Skip to content

feat: Add Last Sync column to ExternalSecret and PushSecret printers#6068

Merged
Skarlso merged 6 commits intoexternal-secrets:mainfrom
jaruwat-panturat:feat/add-last-sync-printer
Mar 14, 2026
Merged

feat: Add Last Sync column to ExternalSecret and PushSecret printers#6068
Skarlso merged 6 commits intoexternal-secrets:mainfrom
jaruwat-panturat:feat/add-last-sync-printer

Conversation

@jaruwat-panturat
Copy link
Copy Markdown
Contributor

@jaruwat-panturat jaruwat-panturat commented Mar 12, 2026

Problem Statement

Cluster admins want to know when the last time a sync operation happened from running the kubectl get ps/es/etc.

Related Issue

Fixes: #6002

Proposed Changes

Add a Last Sync printer column to ExternalSecret and PushSecret that displays the value of status.refreshTime

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

  • charts
  • release
  • testing
  • security
  • templating

Checklist

  • I have read the contribution guidelines
  • All commits are signed with git commit --signoff
  • My changes have reasonable test coverage
  • All tests pass with make test
  • I ensured my PR is ready for review with make reviewable

Adds Last Sync printer column to ExternalSecret and PushSecret

This PR adds a "Last Sync" printer column to ExternalSecret and PushSecret resources that displays the value of status.refreshTime in kubectl output (e.g., kubectl get es/ps). The column is implemented as a kubebuilder additionalPrinterColumn with JSONPath .status.refreshTime and type date.

Changes

  • Added Last Sync printer column to API type annotations:
    • apis/externalsecrets/v1/externalsecret_types.go
    • apis/externalsecrets/v1beta1/externalsecret_types.go
    • apis/externalsecrets/v1alpha1/pushsecret_types.go
  • Updated generated CRD manifests and bundle:
    • config/crds/bases/external-secrets.io_externalsecrets.yaml
    • config/crds/bases/external-secrets.io_pushsecrets.yaml
    • deploy/crds/bundle.yaml
    • corresponding test snapshots updated

All changes are additive to CRD printer columns and do not modify controller logic, status structs, or exported APIs.

Notes / Review comments

  • A reviewer (Skarlso) objects to using a raw timestamp: they recommend the column show a duration (time since last sync) instead of the timestamp, consistent with other kubectl output patterns. Design decision on timestamp vs. elapsed-duration remains outstanding.
  • PR description checklist (contribution guidelines, signed commits, tests, CI) was included but not marked complete.

Jaruwat Panturat added 2 commits March 12, 2026 23:36
…olumns

Signed-off-by: Jaruwat Panturat <panturah@gmaill.com>
…olumns

Signed-off-by: Jaruwat Panturat <panturah@gmaill.com>
@github-actions github-actions bot added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 12, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 12, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 82c0b206-5106-4fb0-8c24-fd69935422f4

📥 Commits

Reviewing files that changed from the base of the PR and between 5cf285a and d10d255.

📒 Files selected for processing (3)
  • apis/externalsecrets/v1/externalsecret_types.go
  • apis/externalsecrets/v1alpha1/pushsecret_types.go
  • apis/externalsecrets/v1beta1/externalsecret_types.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • apis/externalsecrets/v1alpha1/pushsecret_types.go

Walkthrough

Adds a "Last Sync" printer column to multiple CustomResourceDefinitions (ExternalSecret, PushSecret, and cluster variants) exposing .status.refreshTime across v1, v1alpha1, and v1beta1 API versions; no runtime logic or status struct changes.

Changes

Cohort / File(s) Summary
Go type annotations
apis/externalsecrets/v1/externalsecret_types.go, apis/externalsecrets/v1alpha1/pushsecret_types.go, apis/externalsecrets/v1beta1/externalsecret_types.go
Added kubebuilder printcolumn annotation for "Last Sync" referencing .status.refreshTime (type=date) to resource type comments. No struct/signature changes.
CRD base manifests
config/crds/bases/external-secrets.io_externalsecrets.yaml, config/crds/bases/external-secrets.io_pushsecrets.yaml
Added additionalPrinterColumns entries for "Last Sync" with jsonPath: .status.refreshTime and type date in CRD schemas.
Deployed CRD bundle
deploy/crds/bundle.yaml
Inserted "Last Sync" additionalPrinterColumns entries (jsonPath: .status.refreshTime, type date) across multiple CRD definitions (ExternalSecret, PushSecret, cluster variants) in the bundled manifests.
🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning The PR adds a Last Sync column displaying status.refreshTime as a date, but issue #6002 requests a duration (time since last sync, e.g., '1m3s'). The implementation does not match the requested feature. Modify the implementation to display time elapsed since status.refreshTime (relative duration) rather than the raw date/time value to align with issue #6002 requirements.
✅ Passed checks (1 passed)
Check name Status Explanation
Out of Scope Changes check ✅ Passed All changes are directly related to adding a Last Sync printer column to ExternalSecret and PushSecret, which is within scope of issue #6002. No unrelated modifications were detected.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

jaruwat-panturat and others added 2 commits March 13, 2026 00:24
@jaruwat-panturat jaruwat-panturat marked this pull request as ready for review March 12, 2026 18:35
@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented Mar 13, 2026

Add a Last Sync printer column to ExternalSecret and PushSecret that displays the value of status.refreshTime

That's not correct. Last synced should be similar to Age. Meaning it should be duration that expired from the last time this object underwent a Sync event.

So this wouldn't be of type date either. It would of type duration.

@jaruwat-panturat
Copy link
Copy Markdown
Contributor Author

jaruwat-panturat commented Mar 13, 2026

Hello @Skarlso,

Please correct me if I'm wrong, but I believe the last sync column should display something like this after 150 seconds since the last sync:

NAME      AGE   STATUS   LAST SYNC
test-ps   19h   Synced   2m30s

Is this the expected behavior?

@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented Mar 13, 2026

@jaruwat-panturat Yes. And actually, I was wrong, because I can't read. :D I thought that's the interval time. 🤦

I'm sorry. Your change is right.

@sonarqubecloud
Copy link
Copy Markdown

@Skarlso
Copy link
Copy Markdown
Contributor

Skarlso commented Mar 14, 2026

/ok-to-test sha=19f6ed0791c58b2dafa204847dbf83de83d3c686

@eso-service-account-app
Copy link
Copy Markdown
Contributor

@Skarlso Skarlso merged commit 3834024 into external-secrets:main Mar 14, 2026
23 checks passed
AlexOQ pushed a commit to AlexOQ/external-secrets that referenced this pull request Mar 18, 2026
…xternal-secrets#6068)

Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Mar 20, 2026
…2.2.0 (#4923)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.1.0` → `v2.2.0` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information.

---

### Release Notes

<details>
<summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary>

### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0)

[Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0)

Image: `ghcr.io/external-secrets/external-secrets:v2.2.0`
Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`

<!-- Release notes generated using configuration in .github/release.yml at main -->

#### What's Changed

##### General

- chore: release charts v2.1.0 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6030](external-secrets/external-secrets#6030)
- chore: fix the stability doc by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6035](external-secrets/external-secrets#6035)
- fix(security): Fix vulnerabilities by [@&#8203;othomann](https://github.com/othomann) in [#&#8203;6052](external-secrets/external-secrets#6052)
- fix(aws): sync tags and resource policy even when secret value unchanged by [@&#8203;evs-secops](https://github.com/evs-secops) in [#&#8203;6025](external-secrets/external-secrets#6025)
- fix: publish now uses docker build v4 which required some changes by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6062](external-secrets/external-secrets#6062)
- feat(gcpsm): auto-detect projectID from GCP metadata server by [@&#8203;patjlm](https://github.com/patjlm) in [#&#8203;5922](external-secrets/external-secrets#5922)
- chore(templating): Remove years in license and their checks by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;5955](external-secrets/external-secrets#5955)
- docs: Add Roche to official ADOPTERS by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6076](external-secrets/external-secrets#6076)
- feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@&#8203;jaruwat-panturat](https://github.com/jaruwat-panturat) in [#&#8203;6068](external-secrets/external-secrets#6068)
- fix(onepassword): support native item IDs by [@&#8203;chadxz](https://github.com/chadxz) in [#&#8203;6073](external-secrets/external-secrets#6073)
- feat: extract LGTM processor to external JS file with tests by [@&#8203;mateenali66](https://github.com/mateenali66) in [#&#8203;6074](external-secrets/external-secrets#6074)
- feat: fail fast if LGTM label does not exist in repository by [@&#8203;mateenali66](https://github.com/mateenali66) in [#&#8203;6078](external-secrets/external-secrets#6078)
- feat(passbolt): add support for Passbolt V5 API by [@&#8203;cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#&#8203;5919](external-secrets/external-secrets#5919)
- fix(infisical): dataFrom.find.path should filter by secret path not name by [@&#8203;johnvox](https://github.com/johnvox) in [#&#8203;6086](external-secrets/external-secrets#6086)
- fix: disable the priority queue which misbehaves at scale by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6083](external-secrets/external-secrets#6083)
- chore: update go version to 1.26.1 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6072](external-secrets/external-secrets#6072)
- docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@&#8203;Br1an67](https://github.com/Br1an67) in [#&#8203;6056](external-secrets/external-secrets#6056)
- fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@&#8203;Br1an67](https://github.com/Br1an67) in [#&#8203;6036](external-secrets/external-secrets#6036)
- feat(templating): Add certSANs function to extract SANs from certificates by [@&#8203;mzdeb](https://github.com/mzdeb) in [#&#8203;6058](external-secrets/external-secrets#6058)
- docs: document template.metadata labels/annotations behavior by [@&#8203;lucpas](https://github.com/lucpas) in [#&#8203;6102](external-secrets/external-secrets#6102)
- fix: CODEOWNERS are seriously out of date by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6106](external-secrets/external-secrets#6106)
- feat(helm): add readinessProbe support for external-secrets deployment by [@&#8203;AlexOQ](https://github.com/AlexOQ) in [#&#8203;5831](external-secrets/external-secrets#5831)
- fix: update grpc for CVE-2026-33186 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6108](external-secrets/external-secrets#6108)
- feat(azurekv): add expiration time to azure kv secret by [@&#8203;muraliavarma](https://github.com/muraliavarma) in [#&#8203;5935](external-secrets/external-secrets#5935)
- feat: add path to cloud.ru provider by [@&#8203;heavyandrew](https://github.com/heavyandrew) in [#&#8203;5952](external-secrets/external-secrets#5952)
- fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@&#8203;riccardomc](https://github.com/riccardomc) in [#&#8203;6113](external-secrets/external-secrets#6113)

##### Dependencies

- chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6038](external-secrets/external-secrets#6038)
- chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6047](external-secrets/external-secrets#6047)
- chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6050](external-secrets/external-secrets#6050)
- chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6049](external-secrets/external-secrets#6049)
- chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6039](external-secrets/external-secrets#6039)
- chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6043](external-secrets/external-secrets#6043)
- chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6040](external-secrets/external-secrets#6040)
- chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6044](external-secrets/external-secrets#6044)
- chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6042](external-secrets/external-secrets#6042)
- chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6041](external-secrets/external-secrets#6041)
- chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6046](external-secrets/external-secrets#6046)
- chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6048](external-secrets/external-secrets#6048)
- chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6093](external-secrets/external-secrets#6093)
- chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6088](external-secrets/external-secrets#6088)
- chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6087](external-secrets/external-secrets#6087)
- chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6096](external-secrets/external-secrets#6096)
- chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6094](external-secrets/external-secrets#6094)
- chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6095](external-secrets/external-secrets#6095)
- chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6089](external-secrets/external-secrets#6089)
- chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6092](external-secrets/external-secrets#6092)
- chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6090](external-secrets/external-secrets#6090)
- chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6091](external-secrets/external-secrets#6091)

#### New Contributors

- [@&#8203;othomann](https://github.com/othomann) made their first contribution in [#&#8203;6052](external-secrets/external-secrets#6052)
- [@&#8203;evs-secops](https://github.com/evs-secops) made their first contribution in [#&#8203;6025](external-secrets/external-secrets#6025)
- [@&#8203;patjlm](https://github.com/patjlm) made their first contribution in [#&#8203;5922](external-secrets/external-secrets#5922)
- [@&#8203;jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#&#8203;6068](external-secrets/external-secrets#6068)
- [@&#8203;chadxz](https://github.com/chadxz) made their first contribution in [#&#8203;6073](external-secrets/external-secrets#6073)
- [@&#8203;mateenali66](https://github.com/mateenali66) made their first contribution in [#&#8203;6074](external-secrets/external-secrets#6074)
- [@&#8203;cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#&#8203;5919](external-secrets/external-secrets#5919)
- [@&#8203;johnvox](https://github.com/johnvox) made their first contribution in [#&#8203;6086](external-secrets/external-secrets#6086)
- [@&#8203;Br1an67](https://github.com/Br1an67) made their first contribution in [#&#8203;6056](external-secrets/external-secrets#6056)
- [@&#8203;mzdeb](https://github.com/mzdeb) made their first contribution in [#&#8203;6058](external-secrets/external-secrets#6058)
- [@&#8203;lucpas](https://github.com/lucpas) made their first contribution in [#&#8203;6102](external-secrets/external-secrets#6102)
- [@&#8203;AlexOQ](https://github.com/AlexOQ) made their first contribution in [#&#8203;5831](external-secrets/external-secrets#5831)
- [@&#8203;muraliavarma](https://github.com/muraliavarma) made their first contribution in [#&#8203;5935](external-secrets/external-secrets#5935)
- [@&#8203;heavyandrew](https://github.com/heavyandrew) made their first contribution in [#&#8203;5952](external-secrets/external-secrets#5952)

**Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4923
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Mar 20, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.1.0` → `2.2.0` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information.

---

### Release Notes

<details>
<summary>external-secrets/external-secrets (external-secrets)</summary>

### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0)

[Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0)

Image: `ghcr.io/external-secrets/external-secrets:v2.2.0`
Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`

<!-- Release notes generated using configuration in .github/release.yml at main -->

##### What's Changed

##### General

- chore: release charts v2.1.0 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6030](external-secrets/external-secrets#6030)
- chore: fix the stability doc by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6035](external-secrets/external-secrets#6035)
- fix(security): Fix vulnerabilities by [@&#8203;othomann](https://github.com/othomann) in [#&#8203;6052](external-secrets/external-secrets#6052)
- fix(aws): sync tags and resource policy even when secret value unchanged by [@&#8203;evs-secops](https://github.com/evs-secops) in [#&#8203;6025](external-secrets/external-secrets#6025)
- fix: publish now uses docker build v4 which required some changes by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6062](external-secrets/external-secrets#6062)
- feat(gcpsm): auto-detect projectID from GCP metadata server by [@&#8203;patjlm](https://github.com/patjlm) in [#&#8203;5922](external-secrets/external-secrets#5922)
- chore(templating): Remove years in license and their checks by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;5955](external-secrets/external-secrets#5955)
- docs: Add Roche to official ADOPTERS by [@&#8203;evrardj-roche](https://github.com/evrardj-roche) in [#&#8203;6076](external-secrets/external-secrets#6076)
- feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@&#8203;jaruwat-panturat](https://github.com/jaruwat-panturat) in [#&#8203;6068](external-secrets/external-secrets#6068)
- fix(onepassword): support native item IDs by [@&#8203;chadxz](https://github.com/chadxz) in [#&#8203;6073](external-secrets/external-secrets#6073)
- feat: extract LGTM processor to external JS file with tests by [@&#8203;mateenali66](https://github.com/mateenali66) in [#&#8203;6074](external-secrets/external-secrets#6074)
- feat: fail fast if LGTM label does not exist in repository by [@&#8203;mateenali66](https://github.com/mateenali66) in [#&#8203;6078](external-secrets/external-secrets#6078)
- feat(passbolt): add support for Passbolt V5 API by [@&#8203;cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#&#8203;5919](external-secrets/external-secrets#5919)
- fix(infisical): dataFrom.find.path should filter by secret path not name by [@&#8203;johnvox](https://github.com/johnvox) in [#&#8203;6086](external-secrets/external-secrets#6086)
- fix: disable the priority queue which misbehaves at scale by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6083](external-secrets/external-secrets#6083)
- chore: update go version to 1.26.1 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6072](external-secrets/external-secrets#6072)
- docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@&#8203;Br1an67](https://github.com/Br1an67) in [#&#8203;6056](external-secrets/external-secrets#6056)
- fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@&#8203;Br1an67](https://github.com/Br1an67) in [#&#8203;6036](external-secrets/external-secrets#6036)
- feat(templating): Add certSANs function to extract SANs from certificates by [@&#8203;mzdeb](https://github.com/mzdeb) in [#&#8203;6058](external-secrets/external-secrets#6058)
- docs: document template.metadata labels/annotations behavior by [@&#8203;lucpas](https://github.com/lucpas) in [#&#8203;6102](external-secrets/external-secrets#6102)
- fix: CODEOWNERS are seriously out of date by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6106](external-secrets/external-secrets#6106)
- feat(helm): add readinessProbe support for external-secrets deployment by [@&#8203;AlexOQ](https://github.com/AlexOQ) in [#&#8203;5831](external-secrets/external-secrets#5831)
- fix: update grpc for CVE-2026-33186 by [@&#8203;Skarlso](https://github.com/Skarlso) in [#&#8203;6108](external-secrets/external-secrets#6108)
- feat(azurekv): add expiration time to azure kv secret by [@&#8203;muraliavarma](https://github.com/muraliavarma) in [#&#8203;5935](external-secrets/external-secrets#5935)
- feat: add path to cloud.ru provider by [@&#8203;heavyandrew](https://github.com/heavyandrew) in [#&#8203;5952](external-secrets/external-secrets#5952)
- fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@&#8203;riccardomc](https://github.com/riccardomc) in [#&#8203;6113](external-secrets/external-secrets#6113)

##### Dependencies

- chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6038](external-secrets/external-secrets#6038)
- chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6047](external-secrets/external-secrets#6047)
- chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6050](external-secrets/external-secrets#6050)
- chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6049](external-secrets/external-secrets#6049)
- chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6039](external-secrets/external-secrets#6039)
- chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6043](external-secrets/external-secrets#6043)
- chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6040](external-secrets/external-secrets#6040)
- chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6044](external-secrets/external-secrets#6044)
- chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6042](external-secrets/external-secrets#6042)
- chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6041](external-secrets/external-secrets#6041)
- chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6046](external-secrets/external-secrets#6046)
- chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6048](external-secrets/external-secrets#6048)
- chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6093](external-secrets/external-secrets#6093)
- chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6088](external-secrets/external-secrets#6088)
- chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6087](external-secrets/external-secrets#6087)
- chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6096](external-secrets/external-secrets#6096)
- chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6094](external-secrets/external-secrets#6094)
- chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6095](external-secrets/external-secrets#6095)
- chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6089](external-secrets/external-secrets#6089)
- chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6092](external-secrets/external-secrets#6092)
- chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6090](external-secrets/external-secrets#6090)
- chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;6091](external-secrets/external-secrets#6091)

##### New Contributors

- [@&#8203;othomann](https://github.com/othomann) made their first contribution in [#&#8203;6052](external-secrets/external-secrets#6052)
- [@&#8203;evs-secops](https://github.com/evs-secops) made their first contribution in [#&#8203;6025](external-secrets/external-secrets#6025)
- [@&#8203;patjlm](https://github.com/patjlm) made their first contribution in [#&#8203;5922](external-secrets/external-secrets#5922)
- [@&#8203;jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#&#8203;6068](external-secrets/external-secrets#6068)
- [@&#8203;chadxz](https://github.com/chadxz) made their first contribution in [#&#8203;6073](external-secrets/external-secrets#6073)
- [@&#8203;mateenali66](https://github.com/mateenali66) made their first contribution in [#&#8203;6074](external-secrets/external-secrets#6074)
- [@&#8203;cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#&#8203;5919](external-secrets/external-secrets#5919)
- [@&#8203;johnvox](https://github.com/johnvox) made their first contribution in [#&#8203;6086](external-secrets/external-secrets#6086)
- [@&#8203;Br1an67](https://github.com/Br1an67) made their first contribution in [#&#8203;6056](external-secrets/external-secrets#6056)
- [@&#8203;mzdeb](https://github.com/mzdeb) made their first contribution in [#&#8203;6058](external-secrets/external-secrets#6058)
- [@&#8203;lucpas](https://github.com/lucpas) made their first contribution in [#&#8203;6102](external-secrets/external-secrets#6102)
- [@&#8203;AlexOQ](https://github.com/AlexOQ) made their first contribution in [#&#8203;5831](external-secrets/external-secrets#5831)
- [@&#8203;muraliavarma](https://github.com/muraliavarma) made their first contribution in [#&#8203;5935](external-secrets/external-secrets#5935)
- [@&#8203;heavyandrew](https://github.com/heavyandrew) made their first contribution in [#&#8203;5952](external-secrets/external-secrets#5952)

**Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhcnQiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4927
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
dsp0x4 pushed a commit to dsp0x4/external-secrets that referenced this pull request Mar 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/feature Categorizes issue or PR as related to a new feature. size/s

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Add last sync information to ES, PS, etc.

2 participants