docs(azurekv): cert-manager pushsecret example and cleanups#5972
Merged
Skarlso merged 7 commits intoexternal-secrets:mainfrom Mar 6, 2026
Merged
docs(azurekv): cert-manager pushsecret example and cleanups#5972Skarlso merged 7 commits intoexternal-secrets:mainfrom
Skarlso merged 7 commits intoexternal-secrets:mainfrom
Conversation
WalkthroughReplaced generic Azure Key Vault docs with provider-specific guidance for Changes
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
docs/snippets/azkv-secret-store.yaml (1)
12-24: Consider adding a comment noting thatclientSecretandclientCertificateare mutually exclusive.Showing all three auth fields together is fine for documenting available options, but users might try to specify both
clientSecretandclientCertificatesimultaneously. A brief inline comment (e.g.,# Use either clientSecret or clientCertificate, not both) would prevent confusion.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/snippets/azkv-secret-store.yaml` around lines 12 - 24, Add a brief inline note to the authSecretRef block clarifying mutual exclusivity between clientSecret and clientCertificate: indicate that clientId is always provided but use either clientSecret or clientCertificate, not both (e.g., add a comment above clientSecret/clientCertificate). Reference the authSecretRef, clientId, clientSecret and clientCertificate keys so maintainers can locate and update the YAML snippet.docs/provider/azure-key-vault.md (2)
210-210: Minor style improvement: hyphenate compound modifier.Consider changing "PEM encoded PKIX" to "PEM-encoded PKIX" for consistency with standard English compound modifier style.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/provider/azure-key-vault.md` at line 210, Update the compound modifier in the table cell that currently reads "PEM encoded PKIX ASN.1 DER format" to use the hyphenated form "PEM-encoded PKIX ASN.1 DER format"; locate the table row containing the Key column value "`key`" and replace the phrase accordingly to maintain consistent compound-modifier styling.
250-250: Optional: simplify "In order to" phrases.For more concise documentation, consider simplifying "In order to" to "To" in the permission notes at lines 250, 260, and 285. This is a minor style preference.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/provider/azure-key-vault.md` at line 250, Replace the verbose phrase "In order to" with the concise "To" in the permission note sentences (the instances currently reading "In order to create a PushSecret..." and the similar notes at the other two locations) in azure-key-vault.md so the text reads e.g. "To create a PushSecret targeting Secrets, the Key Vault Secrets Officer role..." while preserving the links and role/permission names exactly as-is.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/provider/azure-key-vault.md`:
- Line 250: The markdown contains a typo: "Secretsmust" should be two words;
update the sentence referencing Key Vault roles so "Secretsmust" becomes
"Secrets must". Locate the sentence mentioning "PushSecret", "Key Vault Secrets
Officer", and "SecretStore" and insert a space between "Secrets" and "must" to
correct the phrase.
- Line 264: Fix the subject-verb agreement in the sentence beginning
"Certificates in P12 (also known as PKCS12 or PFX) is the most stable format..."
by rephrasing to use a singular subject (preferred) or make the verb plural;
e.g., change to "The P12 format (also known as PKCS12 or PFX) is the most stable
format for importing certificates to Azure Key Vault." Keep the rest of the
paragraph intact (mentions of PKCS8, PKCS1, and password-less P12 files).
---
Nitpick comments:
In `@docs/provider/azure-key-vault.md`:
- Line 210: Update the compound modifier in the table cell that currently reads
"PEM encoded PKIX ASN.1 DER format" to use the hyphenated form "PEM-encoded PKIX
ASN.1 DER format"; locate the table row containing the Key column value "`key`"
and replace the phrase accordingly to maintain consistent compound-modifier
styling.
- Line 250: Replace the verbose phrase "In order to" with the concise "To" in
the permission note sentences (the instances currently reading "In order to
create a PushSecret..." and the similar notes at the other two locations) in
azure-key-vault.md so the text reads e.g. "To create a PushSecret targeting
Secrets, the Key Vault Secrets Officer role..." while preserving the links and
role/permission names exactly as-is.
In `@docs/snippets/azkv-secret-store.yaml`:
- Around line 12-24: Add a brief inline note to the authSecretRef block
clarifying mutual exclusivity between clientSecret and clientCertificate:
indicate that clientId is always provided but use either clientSecret or
clientCertificate, not both (e.g., add a comment above
clientSecret/clientCertificate). Reference the authSecretRef, clientId,
clientSecret and clientCertificate keys so maintainers can locate and update the
YAML snippet.
Signed-off-by: Richard Ahlquist <richard.jimmy.johansson@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/provider/azure-key-vault.md`:
- Line 48: Change the sentence that currently starts "Regardless which
authentication method is used to authenticate to Azure Key Vault..." to read
"Regardless of which authentication method is used to authenticate to Azure Key
Vault..." (replace "Regardless which" with "Regardless of which") so the grammar
is correct; locate the sentence by its exact phrase "Regardless which
authentication method is used to authenticate to Azure Key Vault" in the
azure-key-vault provider doc and update it accordingly.
- Line 253: Change the uppercase "AND" to lowercase "and" in the supported
formats sentence (the backticked phrase showing `PRIVATE KEY`, `RSA PRIVATE KEY`
AND `EC PRIVATE KEY`) so it reads `PRIVATE KEY`, `RSA PRIVATE KEY` and `EC
PRIVATE KEY`; locate the occurrence in docs/provider/azure-key-vault.md (the
line containing the backticked list of supported formats) and update the casing
for consistency.
Skarlso
reviewed
Feb 27, 2026
Contributor
Skarlso
left a comment
There was a problem hiding this comment.
Couple of remarks. Thanks!
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/provider/azure-key-vault.md`:
- Line 8: The docs describe environmentType as both mandatory and defaulting to
PublicCloud, which is contradictory; update the azure-key-vault.md text to
clarify that environmentType is optional and defaults to "PublicCloud" unless
you need a different cloud flavour (e.g., `USGovernmentCloud`, `ChinaCloud`,
`GermanCloud`, `AzureStackCloud`), and remove the wording that implies it is
required so users understand they only need to set `environmentType` when
targeting a non-default cloud.
- Around line 209-210: The docs incorrectly state that both ExternalSecret and
PushSecret use spec.data[].remoteRef.key for object-type prefixes; update the
wording to note ExternalSecret uses spec.data[].remoteRef.key while PushSecret
expects the prefix on spec.data[].match.remoteRef.remoteKey (refer to the
snippet azkv-pushsecret-certificate-pem.yaml showing
spec.data[].match.remoteRef.remoteKey), and clarify that if no prefix is
provided the operator defaults to secret.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6564a6e2-2768-4580-bccb-52bfd25cc23e
📒 Files selected for processing (6)
docs/provider/azure-key-vault.mddocs/snippets/azkv-pushsecret-certificate-cert-manager.yamldocs/snippets/azkv-pushsecret-certificate-p12.yamldocs/snippets/azkv-pushsecret-certificate-pem.yamldocs/snippets/azkv-secret-store-spn-certificate.yamldocs/snippets/azkv-secret-store-spn-secret.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- docs/snippets/azkv-pushsecret-certificate-cert-manager.yaml
- docs/snippets/azkv-pushsecret-certificate-p12.yaml
Comment on lines
+209
to
210
| Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch via an `ExternalSecret` or push via a `PushSecret`, prefix the `spec.data[].remoteRef.key` field with either `key`, `secret` or `cert`. If no prefix is provided, the operator defaults to `secret`. | ||
|
|
There was a problem hiding this comment.
Object-type key path is wrong for PushSecret.
spec.data[].remoteRef.key is correct for ExternalSecret, but PushSecret uses spec.data[].match.remoteRef.remoteKey (as shown in docs/snippets/azkv-pushsecret-certificate-pem.yaml, Lines 31-34). Current wording can cause users to place prefixes in the wrong field.
✏️ Proposed wording fix
-Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch via an `ExternalSecret` or push via a `PushSecret`, prefix the `spec.data[].remoteRef.key` field with either `key`, `secret` or `cert`. If no prefix is provided, the operator defaults to `secret`.
+Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch via an `ExternalSecret` or push via a `PushSecret`, prefix:
+- `ExternalSecret`: `spec.data[].remoteRef.key`
+- `PushSecret`: `spec.data[].match.remoteRef.remoteKey`
+with either `key`, `secret` or `cert`. If no prefix is provided, the operator defaults to `secret`.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch via an `ExternalSecret` or push via a `PushSecret`, prefix the `spec.data[].remoteRef.key` field with either `key`, `secret` or `cert`. If no prefix is provided, the operator defaults to `secret`. | |
| Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch via an `ExternalSecret` or push via a `PushSecret`, prefix: | |
| - `ExternalSecret`: `spec.data[].remoteRef.key` | |
| - `PushSecret`: `spec.data[].match.remoteRef.remoteKey` | |
| with either `key`, `secret` or `cert`. If no prefix is provided, the operator defaults to `secret`. |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docs/provider/azure-key-vault.md` around lines 209 - 210, The docs
incorrectly state that both ExternalSecret and PushSecret use
spec.data[].remoteRef.key for object-type prefixes; update the wording to note
ExternalSecret uses spec.data[].remoteRef.key while PushSecret expects the
prefix on spec.data[].match.remoteRef.remoteKey (refer to the snippet
azkv-pushsecret-certificate-pem.yaml showing
spec.data[].match.remoteRef.remoteKey), and clarify that if no prefix is
provided the operator defaults to secret.
Signed-off-by: Richard Ahlquist <richard.jimmy.johansson@gmail.com>
There was a problem hiding this comment.
♻️ Duplicate comments (2)
docs/provider/azure-key-vault.md (2)
8-8:⚠️ Potential issue | 🟡 Minor
environmentTypedescription is contradictory.The sentence says you "have to specify" the
environmentTypebut also states it "defaults toPublicCloud". This is confusing—if it defaults, it's not mandatory.✏️ Proposed fix
-ESO supports connecting to different cloud flavours azure supports: `PublicCloud`, `USGovernmentCloud`, `ChinaCloud`, `GermanCloud` and `AzureStackCloud` (for Azure Stack Hub/Edge). You have to specify the `environmentType` and point to the correct cloud flavour. This defaults to `PublicCloud`. +ESO supports connecting to different Azure cloud flavours: `PublicCloud`, `USGovernmentCloud`, `ChinaCloud`, `GermanCloud` and `AzureStackCloud` (for Azure Stack Hub/Edge). Set `environmentType` when targeting a non-default cloud; if omitted, it defaults to `PublicCloud`.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/provider/azure-key-vault.md` at line 8, The documentation line about environmentType is contradictory: change the wording so it clearly states that environmentType is optional and defaults to PublicCloud rather than saying you "have to specify" it; mention the supported values (PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud, AzureStackCloud) and instruct readers to set environmentType only when they need a non-default cloud flavour (e.g., AzureStackCloud) so the doc is unambiguous about the default behavior of environmentType.
209-210:⚠️ Potential issue | 🟡 MinorPushSecret uses a different key path than documented.
The documentation states to prefix
spec.data[].remoteRef.keyfor both ExternalSecret and PushSecret, but PushSecret actually usesspec.data[].match.remoteRef.remoteKey(as shown in the included snippets likeazkv-pushsecret-certificate-pem.yaml).✏️ Proposed fix
-Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch via an `ExternalSecret` or push via a `PushSecret`, prefix the `spec.data[].remoteRef.key` field with either `key`, `secret` or `cert`. If no prefix is provided, the operator defaults to `secret`. +Azure Key Vault has different [object types](https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#object-types); Secrets, Keys and Certificates, all of which are supported. To explicitly select which object type to fetch or push, prefix with `key`, `secret` or `cert`: + +- **ExternalSecret**: prefix `spec.data[].remoteRef.key` +- **PushSecret**: prefix `spec.data[].match.remoteRef.remoteKey` + +If no prefix is provided, the operator defaults to `secret`.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/provider/azure-key-vault.md` around lines 209 - 210, Update the docs to state that PushSecret uses a different remote key path than ExternalSecret: instead of `spec.data[].remoteRef.key` the PushSecret examples and usage must reference `spec.data[].match.remoteRef.remoteKey` (as seen in `azkv-pushsecret-certificate-pem.yaml`) and clarify the same `key|secret|cert` prefix semantics apply to that field; adjust the paragraph that currently mentions `spec.data[].remoteRef.key` so it explicitly distinguishes ExternalSecret vs PushSecret field names and update any example snippets to use `spec.data[].match.remoteRef.remoteKey` for PushSecret.
🧹 Nitpick comments (1)
docs/provider/azure-key-vault.md (1)
48-48: Minor: Consider hyphenating compound adjective."Access Policy based Key Vaults" would read more clearly as "Access Policy-based Key Vaults".
✏️ Proposed fix
-Regardless of which authentication method is used to authenticate to Azure Key Vault, the identity which is assigned to External Secrets Operator needs to have proper permissions to access the Key Vault. Both [RBAC](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide) and legacy [Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy) based Key Vaults are supported. +Regardless of which authentication method is used to authenticate to Azure Key Vault, the identity which is assigned to External Secrets Operator needs to have proper permissions to access the Key Vault. Both [RBAC](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide) and legacy [Access Policy](https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy)-based Key Vaults are supported.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/provider/azure-key-vault.md` at line 48, Update the phrase "Access Policy based Key Vaults" to the hyphenated form "Access Policy-based Key Vaults" in the docs content (search for the exact string "Access Policy based Key Vaults" in azure-key-vault.md and replace it); also scan for any other occurrences of the same compound adjective in that file and apply the same hyphenation to keep wording consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@docs/provider/azure-key-vault.md`:
- Line 8: The documentation line about environmentType is contradictory: change
the wording so it clearly states that environmentType is optional and defaults
to PublicCloud rather than saying you "have to specify" it; mention the
supported values (PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud,
AzureStackCloud) and instruct readers to set environmentType only when they need
a non-default cloud flavour (e.g., AzureStackCloud) so the doc is unambiguous
about the default behavior of environmentType.
- Around line 209-210: Update the docs to state that PushSecret uses a different
remote key path than ExternalSecret: instead of `spec.data[].remoteRef.key` the
PushSecret examples and usage must reference
`spec.data[].match.remoteRef.remoteKey` (as seen in
`azkv-pushsecret-certificate-pem.yaml`) and clarify the same `key|secret|cert`
prefix semantics apply to that field; adjust the paragraph that currently
mentions `spec.data[].remoteRef.key` so it explicitly distinguishes
ExternalSecret vs PushSecret field names and update any example snippets to use
`spec.data[].match.remoteRef.remoteKey` for PushSecret.
---
Nitpick comments:
In `@docs/provider/azure-key-vault.md`:
- Line 48: Update the phrase "Access Policy based Key Vaults" to the hyphenated
form "Access Policy-based Key Vaults" in the docs content (search for the exact
string "Access Policy based Key Vaults" in azure-key-vault.md and replace it);
also scan for any other occurrences of the same compound adjective in that file
and apply the same hyphenation to keep wording consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a90639f6-abcb-48d6-b8b7-f4c11a3344ed
📒 Files selected for processing (6)
docs/provider/azure-key-vault.mddocs/snippets/azkv-pushsecret-certificate-cert-manager.yamldocs/snippets/azkv-pushsecret-certificate-p12.yamldocs/snippets/azkv-pushsecret-certificate-pem.yamldocs/snippets/azkv-secret-store-spn-certificate.yamldocs/snippets/azkv-secret-store-spn-secret.yaml
🚧 Files skipped from review as they are similar to previous changes (4)
- docs/snippets/azkv-pushsecret-certificate-cert-manager.yaml
- docs/snippets/azkv-pushsecret-certificate-p12.yaml
- docs/snippets/azkv-secret-store-spn-secret.yaml
- docs/snippets/azkv-secret-store-spn-certificate.yaml
Skarlso
approved these changes
Mar 5, 2026
|
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Mar 6, 2026
…2.1.0 (#4491) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.0.1` → `v2.1.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.1.0) [Compare Source](external-secrets/external-secrets@v2.0.1...v2.1.0) Image: `ghcr.io/external-secrets/external-secrets:v2.1.0` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore(release): Update helm chart by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5981](external-secrets/external-secrets#5981) - fix: cosign verify does not use signing config by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5982](external-secrets/external-secrets#5982) - docs: Update release process by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5980](external-secrets/external-secrets#5980) - fix: allow cross-namespace push with ClusterSecretStore objects by [@​Skarlso](https://github.com/Skarlso) in [#​5998](external-secrets/external-secrets#5998) - feat(charts): add new flag enable leader for cert-manager by [@​nutmos](https://github.com/nutmos) in [#​5863](external-secrets/external-secrets#5863) - feat(kubernetes): fall back to system CA roots when no CA is configured by [@​rajsinghtech](https://github.com/rajsinghtech) in [#​5961](external-secrets/external-secrets#5961) - feat: dedup sbom but keep it monolithic by [@​moolen](https://github.com/moolen) in [#​6004](external-secrets/external-secrets#6004) - fix: add missing metrics and fundamentally fix the caching logic by [@​Skarlso](https://github.com/Skarlso) in [#​5894](external-secrets/external-secrets#5894) - docs: designate Oracle Vault provider as 'stable' by [@​anders-swanson](https://github.com/anders-swanson) in [#​6020](external-secrets/external-secrets#6020) - docs: Oracle Vault provider capabilities by [@​anders-swanson](https://github.com/anders-swanson) in [#​6023](external-secrets/external-secrets#6023) - docs(azurekv): cert-manager pushsecret example and cleanups by [@​illrill](https://github.com/illrill) in [#​5972](external-secrets/external-secrets#5972) - feat(kubernetes): implement SecretExists by [@​Saku2](https://github.com/Saku2) in [#​5973](external-secrets/external-secrets#5973) - fix(charts): Fix wrongly set annotations for cert-controller metrics service by [@​josemaia](https://github.com/josemaia) in [#​6029](external-secrets/external-secrets#6029) - feat(providers): Nebius MysteryBox integration by [@​greenmapc](https://github.com/greenmapc) in [#​5868](external-secrets/external-secrets#5868) ##### Dependencies - chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5986](external-secrets/external-secrets#5986) - chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5992](external-secrets/external-secrets#5992) - chore(deps): bump ubi9/ubi from `b8923f5` to `cecb1cd` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5984](external-secrets/external-secrets#5984) - chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5985](external-secrets/external-secrets#5985) - chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5990](external-secrets/external-secrets#5990) - chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5989](external-secrets/external-secrets#5989) - chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5987](external-secrets/external-secrets#5987) - chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5991](external-secrets/external-secrets#5991) - chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5988](external-secrets/external-secrets#5988) - chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6012](external-secrets/external-secrets#6012) - chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6014](external-secrets/external-secrets#6014) - chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6015](external-secrets/external-secrets#6015) - chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6016](external-secrets/external-secrets#6016) - chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6013](external-secrets/external-secrets#6013) - chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6010](external-secrets/external-secrets#6010) - chore(deps): bump hashicorp/setup-terraform from [`ce70bcf`](external-secrets/external-secrets@ce70bcf) to [`5e8dbf3`](external-secrets/external-secrets@5e8dbf3) by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6011](external-secrets/external-secrets#6011) - chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6009](external-secrets/external-secrets#6009) - chore(deps): bump distroless/static from `972618c` to `28efbe9` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6008](external-secrets/external-secrets#6008) #### New Contributors - [@​nutmos](https://github.com/nutmos) made their first contribution in [#​5863](external-secrets/external-secrets#5863) - [@​rajsinghtech](https://github.com/rajsinghtech) made their first contribution in [#​5961](external-secrets/external-secrets#5961) - [@​illrill](https://github.com/illrill) made their first contribution in [#​5972](external-secrets/external-secrets#5972) - [@​Saku2](https://github.com/Saku2) made their first contribution in [#​5973](external-secrets/external-secrets#5973) - [@​greenmapc](https://github.com/greenmapc) made their first contribution in [#​5868](external-secrets/external-secrets#5868) **Full Changelog**: <external-secrets/external-secrets@v2.0.1...v2.1.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41MS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4491 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Mar 7, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.0.1` → `2.1.0` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.1.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.1.0) [Compare Source](external-secrets/external-secrets@v2.0.1...v2.1.0) Image: `ghcr.io/external-secrets/external-secrets:v2.1.0` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore(release): Update helm chart by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5981](external-secrets/external-secrets#5981) - fix: cosign verify does not use signing config by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5982](external-secrets/external-secrets#5982) - docs: Update release process by [@​evrardj-roche](https://github.com/evrardj-roche) in [#​5980](external-secrets/external-secrets#5980) - fix: allow cross-namespace push with ClusterSecretStore objects by [@​Skarlso](https://github.com/Skarlso) in [#​5998](external-secrets/external-secrets#5998) - feat(charts): add new flag enable leader for cert-manager by [@​nutmos](https://github.com/nutmos) in [#​5863](external-secrets/external-secrets#5863) - feat(kubernetes): fall back to system CA roots when no CA is configured by [@​rajsinghtech](https://github.com/rajsinghtech) in [#​5961](external-secrets/external-secrets#5961) - feat: dedup sbom but keep it monolithic by [@​moolen](https://github.com/moolen) in [#​6004](external-secrets/external-secrets#6004) - fix: add missing metrics and fundamentally fix the caching logic by [@​Skarlso](https://github.com/Skarlso) in [#​5894](external-secrets/external-secrets#5894) - docs: designate Oracle Vault provider as 'stable' by [@​anders-swanson](https://github.com/anders-swanson) in [#​6020](external-secrets/external-secrets#6020) - docs: Oracle Vault provider capabilities by [@​anders-swanson](https://github.com/anders-swanson) in [#​6023](external-secrets/external-secrets#6023) - docs(azurekv): cert-manager pushsecret example and cleanups by [@​illrill](https://github.com/illrill) in [#​5972](external-secrets/external-secrets#5972) - feat(kubernetes): implement SecretExists by [@​Saku2](https://github.com/Saku2) in [#​5973](external-secrets/external-secrets#5973) - fix(charts): Fix wrongly set annotations for cert-controller metrics service by [@​josemaia](https://github.com/josemaia) in [#​6029](external-secrets/external-secrets#6029) - feat(providers): Nebius MysteryBox integration by [@​greenmapc](https://github.com/greenmapc) in [#​5868](external-secrets/external-secrets#5868) ##### Dependencies - chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5986](external-secrets/external-secrets#5986) - chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5992](external-secrets/external-secrets#5992) - chore(deps): bump ubi9/ubi from `b8923f5` to `cecb1cd` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5984](external-secrets/external-secrets#5984) - chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5985](external-secrets/external-secrets#5985) - chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5990](external-secrets/external-secrets#5990) - chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5989](external-secrets/external-secrets#5989) - chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5987](external-secrets/external-secrets#5987) - chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5991](external-secrets/external-secrets#5991) - chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5988](external-secrets/external-secrets#5988) - chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6012](external-secrets/external-secrets#6012) - chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6014](external-secrets/external-secrets#6014) - chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6015](external-secrets/external-secrets#6015) - chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6016](external-secrets/external-secrets#6016) - chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6013](external-secrets/external-secrets#6013) - chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6010](external-secrets/external-secrets#6010) - chore(deps): bump hashicorp/setup-terraform from [`ce70bcf`](external-secrets/external-secrets@ce70bcf) to [`5e8dbf3`](external-secrets/external-secrets@5e8dbf3) by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6011](external-secrets/external-secrets#6011) - chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6009](external-secrets/external-secrets#6009) - chore(deps): bump distroless/static from `972618c` to `28efbe9` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​6008](external-secrets/external-secrets#6008) #### New Contributors - [@​nutmos](https://github.com/nutmos) made their first contribution in [#​5863](external-secrets/external-secrets#5863) - [@​rajsinghtech](https://github.com/rajsinghtech) made their first contribution in [#​5961](external-secrets/external-secrets#5961) - [@​illrill](https://github.com/illrill) made their first contribution in [#​5972](external-secrets/external-secrets#5972) - [@​Saku2](https://github.com/Saku2) made their first contribution in [#​5973](external-secrets/external-secrets#5973) - [@​greenmapc](https://github.com/greenmapc) made their first contribution in [#​5868](external-secrets/external-secrets#5868) **Full Changelog**: <external-secrets/external-secrets@v2.0.1...v2.1.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhcnQiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4516 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
evs-secops
pushed a commit
to evs-secops/external-secrets
that referenced
this pull request
Mar 8, 2026
…-secrets#5972) Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com> Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>
AlexOQ
pushed a commit
to AlexOQ/external-secrets
that referenced
this pull request
Mar 18, 2026
…-secrets#5972) Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com> Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>
dsp0x4
pushed a commit
to dsp0x4/external-secrets
that referenced
this pull request
Mar 22, 2026
…-secrets#5972) Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem Statement
Closes issues #5740 and #2589 by providing complete documentation and working examples for cert-manager → Azure Key Vault certificate workflows, addressing PEM-to-PKCS#12 conversion requirements and Azure Key Vault certificate store integration. In addition, enhancements and cleanup of the overall article, including:
Related Issue
Closes #5740
Closes #2589
Proposed Changes
Format
Please ensure that your PR follows the following format for the title:
Where
scopeis optionally one of:Checklist
git commit --signoffmake testmake reviewableOverview
Expanded documentation and examples for the Azure Key Vault provider to enable cert-manager → Azure Key Vault certificate workflows via PushSecret, including PEM→PKCS#12 conversion and Key Vault certificate store support.
Key Changes
docs/provider/azure-key-vault.md
Examples and snippets
Notable details
Impact
Closes issues #5740 and #2589 by documenting conversion guidance and providing working PushSecret examples to import cert-manager–generated certificates (or kubernetes.io/tls secrets) into Azure Key Vault certificates (PKCS#12 import). Also includes contributor checklist confirmations and doc cleanups.