fix(aws): sync tags and resource policy even when secret value unchanged by evs-secops · Pull Request #6025 · external-secrets/external-secrets

evs-secops · 2026-03-05T16:24:49Z

Summary

When using PushSecret with AWS Secrets Manager, tag and resource policy updates were silently ignored if the secret value hadn't changed. The putSecretValueWithContext function had an early-return optimization that skipped patchTags() and manageResourcePolicy() when the value was identical.

Changes

Move patchTags() and manageResourcePolicy() calls before the secret value comparison check in putSecretValueWithContext
Add regression test TestPushSecretTagsUpdatedWhenValueUnchanged
Fix existing test SetSecretWillNotPushSameSecret to include required fake client methods
Extract testARN and testDefaultVersion constants to fix goconst lint

Testing

All unit tests pass (go test ./providers/v1/aws/secretsmanager/...)
Lint passes (make lint)

fix(aws): sync tags and resource policy even when secret value unchanged

Fixes #6024: Ensure PushSecret metadata updates (tags and resource policy) are applied to AWS Secrets Manager even when the secret value is unchanged by removing the early-return that prevented tag/policy updates.

Changes

providers/v1/aws/secretsmanager/secretsmanager.go

Move patchTags() and manageResourcePolicy() to execute before the secret value equality check and before PutSecretValue in putSecretValueWithContext. Remove the prior post-PutSecretValue tag/policy flow.
No exported APIs changed.

providers/v1/aws/secretsmanager/secretsmanager_test.go

Add constants testARN and testDefaultVersion to replace hard-coded ARN/version strings.
Extend fake client setup with TagResourceFn, UntagResourceFn, and DeleteResourcePolicyFn where required.
Add regression tests:
- TestPushSecretTagsUpdatedWhenValueUnchanged — verifies TagResource is called to update tags when value is unchanged and PutSecretValue is not called.
- TestPushSecretResourcePolicyUpdatedWhenValueUnchanged — verifies PutResourcePolicy is called to update resource policy when value is unchanged and PutSecretValue is not called.
Fix existing test SetSecretWillNotPushSameSecret to include required fake client methods and adjust mocks/assertions.

Testing

Unit tests for providers/v1/aws/secretsmanager pass (go test ./providers/v1/aws/secretsmanager/...).
Lint passes (make lint).

coderabbitai · 2026-03-05T16:25:09Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Reorders tag and resource-policy operations to run before calling PutSecretValue in Secrets Manager logic; adds test constants and mocks, and adds tests ensuring tags and resource policy are updated when the secret value is unchanged. No exported APIs changed.

Changes

Cohort / File(s)	Summary
Secrets Manager Implementation `providers/v1/aws/secretsmanager/secretsmanager.go`	Reordered `putSecretValueWithContext` flow: builds `currentTags`, calls `patchTags`, and invokes `manageResourcePolicy` before calling `PutSecretValue`. Removed the previous post-`PutSecretValue` tag and policy handling. Internal-only changes; no public signatures modified.
Secrets Manager Tests `providers/v1/aws/secretsmanager/secretsmanager_test.go`	Added `testARN` and `testDefaultVersion` constants and replaced hard-coded literals; expanded test mocks (`TagResourceFn`, `UntagResourceFn`, `DeleteResourcePolicyFn`); added tests (`TestPushSecretTagsUpdatedWhenValueUnchanged`, `TestPushSecretResourcePolicyUpdatedWhenValueUnchanged`) asserting tag and resource-policy updates occur without invoking `PutSecretValue`.

Possibly related PRs

fix(aws): parse resource policies into canonical JSON (sorted) before comparing #5622: Modifies manageResourcePolicy policy comparison/management logic, directly related to invoking manageResourcePolicy earlier in the write flow.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The pull request directly addresses the requirements from issue `#6024` by moving patchTags() and manageResourcePolicy() calls before the secret value equality check, ensuring metadata updates are applied even when the secret value is unchanged.
Out of Scope Changes check	✅ Passed	All changes are directly related to fixing the bug described in issue `#6024` and adding regression tests; no out-of-scope modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (1)

providers/v1/aws/secretsmanager/secretsmanager_test.go (1)

1267-1269: Strengthen the regression assertion by validating tag content.

Right now this only checks TagResource was called. Assert the expected tag payload too, so the test fails if the call happens with incorrect tags.

Suggested assertion hardening

 		TagResourceFn: fakesm.NewTagResourceFn(&awssm.TagResourceOutput{}, nil, func(input *awssm.TagResourceInput) {
 			tagResourceCalled = true
+			assert.Contains(t, input.Tags, types.Tag{Key: ptr.To("newTag"), Value: ptr.To("newValue")})
 		}),

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@providers/v1/aws/secretsmanager/secretsmanager_test.go` around lines 1267 -
1269, The test currently only sets TagResourceFn to flip tagResourceCalled;
modify the fake to capture the provided *awssm.TagResourceInput and assert its
Tags payload equals the expected tags. Replace the simple callback in
fakesm.NewTagResourceFn with one that stores the input (e.g., capturedTagInput)
or directly validates input.Tags against your expected slice/map, and add an
assertion after exercising the code to compare capturedTagInput.Tags to the
expected tag set; reference TagResourceFn, fakesm.NewTagResourceFn,
tagResourceCalled and awssm.TagResourceInput when locating where to add the
capture/assertion.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@providers/v1/aws/secretsmanager/secretsmanager_test.go`:
- Around line 1267-1269: The test currently only sets TagResourceFn to flip
tagResourceCalled; modify the fake to capture the provided
*awssm.TagResourceInput and assert its Tags payload equals the expected tags.
Replace the simple callback in fakesm.NewTagResourceFn with one that stores the
input (e.g., capturedTagInput) or directly validates input.Tags against your
expected slice/map, and add an assertion after exercising the code to compare
capturedTagInput.Tags to the expected tag set; reference TagResourceFn,
fakesm.NewTagResourceFn, tagResourceCalled and awssm.TagResourceInput when
locating where to add the capture/assertion.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9347b7b1-12cc-4881-97bc-980bed478cb1

📥 Commits

Reviewing files that changed from the base of the PR and between b9af3d6 and dceffde.

📒 Files selected for processing (2)

providers/v1/aws/secretsmanager/secretsmanager.go
providers/v1/aws/secretsmanager/secretsmanager_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

providers/v1/aws/secretsmanager/secretsmanager.go

coderabbitai

🧹 Nitpick comments (1)

providers/v1/aws/secretsmanager/secretsmanager_test.go (1)
1236-1302: Add a companion unchanged-value regression for resource policy sync.

Line [1236] covers the tag-update path well, but this PR also targets resource-policy reconciliation when value is unchanged. Please add a sibling test that keeps value identical, sets resourcePolicy metadata, asserts policy API calls occur, and confirms PutSecretValue is still skipped.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@providers/v1/aws/secretsmanager/secretsmanager_test.go` around lines 1236 -
1302, Add a sibling test named something like
TestPushSecretResourcePolicyUpdatedWhenValueUnchanged that mirrors
TestPushSecretTagsUpdatedWhenValueUnchanged but validates resource-policy
reconciliation: use the same secretKey/secretValue/fakeSecret and a
fakesm.Client where GetSecretValueFn and DescribeSecretFn return the existing
ARN/version and ensure PutSecretValueFn returns an error if invoked (to assert
it is not called), add a PutResourcePolicyFn (or the provider's equivalent,
e.g., PutResourcePolicyFn/PutResourcePolicy) stub that records being called and
captures its input (capturedPolicyInput), set pushSecretData.Metadata.Raw to
include a resourcePolicy payload, call sm.PushSecret(...), assert no error,
assert the PutResourcePolicy stub was called and capturedPolicyInput contains
the expected policy, and assert PutSecretValue was not called.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@providers/v1/aws/secretsmanager/secretsmanager_test.go`:
- Around line 1236-1302: Add a sibling test named something like
TestPushSecretResourcePolicyUpdatedWhenValueUnchanged that mirrors
TestPushSecretTagsUpdatedWhenValueUnchanged but validates resource-policy
reconciliation: use the same secretKey/secretValue/fakeSecret and a
fakesm.Client where GetSecretValueFn and DescribeSecretFn return the existing
ARN/version and ensure PutSecretValueFn returns an error if invoked (to assert
it is not called), add a PutResourcePolicyFn (or the provider's equivalent,
e.g., PutResourcePolicyFn/PutResourcePolicy) stub that records being called and
captures its input (capturedPolicyInput), set pushSecretData.Metadata.Raw to
include a resourcePolicy payload, call sm.PushSecret(...), assert no error,
assert the PutResourcePolicy stub was called and capturedPolicyInput contains
the expected policy, and assert PutSecretValue was not called.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8b40d753-eaa7-40dc-8cf9-0f51c1459c5e

📥 Commits

Reviewing files that changed from the base of the PR and between dceffde and 91cd403.

📒 Files selected for processing (2)

providers/v1/aws/secretsmanager/secretsmanager.go
providers/v1/aws/secretsmanager/secretsmanager_test.go

Skarlso · 2026-03-06T14:16:27Z

/ok-to-test sha=c140a66806c63abb8c4d78825832f5b095e05464

Skarlso · 2026-03-06T14:28:02Z

/ok-to-test sha=c140a66806c63abb8c4d78825832f5b095e05464

Skarlso · 2026-03-06T14:48:19Z

@evs-secops Please fix the test. Also I doubt you ran it since it doesn't even compile.

Skarlso

Failing unit test.

eso-service-account-app · 2026-03-06T14:49:07Z

[Bot] - ✅ e2e for c140a66806c63abb8c4d78825832f5b095e05464 passed

evs-secops · 2026-03-08T10:04:28Z

@Skarlso Hi
I did run the tests locally, but I'm failing to assume those roles

arn:aws:iam::783882199045:role/eso-e2e-external-id
arn:aws:iam::783882199045:role/eso-e2e-session-tags

How can we run the e2e otherwise?

I ran the unit tests, and everything went smoothly.

evs-secops · 2026-03-08T10:08:43Z

I found an issue, fixed it :)
Sorry for the trouble

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@providers/v1/aws/secretsmanager/secretsmanager_test.go`:
- Around line 1391-1397: The assertion for SecretId is wrong: the resource
policy is managed with the ARN returned by DescribeSecret, not the original
remote key. Update the test expectation in the PushSecret test to assert that
capturedPolicyInput.SecretId equals testARN (the value returned by
DescribeSecretFn) instead of fakeKey; reference the PushSecret call, the
DescribeSecretFn setup that sets arn = testARN, and the
capturedPolicyInput.SecretId used in the assertion.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 97a0284f-dcac-4040-8123-c1a29bcb66b7

📥 Commits

Reviewing files that changed from the base of the PR and between c140a66 and 7d96b0b.

📒 Files selected for processing (1)

providers/v1/aws/secretsmanager/secretsmanager_test.go

providers/v1/aws/secretsmanager/secretsmanager_test.go

Fixes external-secrets#6024 When using PushSecret with AWS Secrets Manager, tag and resource policy updates were silently ignored if the secret value hadn't changed. The putSecretValueWithContext function had an early-return optimization that skipped patchTags() and manageResourcePolicy() when the value was identical to the existing secret. This fix moves tag patching and resource policy management before the value comparison check, ensuring metadata updates are always applied regardless of whether the secret value has changed. - Add regression test TestPushSecretTagsUpdatedWhenValueUnchanged that verifies tags are updated even when value is unchanged - Fix existing test SetSecretWillNotPushSameSecret by adding required fake client methods - Extract testARN and testDefaultVersion constants to fix goconst lint violations Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>

Add TestPushSecretResourcePolicyUpdatedWhenValueUnchanged to verify that resource policy changes are applied even when the secret value hasn't changed. This complements the existing tag update test. Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>

…cy test Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>

evs-secops · 2026-03-08T10:41:49Z

ready for review

Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>

evs-secops · 2026-03-10T08:15:14Z

Hi @Skarlso
Can you test and approve the PR if everything is okay? My organization is waiting for that fix :)

Skarlso · 2026-03-10T08:24:19Z

My organization is waiting for that fix :)

For the record, adding something like this just will make it review it later. :) I don't care about your organization. This is a free product. Sentences like this used to pressure the maintainer will result in the opposite of what you are trying to achieve.

I don't appreciate doing something like this. I will let this one slide because it's your first time, but please keep this in mind that people are working on ESO mostly in their free time, so please be respectful of that.

Thanks.

evs-secops · 2026-03-10T13:26:23Z

My organization is waiting for that fix :)

For the record, adding something like this just will make it review it later. :) I don't care about your organization. This is a free product. Sentences like this used to pressure the maintainer will result in the opposite of what you are trying to achieve.

I don't appreciate doing something like this. I will let this one slide because it's your first time, but please keep this in mind that people are working on ESO mostly in their free time, so please be respectful of that.

Thanks.

@Skarlso

First, I apologize for any inconvenience caused; I did not intend to pressure you. I genuinely appreciate all the effort you and the community are putting in.

Second, I want to highlight something I noticed in my own environment.

With this fix, tags and resource policies are now synced on every reconciliation, even when the secret value is unchanged. This means:

Tags specified in PushSecret metadata will be added/updated
Tags not specified in PushSecret metadata will be removed from AWS

Should this "source of truth" behavior be preserved (as it was the original design), or would it be better to change to an "additive-only" approach where ESO only adds/updates specified tags without removing unspecified ones?
If keeping the original behavior, should I add documentation for this as part of this PR?

Skarlso · 2026-03-10T14:00:09Z

No worries, sorry about the "lecture". These things trigger me badly... :D I apologies.

If keeping the original behavior, should I add documentation for this as part of this PR?

I would keep this for now, maybe tackle it in another PR perhaps. But the documentation would be appreciated, yes! 🙇 ✨

evs-secops · 2026-03-10T15:02:02Z

Everything is fine; I genuinely understand why you felt triggered :)

Document that ESO treats PushSecret as source of truth for tags and resource policies. Tags not specified in metadata.tags will be removed from AWS. Both tags and resource policies are synchronized on every reconciliation, even when the secret value hasn't changed. Signed-off-by: Evyatar Shtern <239746605+evs-secops@users.noreply.github.com>

sonarqubecloud · 2026-03-10T15:15:05Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Skarlso · 2026-03-10T20:06:42Z

/ok-to-test sha=d4d7e192008f821d2b5f0d500ceeb8639ac1fcbc

eso-service-account-app · 2026-03-10T20:25:59Z

[Bot] - ✅ e2e for d4d7e192008f821d2b5f0d500ceeb8639ac1fcbc passed

…ged (external-secrets#6025) Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>

…2.2.0 (#4923) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.1.0` → `v2.2.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](external-secrets/external-secrets#6091) #### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](external-secrets/external-secrets#6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](external-secrets/external-secrets#6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](external-secrets/external-secrets#5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](external-secrets/external-secrets#6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](external-secrets/external-secrets#6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](external-secrets/external-secrets#6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](external-secrets/external-secrets#5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](external-secrets/external-secrets#6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](external-secrets/external-secrets#6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](external-secrets/external-secrets#6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](external-secrets/external-secrets#6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](external-secrets/external-secrets#5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](external-secrets/external-secrets#5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4923 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.1.0` → `2.2.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`  ##### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](external-secrets/external-secrets#6091) ##### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](external-secrets/external-secrets#6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](external-secrets/external-secrets#6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](external-secrets/external-secrets#5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](external-secrets/external-secrets#6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](external-secrets/external-secrets#6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](external-secrets/external-secrets#6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](external-secrets/external-secrets#5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](external-secrets/external-secrets#6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](external-secrets/external-secrets#6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](external-secrets/external-secrets#6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](external-secrets/external-secrets#6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](external-secrets/external-secrets#5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](external-secrets/external-secrets#5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4927 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…ged (external-secrets#6025)

github-project-automation bot added this to External Secrets Mar 5, 2026

github-actions bot added the size/m label Mar 5, 2026

evs-secops force-pushed the fix/6024-tag-update-ignored branch from b9af3d6 to dceffde Compare March 5, 2026 16:27

coderabbitai bot reviewed Mar 5, 2026

View reviewed changes

evs-secops force-pushed the fix/6024-tag-update-ignored branch from dceffde to 91cd403 Compare March 5, 2026 16:54

coderabbitai bot reviewed Mar 5, 2026

View reviewed changes

github-actions bot added area/aws Indicates an issue or PR related to AWS. kind/bug Categorizes issue or PR as related to a bug. labels Mar 5, 2026

Skarlso approved these changes Mar 6, 2026

View reviewed changes

Skarlso requested changes Mar 6, 2026

View reviewed changes

coderabbitai bot reviewed Mar 8, 2026

View reviewed changes

providers/v1/aws/secretsmanager/secretsmanager_test.go Show resolved Hide resolved

evs-secops force-pushed the fix/6024-tag-update-ignored branch from 7d96b0b to 295a20a Compare March 8, 2026 10:25

github-actions bot added kind/documentation Categorizes issue or PR as related to documentation. kind/dependency dependabot and upgrades size/l labels Mar 8, 2026

evs-secops added 3 commits March 8, 2026 12:32

fix(test): correct PutSecretValue mock and assertion in resource poli…

abbaa5c

…cy test Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>

evs-secops force-pushed the fix/6024-tag-update-ignored branch from 295a20a to abbaa5c Compare March 8, 2026 10:32

evs-secops added 3 commits March 8, 2026 14:40

fix(test): use constant for fake-secret-key string

830d399

Signed-off-by: Evyatar Shtern <evyatar.shtern@gong.io>

Merge branch 'main' into fix/6024-tag-update-ignored

560265c

Merge branch 'main' into fix/6024-tag-update-ignored

5b7540a

evs-secops requested a review from Skarlso March 9, 2026 10:53

Merge branch 'main' into fix/6024-tag-update-ignored

b943d86

Skarlso approved these changes Mar 10, 2026

View reviewed changes

Skarlso merged commit 0e93b75 into external-secrets:main Mar 10, 2026
27 checks passed

github-project-automation bot moved this to Done in External Secrets Mar 10, 2026

coderabbitai bot mentioned this pull request Mar 17, 2026

fix: do not set tags if undefined #6103

Open

5 tasks

AlexOQ pushed a commit to AlexOQ/external-secrets that referenced this pull request Mar 18, 2026

fix(aws): sync tags and resource policy even when secret value unchan…

e94d285

…ged (external-secrets#6025) Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>

dsp0x4 pushed a commit to dsp0x4/external-secrets that referenced this pull request Mar 22, 2026

fix(aws): sync tags and resource policy even when secret value unchan…

846253d

…ged (external-secrets#6025)

This was referenced Mar 27, 2026

fix(aws): handle empty resource policy in PushSecret for SecretsManager #6145

Open

fix(aws): guard against empty resource policy in PushSecret #6162

Closed

Uh oh!

Conversation

evs-secops commented Mar 5, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

fix(aws): sync tags and resource policy even when secret value unchanged

Changes

Testing

Uh oh!

coderabbitai bot commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Possibly related PRs

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Skarlso commented Mar 6, 2026

Uh oh!

Skarlso commented Mar 6, 2026

Uh oh!

Skarlso commented Mar 6, 2026

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

eso-service-account-app bot commented Mar 6, 2026

Uh oh!

evs-secops commented Mar 8, 2026

Uh oh!

evs-secops commented Mar 8, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

evs-secops commented Mar 8, 2026

Uh oh!

evs-secops commented Mar 10, 2026

Uh oh!

Skarlso commented Mar 10, 2026

Uh oh!

evs-secops commented Mar 10, 2026

Uh oh!

Skarlso commented Mar 10, 2026

Uh oh!

evs-secops commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Mar 10, 2026

Quality Gate passed

Uh oh!

Skarlso commented Mar 10, 2026

Uh oh!

eso-service-account-app bot commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evs-secops commented Mar 5, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Mar 5, 2026 •

edited

Loading

evs-secops commented Mar 10, 2026 •

edited

Loading