feat(azurekv): add expiration time to azure kv secret by muraliavarma · Pull Request #5935 · external-secrets/external-secrets

muraliavarma · 2026-02-06T14:45:47Z

Problem Statement

Expose expiration date and other time-based attributes (created, updated, notBefore) in Azure KeyVault secret metadata. Previously only tags were returned when MetadataPolicy was set to Fetch.

Related Issue

Fixes #4697

Continues the work from #4709 which was abandoned. Fixes the lint errors that blocked that PR.

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Summary

Exposes time-based metadata (expiration, creation, update, and notBefore timestamps) from Azure Key Vault secrets, certificates, and keys when MetadataPolicy is set to Fetch. Previously, only user-defined tags were exposed.

Changes

keyvault.go:

Added constants for attribute.expires, attribute.created, attribute.updated, and attribute.notBefore
Introduced getSecretAllMetadata() helper to merge time-based attributes with existing tags
Updated legacy SDK fetch paths for secrets, certificates, and keys to extract and include time-based attributes when MetadataPolicyFetch is set
Added nil checks to prevent panics when dereferencing tag and attribute values
Prefixed attribute keys with "attribute." to avoid naming collisions with user-defined tags

keyvault_test.go:

Added test coverage for secrets with Expires and Created attributes

Impact

Users can now include Azure Key Vault expiration dates and other time-based metadata in templated Kubernetes secrets, enabling use cases like displaying secret expiry information (e.g., "01.01.2030") in applications that consume the External Secrets Operator.

coderabbitai · 2026-02-06T14:46:08Z

Walkthrough

Adds time-based metadata handling to the Azure Key Vault provider: introduces getSecretAllMetadata to merge tags with Expires/Created/Updated/NotBefore attributes, updates legacy fetch/tag handling for secrets, certificates, and keys, adjusts nil-guards and error parsing, and adds tests for Expires/Created attribute handling.

Changes

Cohort / File(s)	Summary
KeyVault provider core `providers/v1/azure/keyvault/keyvault.go`	Adds constants for time-based attributes and a new helper `getSecretAllMetadata` to merge tags with Expires/Created/Updated/NotBefore. Updates legacy fetch flows for secrets, certificates, and keys to incorporate attribute-derived metadata, adds nil checks, and refactors inline error parsing.
Tests `providers/v1/azure/keyvault/keyvault_test.go`	Adds test helper `setSecretWithExpiresAttribute` and a test case to validate handling of Expires and Created attributes when fetching secrets.
Project files `manifest_file`, `go.mod`	Minor changes recorded (dependency/manifest adjustments) accompanying the code and test updates.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The pull request successfully implements time-based metadata exposure from Azure Key Vault including expiration dates and additional timestamps when MetadataPolicy is set to Fetch, directly addressing the requirement to expose expiration dates for use in templates.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing time-based metadata handling in Azure Key Vault secret fetching and corresponding test coverage, with no unrelated modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@providers/v1/azure/keyvault/keyvault.go`:
- Around line 829-852: The buildMetadataWithAttributes function currently writes
time attributes into the provided tags map keys (attributeExpires,
attributeCreated, attributeUpdated, attributeNotBefore) and can silently
overwrite user tags; change the attribute keys to a reserved/prefixed form
(e.g., prefix with "attribute." or "azure.attribute.") instead of the plain
names, or explicitly detect collisions and use a prefixed alternative when tags
already contain those keys; update the constants (attributeExpires,
attributeCreated, attributeUpdated, attributeNotBefore) or the key construction
in buildMetadataWithAttributes accordingly so time attributes never overwrite
user-provided tag entries.

providers/v1/azure/keyvault/keyvault.go

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@providers/v1/azure/keyvault/keyvault.go`:
- Around line 859-876: flattenSecretTags dereferences tag pointers without a nil
check causing a panic; update flattenSecretTags to check if tagval == nil before
using *tagval — if nil, set secretTagsData[name] = nil (or skip adding subkeys)
and continue, otherwise proceed to json.Unmarshal([]byte(*tagval)) and expand
JSON keys as before; apply the same nil-guard pattern to okByTags to avoid
dereferencing nil *string values.

🧹 Nitpick comments (1)

providers/v1/azure/keyvault/keyvault_new_sdk.go (1)
674-727: Metadata handling pattern is consistent across all three fetch helpers — consider a minor DRY extraction.

fetchSecret, fetchCertificate, and fetchKey each repeat the identical metadata-check block:
if ref.MetadataPolicy == esv1.ExternalSecretMetadataPolicyFetch {
    if resp.Attributes != nil {
        return getSecretMetadata(resp.Tags, ref.Property,
            resp.Attributes.Expires, resp.Attributes.Created,
            resp.Attributes.Updated, resp.Attributes.NotBefore)
    }
    return getSecretTag(resp.Tags, ref.Property)
}
Not a blocker since the surrounding SDK types differ, but if this pattern grows further (e.g., more attribute fields), a small generic helper taking (tags, property, attributes) would reduce copy-paste. Fine to defer.

providers/v1/azure/keyvault/keyvault.go

coderabbitai

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@providers/v1/azure/keyvault/keyvault.go`:
- Around line 946-951: Attributes added via getSecretAllMetadata are unprefixed
(expires, created, etc.) while tags are stored as secretName_tagname, causing
property lookups in getSecretMapProperties/GetSecretMap to miss them; update the
call that merges attributes into secretTagsData (or adjust getSecretAllMetadata)
to prefix attribute keys with the secret name (e.g., secretName_expires,
secretName_created, secretName_updated, secretName_notBefore) so they follow the
same secretName_property pattern as tags, ensuring getSecretMapProperties can
find them by key + "_" + property.
- Around line 820-843: The getSecretAllMetadata function currently copies Azure
SDK tags (map[string]*string) verbatim which can include nil pointers and later
causes nil-pointer dereferences in getSecretTag and getSecretMapProperties;
update getSecretAllMetadata to skip any tag entries where the value is nil (only
copy tags with non-nil *string values) while retaining the existing logic that
adds time-based attributes (attributeExpires, attributeCreated,
attributeUpdated, attributeNotBefore) so downstream callers like getSecretTag
and getSecretMapProperties never receive nil pointers.

🧹 Nitpick comments (1)

providers/v1/azure/keyvault/keyvault.go (1)
1437-1442: Consider extracting the repeated metadata-fetch pattern into a helper.

The same 5-line block (declare 4 nil pointers → conditionally extract from .Attributes → call getSecretAllMetadata → call getSecretTag) is duplicated verbatim for secrets (line 1438), certificates (line 1455), and keys (line 1472). A small helper would reduce duplication:
♻️ Example helper
// getMetadataTag extracts time-based attributes from legacy SDK attributes and merges them with tags.
func getMetadataTag(tags map[string]*string, expires, created, updated, notBefore *date.UnixTime, property string) ([]byte, error) {
	return getSecretTag(getSecretAllMetadata(tags, expires, created, updated, notBefore), property)
}
Each call site would then reduce to:
if ref.MetadataPolicy == esv1.ExternalSecretMetadataPolicyFetch {
    var expires, created, updated, notBefore *date.UnixTime
    if secretResp.Attributes != nil {
        expires, created, updated, notBefore = secretResp.Attributes.Expires, secretResp.Attributes.Created, secretResp.Attributes.Updated, secretResp.Attributes.NotBefore
    }
    return getMetadataTag(secretResp.Tags, expires, created, updated, notBefore, ref.Property)
}
You could further reduce boilerplate by accepting the Attributes struct directly if the three attribute types share a common interface or struct.

providers/v1/azure/keyvault/keyvault.go

sonarqubecloud · 2026-02-06T16:14:32Z

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Skarlso

Actually, this is a lot of code that could be massively simplified. :D

providers/v1/azure/keyvault/keyvault.go

Closes external-secrets#4697. When MetadataPolicy is set to Fetch, secret/cert/key attributes (expires, created, updated, notBefore) are now included alongside tags in the metadata response as RFC3339 timestamps. Also fixes the gocritic sloppyReassign lint errors that blocked PR external-secrets#4709. Signed-off-by: Murali <muraliavarma@gmail.com>

- Add nil checks before dereferencing tag value pointers in getSecretAllMetadata, getSecretTagsWithLegacySDK, and okByTags - Prefix attribute keys with "attribute." to avoid colliding with user-defined tags - Use secretName_ prefix for attributes in getSecretTagsWithLegacySDK so property lookups in GetSecretMap work correctly Signed-off-by: Murali <muraliavarma@gmail.com>

- Accept response structs directly in getSecretAllMetadata via type switch, reducing call sites to one-liners - Use inline set closure to eliminate repeated nil-check + format blocks - Mutate tags map in-place instead of cloning - Remove unrelated parseError style changes to keep diff focused Signed-off-by: Murali <muraliavarma@gmail.com>

muraliavarma · 2026-03-17T02:41:38Z

@Skarlso I tried addressing your feedback. Go is not my most comfortable language so I apologize if it is not up to standards, but I am happy to iterate and get this across the finish line. Thank you.

Skarlso · 2026-03-17T06:59:47Z

No worries. I'll help you along. 😊

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

Skarlso · 2026-03-18T06:10:43Z

Well done, I think this is okay. I did some tiny changes, the rest looks good to me. :)

Skarlso

Actually, this is a lot of code that could be massively simplified. :D

sonarqubecloud · 2026-03-19T08:13:37Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…2.2.0 (#4923) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.1.0` → `v2.2.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](external-secrets/external-secrets#6091) #### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](external-secrets/external-secrets#6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](external-secrets/external-secrets#6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](external-secrets/external-secrets#5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](external-secrets/external-secrets#6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](external-secrets/external-secrets#6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](external-secrets/external-secrets#6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](external-secrets/external-secrets#5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](external-secrets/external-secrets#6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](external-secrets/external-secrets#6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](external-secrets/external-secrets#6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](external-secrets/external-secrets#6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](external-secrets/external-secrets#5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](external-secrets/external-secrets#5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4923 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.1.0` → `2.2.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`  ##### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](external-secrets/external-secrets#6091) ##### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](external-secrets/external-secrets#6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](external-secrets/external-secrets#6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](external-secrets/external-secrets#5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](external-secrets/external-secrets#6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](external-secrets/external-secrets#6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](external-secrets/external-secrets#6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](external-secrets/external-secrets#5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](external-secrets/external-secrets#6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](external-secrets/external-secrets#6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](external-secrets/external-secrets#6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](external-secrets/external-secrets#6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](external-secrets/external-secrets#5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](external-secrets/external-secrets#5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4927 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

github-project-automation bot added this to External Secrets Feb 6, 2026

github-actions bot added kind/feature Categorizes issue or PR as related to a new feature. area/azurekv size/m labels Feb 6, 2026

coderabbitai bot reviewed Feb 6, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

muraliavarma force-pushed the feat/azure-kv-expose-attributes branch 6 times, most recently from d8e54ae to 93a362e Compare February 6, 2026 15:42

coderabbitai bot reviewed Feb 6, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

muraliavarma force-pushed the feat/azure-kv-expose-attributes branch from 93a362e to 56b36cd Compare February 6, 2026 16:00

github-actions bot added the size/s label Feb 6, 2026

muraliavarma changed the title ~~feat(azurekv): expose expiration and time attributes in secret metadata~~ feat(azurekv): add expiration time to azure kv secret Feb 6, 2026

coderabbitai bot reviewed Feb 6, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Show resolved Hide resolved

providers/v1/azure/keyvault/keyvault.go Show resolved Hide resolved

muraliavarma mentioned this pull request Feb 6, 2026

feat(azurekv): add expiration time to azure kv secret #4709

Closed

5 tasks

muraliavarma mentioned this pull request Feb 28, 2026

Expose Expiration Date from secret backend #4697

Closed

Skarlso approved these changes Mar 16, 2026

View reviewed changes

Skarlso requested changes Mar 16, 2026

View reviewed changes

Skarlso reviewed Mar 16, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

Skarlso reviewed Mar 16, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

Skarlso reviewed Mar 16, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

Skarlso reviewed Mar 16, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

Skarlso reviewed Mar 16, 2026

View reviewed changes

providers/v1/azure/keyvault/keyvault.go Outdated Show resolved Hide resolved

muraliavarma added 3 commits March 16, 2026 22:37

muraliavarma force-pushed the feat/azure-kv-expose-attributes branch from ad65e96 to 915ab9f Compare March 17, 2026 02:39

muraliavarma requested a review from Skarlso March 17, 2026 02:40

small adjustments and nil checks

711ff5a

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

Merge branch 'main' into feat/azure-kv-expose-attributes

ccd9e28

Skarlso approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into feat/azure-kv-expose-attributes

f0335eb

Skarlso merged commit 0b4e1f9 into external-secrets:main Mar 19, 2026
29 checks passed

github-project-automation bot moved this to Done in External Secrets Mar 19, 2026

Uh oh!

Conversation

muraliavarma commented Feb 6, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Checklist

Summary

Changes

Impact

Uh oh!

coderabbitai bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 6, 2026

Quality Gate passed

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

muraliavarma commented Mar 17, 2026

Uh oh!

Skarlso commented Mar 17, 2026

Uh oh!

Skarlso commented Mar 18, 2026

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Mar 19, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

muraliavarma commented Feb 6, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Feb 6, 2026 •

edited

Loading