Skip to content

fix: add validation constraints to ExternalSecretRewrite #5006

Merged
gusfcarvalho merged 2 commits intoexternal-secrets:mainfrom
Aakkash-Suresh:fix/rewrite-validation-constraint
Jul 21, 2025
Merged

fix: add validation constraints to ExternalSecretRewrite #5006
gusfcarvalho merged 2 commits intoexternal-secrets:mainfrom
Aakkash-Suresh:fix/rewrite-validation-constraint

Conversation

@Aakkash-Suresh
Copy link
Copy Markdown
Contributor

@Aakkash-Suresh Aakkash-Suresh commented Jul 7, 2025

Problem Statement

Adds minProperties=1 and maxProperties=1 validation to ExternalSecretRewrite to ensure exactly one rewrite method is specified.

Related Issue

#4995

Checklist

  • I have read the contribution guidelines
  • All commits are signed with git commit --signoff
  • My changes have reasonable test coverage
  • All tests pass with make test
  • I ensured my PR is ready for review with make reviewable

…ingle property selection

Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>
@Aakkash-Suresh Aakkash-Suresh force-pushed the fix/rewrite-validation-constraint branch from 2670e40 to bbdcab4 Compare July 7, 2025 15:28
@Aakkash-Suresh Aakkash-Suresh marked this pull request as ready for review July 7, 2025 15:33
@Aakkash-Suresh Aakkash-Suresh requested a review from a team as a code owner July 7, 2025 15:33
@Aakkash-Suresh Aakkash-Suresh requested a review from Skarlso July 7, 2025 15:33
@Aakkash-Suresh
Copy link
Copy Markdown
Contributor Author

@gusfcarvalho should this suffice?

@gusfcarvalho gusfcarvalho enabled auto-merge (squash) July 21, 2025 11:39
@gusfcarvalho gusfcarvalho merged commit 6f12eb9 into external-secrets:main Jul 21, 2025
1 check passed
@gusfcarvalho
Copy link
Copy Markdown
Member

thanks for your contribution @Aakkash-Suresh !

@sonarqubecloud
Copy link
Copy Markdown

varonix0 pushed a commit to x032205/external-secrets that referenced this pull request Jul 31, 2025
…ingle property selection (external-secrets#5006)

Signed-off-by: Aakkash-Suresh <i-aakkash.s@devrev.ai>
Signed-off-by: Daniel Hougaard <daniel@infisical.com>
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Aug 3, 2025
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `0.18.2` -> `0.19.0` |

---

### Release Notes

<details>
<summary>external-secrets/external-secrets (external-secrets)</summary>

### [`v0.19.0`](https://github.com/external-secrets/external-secrets/releases/tag/v0.19.0)

[Compare Source](external-secrets/external-secrets@v0.18.2...v0.19.0)

#### **BREAKING CHANGE**

🔴 🔴  BREAKING CHANGE 🔴 🔴

Please note that this a breaking change because our CRDs are now too big. Meaning a simple kubectl apply or Argo's default client side apply WILL NOT WORK! You have to add `--server-side` to kubectl apply and in argo add:

```yaml
spec:
  project: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true
    - ServerSideApply=true
```

for it to correctly install the CRDs. Thank you.

Image: `ghcr.io/external-secrets/external-secrets:v0.19.0`
Image: `ghcr.io/external-secrets/external-secrets:v0.19.0-ubi`
Image: `ghcr.io/external-secrets/external-secrets:v0.19.0-ubi-boringssl`

#### What's Changed

- chore: release helm chart for v0.18.2 by [@&#8203;Skarlso](https://github.com/Skarlso) in external-secrets/external-secrets#4985
- chore(deps): bump golang from `ee7ff13` to `10f549d` in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#4997
- chore(deps): bump golang from `68932fa` to `68932fa` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5000
- chore(deps): bump mkdocs-material from 9.6.14 to 9.6.15 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#4998
- chore(deps): bump anchore/sbom-action from 0.20.1 to 0.20.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5001
- chore(deps): bump github/codeql-action from 3.29.1 to 3.29.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5003
- chore(deps): bump aquasecurity/trivy-action from 0.31.0 to 0.32.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5002
- fix: do not turn original value into string on value scope by [@&#8203;Skarlso](https://github.com/Skarlso) in external-secrets/external-secrets#5011
- fix: add uuid in edit and view clusterroles by [@&#8203;sylvainOL](https://github.com/sylvainOL) in external-secrets/external-secrets#5017
- chore: update dependencies by [@&#8203;eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in external-secrets/external-secrets#4999
- fix: template data should not be the secret Data itself by [@&#8203;gusfcarvalho](https://github.com/gusfcarvalho) in external-secrets/external-secrets#5023
- Fix: Return appropriate error in ValidateStore by [@&#8203;prakash-218](https://github.com/prakash-218) in external-secrets/external-secrets#5019
- feat(helm): allow to set init containers by [@&#8203;rclsilver](https://github.com/rclsilver) in external-secrets/external-secrets#4745
- chore(deps): bump certifi from 2025.6.15 to 2025.7.14 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5032
- Fix: Remove root/buildinfo from ubi build files by [@&#8203;bainsy88](https://github.com/bainsy88) in external-secrets/external-secrets#5037
- chore(deps): bump ubi8/ubi from `19eae3d` to `c0b0729` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5033
- chore(deps): bump golang from 1.24.4-bookworm to 1.24.5-bookworm in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5029
- chore(deps): bump golang from 1.24.4 to 1.24.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5034
- chore: update dependencies by [@&#8203;eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in external-secrets/external-secrets#5031
- Add Red Hat OpenShift in Adopters by [@&#8203;KeenonLee](https://github.com/KeenonLee) in external-secrets/external-secrets#5039
- fix: remove authentication option with JWT token from STSSessionToken generator by [@&#8203;Skarlso](https://github.com/Skarlso) in external-secrets/external-secrets#5026
- fix: add validation constraints to ExternalSecretRewrite  by [@&#8203;Aakkash-Suresh](https://github.com/Aakkash-Suresh) in external-secrets/external-secrets#5006
- fix: stability support matrix by [@&#8203;gusfcarvalho](https://github.com/gusfcarvalho) in external-secrets/external-secrets#5043
- docs(decoding-strategy): clarify base64 auto-detection limitations by [@&#8203;orymate](https://github.com/orymate) in external-secrets/external-secrets#5004
- feat(infisical): auth methods by [@&#8203;DanielHougaard](https://github.com/DanielHougaard) in external-secrets/external-secrets#5040
- chore(deps): bump alpine from 3.22.0 to 3.22.1 in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5046
- chore(aws): parameterstore unit tests improvement by [@&#8203;ivankatliarchuk](https://github.com/ivankatliarchuk) in external-secrets/external-secrets#4986
- fix(helm): grafana dashboard: fix heatmaps to actually be heatmaps, not time series by [@&#8203;desaintmartin](https://github.com/desaintmartin) in external-secrets/external-secrets#5069
- chore(deps): bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5047
- chore(deps): bump step-security/harden-runner from 2.12.2 to 2.13.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5048
- chore(deps): bump golang from `ddf5200` to `daae04e` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5049
- chore(deps): bump alpine from `8a1f59f` to `4bcff63` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5051
- chore(deps): bump alpine from `8a1f59f` to `4bcff63` in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5052
- chore(deps): bump mkdocs-material from 9.6.15 to 9.6.16 in /hack/api-docs by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5077
- Add SelfSubjectAccessReview as a fallback for failing SelfSubjectRulesReview by [@&#8203;alvin-rw](https://github.com/alvin-rw) in external-secrets/external-secrets#5025
- chore(deps): bump golang from `69adc37` to `ef8c5c7` in /e2e by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5076
- chore(deps): bump ubi8/ubi from `c0b0729` to `785d38c` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5075
- chore(deps): bump github/codeql-action from 3.29.2 to 3.29.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5072
- chore(deps): bump anchore/sbom-action from 0.20.2 to 0.20.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in external-secrets/external-secrets#5073
- SSHKey generator by [@&#8203;dex4er](https://github.com/dex4er) in external-secrets/external-secrets#5083
- fix: restore AWS credential chain resolution for ECRAuthorizationToken generator by [@&#8203;aditmeno](https://github.com/aditmeno) in external-secrets/external-secrets#5082
- fix(helm): grafana dashboard: add widget for sum of not ready secrets by [@&#8203;desaintmartin](https://github.com/desaintmartin) in external-secrets/external-secrets#5086
- feat(aws): secretsmanager to update/patch/delete tags by [@&#8203;ivankatliarchuk](https://github.com/ivankatliarchuk) in external-secrets/external-secrets#4984
- fix: update the e2e test with the new store status value by [@&#8203;Skarlso](https://github.com/Skarlso) in external-secrets/external-secrets#5089
- fix: correct usage of if in dlc and update for server side apply by [@&#8203;Skarlso](https://github.com/Skarlso) in external-secrets/external-secrets#5092

#### New Contributors

- [@&#8203;sylvainOL](https://github.com/sylvainOL) made their first contribution in external-secrets/external-secrets#5017
- [@&#8203;prakash-218](https://github.com/prakash-218) made their first contribution in external-secrets/external-secrets#5019
- [@&#8203;rclsilver](https://github.com/rclsilver) made their first contribution in external-secrets/external-secrets#4745
- [@&#8203;bainsy88](https://github.com/bainsy88) made their first contribution in external-secrets/external-secrets#5037
- [@&#8203;KeenonLee](https://github.com/KeenonLee) made their first contribution in external-secrets/external-secrets#5039
- [@&#8203;orymate](https://github.com/orymate) made their first contribution in external-secrets/external-secrets#5004
- [@&#8203;desaintmartin](https://github.com/desaintmartin) made their first contribution in external-secrets/external-secrets#5069
- [@&#8203;alvin-rw](https://github.com/alvin-rw) made their first contribution in external-secrets/external-secrets#5025
- [@&#8203;dex4er](https://github.com/dex4er) made their first contribution in external-secrets/external-secrets#5083
- [@&#8203;aditmeno](https://github.com/aditmeno) made their first contribution in external-secrets/external-secrets#5082

**Full Changelog**: external-secrets/external-secrets@v0.18.2...v0.19.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImNoYXJ0Il19-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1114
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants