](external-secrets/external-secrets@ce70bcf) to [`5e8dbf3`](external-secrets/external-secrets@5e8dbf3) by [@dependabot](https://github.com/dependabot)\[bot] in [#6011](external-secrets/external-secrets#6011) - chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6009](external-secrets/external-secrets#6009) - chore(deps): bump distroless/static from `972618c` to `28efbe9` by [@dependabot](https://github.com/dependabot)\[bot] in [#6008](external-secrets/external-secrets#6008) #### New Contributors - [@nutmos](https://github.com/nutmos) made their first contribution in [#5863](external-secrets/external-secrets#5863) - [@rajsinghtech](https://github.com/rajsinghtech) made their first contribution in [#5961](external-secrets/external-secrets#5961) - [@illrill](https://github.com/illrill) made their first contribution in [#5972](external-secrets/external-secrets#5972) - [@Saku2](https://github.com/Saku2) made their first contribution in [#5973](external-secrets/external-secrets#5973) - [@greenmapc](https://github.com/greenmapc) made their first contribution in [#5868](external-secrets/external-secrets#5868) **Full Changelog**: <external-secrets/external-secrets@v2.0.1...v2.1.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4491 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.0.1` → `2.1.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.1.0) [Compare Source](external-secrets/external-secrets@v2.0.1...v2.1.0) Image: `ghcr.io/external-secrets/external-secrets:v2.1.0` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl`  #### What's Changed ##### General - chore(release): Update helm chart by [@evrardj-roche](https://github.com/evrardj-roche) in [#5981](external-secrets/external-secrets#5981) - fix: cosign verify does not use signing config by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5982](external-secrets/external-secrets#5982) - docs: Update release process by [@evrardj-roche](https://github.com/evrardj-roche) in [#5980](external-secrets/external-secrets#5980) - fix: allow cross-namespace push with ClusterSecretStore objects by [@Skarlso](https://github.com/Skarlso) in [#5998](external-secrets/external-secrets#5998) - feat(charts): add new flag enable leader for cert-manager by [@nutmos](https://github.com/nutmos) in [#5863](external-secrets/external-secrets#5863) - feat(kubernetes): fall back to system CA roots when no CA is configured by [@rajsinghtech](https://github.com/rajsinghtech) in [#5961](external-secrets/external-secrets#5961) - feat: dedup sbom but keep it monolithic by [@moolen](https://github.com/moolen) in [#6004](external-secrets/external-secrets#6004) - fix: add missing metrics and fundamentally fix the caching logic by [@Skarlso](https://github.com/Skarlso) in [#5894](external-secrets/external-secrets#5894) - docs: designate Oracle Vault provider as 'stable' by [@anders-swanson](https://github.com/anders-swanson) in [#6020](external-secrets/external-secrets#6020) - docs: Oracle Vault provider capabilities by [@anders-swanson](https://github.com/anders-swanson) in [#6023](external-secrets/external-secrets#6023) - docs(azurekv): cert-manager pushsecret example and cleanups by [@illrill](https://github.com/illrill) in [#5972](external-secrets/external-secrets#5972) - feat(kubernetes): implement SecretExists by [@Saku2](https://github.com/Saku2) in [#5973](external-secrets/external-secrets#5973) - fix(charts): Fix wrongly set annotations for cert-controller metrics service by [@josemaia](https://github.com/josemaia) in [#6029](external-secrets/external-secrets#6029) - feat(providers): Nebius MysteryBox integration by [@greenmapc](https://github.com/greenmapc) in [#5868](external-secrets/external-secrets#5868) ##### Dependencies - chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5986](external-secrets/external-secrets#5986) - chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5992](external-secrets/external-secrets#5992) - chore(deps): bump ubi9/ubi from `b8923f5` to `cecb1cd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5984](external-secrets/external-secrets#5984) - chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5985](external-secrets/external-secrets#5985) - chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5990](external-secrets/external-secrets#5990) - chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5989](external-secrets/external-secrets#5989) - chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5987](external-secrets/external-secrets#5987) - chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5991](external-secrets/external-secrets#5991) - chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5988](external-secrets/external-secrets#5988) - chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6012](external-secrets/external-secrets#6012) - chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6014](external-secrets/external-secrets#6014) - chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6015](external-secrets/external-secrets#6015) - chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6016](external-secrets/external-secrets#6016) - chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6013](external-secrets/external-secrets#6013) - chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6010](external-secrets/external-secrets#6010) - chore(deps): bump hashicorp/setup-terraform from [`ce70bcf`](external-secrets/external-secrets@ce70bcf) to [`5e8dbf3`](external-secrets/external-secrets@5e8dbf3) by [@dependabot](https://github.com/dependabot)\[bot] in [#6011](external-secrets/external-secrets#6011) - chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6009](external-secrets/external-secrets#6009) - chore(deps): bump distroless/static from `972618c` to `28efbe9` by [@dependabot](https://github.com/dependabot)\[bot] in [#6008](external-secrets/external-secrets#6008) #### New Contributors - [@nutmos](https://github.com/nutmos) made their first contribution in [#5863](external-secrets/external-secrets#5863) - [@rajsinghtech](https://github.com/rajsinghtech) made their first contribution in [#5961](external-secrets/external-secrets#5961) - [@illrill](https://github.com/illrill) made their first contribution in [#5972](external-secrets/external-secrets#5972) - [@Saku2](https://github.com/Saku2) made their first contribution in [#5973](external-secrets/external-secrets#5973) - [@greenmapc](https://github.com/greenmapc) made their first contribution in [#5868](external-secrets/external-secrets#5868) **Full Changelog**: <external-secrets/external-secrets@v2.0.1...v2.1.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4516 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…ecrets#5863) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Umaid Abbasi <91631027+umizoom@users.noreply.github.com> Co-authored-by: Joshua N Haupt <joshuanhaupt@outlook.com> Co-authored-by: n4zukker <n4zukker@users.noreply.github.com> Co-authored-by: Remy Bertot <stripthis@users.noreply.github.com> Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Co-authored-by: Gustavo Fernandes de Carvalho <17139678+gusfcarvalho@users.noreply.github.com> Co-authored-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com> Co-authored-by: Jan Lauber <jan.lauber@protonmail.ch> Co-authored-by: varonix <62331820+varonix0@users.noreply.github.com> Co-authored-by: lochan_2112 <rn.lochan@gmail.com> Co-authored-by: Fan Zhang <m42zhang@uwaterloo.ca> Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com> Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>

…ecrets#5863) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Umaid Abbasi <91631027+umizoom@users.noreply.github.com> Co-authored-by: Joshua N Haupt <joshuanhaupt@outlook.com> Co-authored-by: n4zukker <n4zukker@users.noreply.github.com> Co-authored-by: Remy Bertot <stripthis@users.noreply.github.com> Co-authored-by: Moritz Johner <moolen@users.noreply.github.com> Co-authored-by: Gustavo Fernandes de Carvalho <17139678+gusfcarvalho@users.noreply.github.com> Co-authored-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com> Co-authored-by: Jan Lauber <jan.lauber@protonmail.ch> Co-authored-by: varonix <62331820+varonix0@users.noreply.github.com> Co-authored-by: lochan_2112 <rn.lochan@gmail.com> Co-authored-by: Fan Zhang <m42zhang@uwaterloo.ca> Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com>

github-project-automation bot added this to External Secrets Jan 25, 2026

github-actions bot added area/charts Issues / Pull Requests related to our helm charts kind/feature Categorizes issue or PR as related to a new feature. labels Jan 25, 2026

github-actions bot added the size/xs label Jan 25, 2026

nutmos mentioned this pull request Jan 25, 2026

cert-controller feature flag --enable-leader-election not in helm chart #5737

Closed

nutmos force-pushed the feat/enable-leader-election-cert-controller branch 2 times, most recently from dd47773 to bd857bb Compare January 25, 2026 03:14

Skarlso marked this pull request as ready for review January 25, 2026 08:49

Skarlso marked this pull request as draft January 25, 2026 08:49

nutmos marked this pull request as ready for review February 6, 2026 12:49

coderabbitai bot reviewed Feb 6, 2026

View reviewed changes

deploy/charts/external-secrets/templates/cert-controller-deployment.yaml Outdated Show resolved Hide resolved

nutmos force-pushed the feat/enable-leader-election-cert-controller branch from e2159a6 to 0f51316 Compare February 11, 2026 03:26

github-actions bot added kind/documentation Categorizes issue or PR as related to documentation. kind/dependency dependabot and upgrades component/github-actions size/l labels Feb 11, 2026

coderabbitai bot reviewed Feb 11, 2026

View reviewed changes

github-actions bot added the size/s label Feb 18, 2026

coderabbitai bot reviewed Feb 18, 2026

View reviewed changes

nutmos and others added 9 commits February 18, 2026 17:54

add new flag enable leader

0c4ca2c

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Revert "chore(chart): Add missing tests for readinessProbe (external-…

07438cd

…secrets#5769)" This reverts commit 824da30. Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Reapply "chore(chart): Add missing tests for readinessProbe (external…

9bb2826

…-secrets#5769)" This reverts commit b4e4aa3. Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

docs: Update FluxCD example (external-secrets#5862)

92ccc3f

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

chore(deps): bump ubi9/ubi from 22e9573 to 1f84f5c (external-secr…

71d6757

…ets#5871) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

Removed the unused check for Windows in Makefile (external-secrets#5870)

7746f7c

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

dependabot bot and others added 16 commits February 18, 2026 17:54

remove trailing whitespace

99af14b

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

fix: webhook initialization order (external-secrets#5901)

680f991

Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

chore: remove unmaintained secret stores (external-secrets#5918)

bc86255

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

fix: deleting the whole secret when it is empty (external-secrets#5927)

d28d432

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

chore: update controller runtime (external-secrets#5930)

67a5b5b

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

fix: update cosign and syft for signing (external-secrets#5958)

8f104e1

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

fix: the informer can not register use GetInformer instead (external-…

8f9d510

…secrets#5931) Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

chore: remove outdated info from stability doc (external-secrets#5971)

8bbb1f6

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com> Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

add test case for leader election

9a2e0ed

Signed-off-by: Nattapong Ekudomsuk <nuttapong_mos@hotmail.com>

nutmos force-pushed the feat/enable-leader-election-cert-controller branch from 8355df0 to 9a2e0ed Compare February 18, 2026 10:54

github-actions bot added the size/xl label Feb 18, 2026

Merge branch 'main' into feat/enable-leader-election-cert-controller

a2da11b

Signed-off-by: Nutmos <nutmos@users.noreply.github.com>

Skarlso approved these changes Feb 26, 2026

View reviewed changes

Merge branch 'main' into feat/enable-leader-election-cert-controller

b009455

Skarlso merged commit 0ed2729 into external-secrets:main Feb 26, 2026
33 checks passed

github-project-automation bot moved this to Done in External Secrets Feb 26, 2026

nutmos deleted the feat/enable-leader-election-cert-controller branch March 14, 2026 13:25

github-actions bot mentioned this pull request Mar 30, 2026

Update Helm release external-secrets to v2.1.0 claytono/infra#1875

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(charts): add new flag enable leader for cert-manager#5863

feat(charts): add new flag enable leader for cert-manager#5863
Skarlso merged 69 commits intoexternal-secrets:mainfrom
nutmos:feat/enable-leader-election-cert-controller

nutmos commented Jan 25, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Jan 25, 2026 •

edited

Loading

Uh oh!

Skarlso commented Jan 25, 2026

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Feb 11, 2026

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

sonarqubecloud bot commented Feb 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Uh oh!

Conversation

nutmos commented Jan 25, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Format

Checklist

Description

Changes

Fixes

Uh oh!

coderabbitai bot commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Skarlso commented Jan 25, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Feb 26, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

nutmos commented Jan 25, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jan 25, 2026 •

edited

Loading