chore: azure sdk update#5162
Merged
Skarlso merged 24 commits intoexternal-secrets:mainfrom Sep 8, 2025
Merged
Conversation
Signed-off-by: will haus <william.o.haus.civ@army.mil>
…5064) Signed-off-by: Martin Hrabovcin <martin.hrabovcin@nutanix.com> Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
…ets#5139) See, ``` codespell $(find . -type f -name '*.md') ``` Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
Signed-off-by: Anton Mu <34460584+muckelba@users.noreply.github.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
* feat: add liveness probe to eso controller Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * fixed the linter warning Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * fixed the helm schema generator as values and output was removed effectively Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * add named port and add a helm test for the new value Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com Signed-off-by: will haus <william.o.haus.civ@army.mil>
…5144) * fix(helm): add boolean to remove clusterGenerator Signed-off-by: DrummyFloyd <jonathan.monnet28@gmail.com> * style(helm): typo missing space Signed-off-by: DrummyFloyd <jonathan.monnet28@gmail.com> --------- Signed-off-by: DrummyFloyd <jonathan.monnet28@gmail.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
- Add Cisco.com to the ADOPTERS.md Signed-off-by: Sri Aradhyula <sraradhy@cisco.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
…ecrets#5087) Signed-off-by: Pat Riehecky <riehecky@fnal.gov> Co-authored-by: Gergely Brautigam <skarlso777@gmail.com> Signed-off-by: will haus <william.o.haus.civ@army.mil>
254b379 to
d771162
Compare
Contributor
Author
|
FIXED: I had the python version of yq instead of the go version, thanks to debian. Getting the following error when running the make commands: jq: Unknown option -p=json cursory look didn't make much sense to me, figured I'd comment in case yall have seen this before. |
added 2 commits
August 19, 2025 13:37
Signed-off-by: will haus <william.o.haus.civ@army.mil>
…l-secrets into azure-sdk-update
Member
|
/ok-to-test sha=6de7540d1a69f706ac0e2172dc1c2ba17bcd1914 |
Contributor
Skarlso
requested changes
Aug 20, 2025
Comment on lines
+136
to
+138
| secretsClient *azsecrets.Client | ||
| keysClient *azkeys.Client | ||
| certsClient *azcertificates.Client |
Contributor
There was a problem hiding this comment.
You didn't implement any switches in the DeleteSecret section. Meaning it will fail since the client is not initialized, right?
Contributor
Author
There was a problem hiding this comment.
This should be implemented with yesterdays work.
moolen
reviewed
Aug 20, 2025
Member
moolen
left a comment
There was a problem hiding this comment.
Thank you for having a shot at this, much appreciated!
One comment from my side:
From my understanding, using the new SDK is a breaking change, (at least looking at the migration guide. This is inevitable and it will need to happen at some point, because the old SDK isn't supported any more.
I'm fine having a switch in the secret store as newer versions of the operator need to be compatible with previous ones. I think we'll need to change the defaults with v2 of the secret store.
Before merging this i need to be sure that most of the functionality using the new sdk is covered in e2e tests. At a first glance, no existing test case seems to be breaking which is good 👍, but we need certainty that we don't break our users if they enable this feature. I suggest to add another set of tests in this file which modifies the secret stores and enables the new sdk. We have these functions that allow composition of test cases
Signed-off-by: will haus <william.o.haus.civ@army.mil>
Contributor
Author
|
I believe I've implemented most of Skarlso's requested changes. I'm working going to work on the test updates soon. I see the sonarqube issues, but they seem to be flagging the same level of layering that exists in some of the legacy functions. I assume implementing a helper func to handle the secret existence checks on the setters would alleviate the issues? I'll try to get the test updates to yall tomorrow. |
Signed-off-by: will haus <william.o.haus.civ@army.mil>
Contributor
Author
|
@Skarlso I know you wanted the sonarqube issues addressed, maybe you can help me understand them? Am I reading right that those functions have too many layers of loops/conditionals and its failing for cognitive load? The layers should match the old implementation, but looking at it I could do a helper func to move the secret checks out of each of those functions. Theoretically that could solve the issues. |
Contributor
|
@hauswio I'm fine if you leave most it but please refactor getAllSecretsWithNewSDK at the very least. :) For example checkTag and checkName could be small functions that return a boolean. And if false, continue. Or the entire internal for loop can be a function on its own. Other than that, I ignored the rest of the errors. |
Signed-off-by: will haus <william.o.haus.civ@army.mil>
Signed-off-by: william-o-haus-civ_S2VA <william.o.haus.civ@army.mil>
Contributor
Author
|
I rechecked my test code for creating the secretstore and doing the key test. The only difference between existing and new tests is setting the useAzureSDK bool on the secret store. Still authing to yalls keyvault with all the same values and pulling the same key ref. I don't know why the test is an issue now vs prior. |
Contributor
|
There is no prior. Your new test is failing. :) |
Contributor
Author
|
Sorry, what I meant is my new test is basically a copy of the existing test in azure_key.go. If you look at the diff on that file you'll see what I mean. Looking through it all again the only difference I can find is where I configure the secretstore with the feature flag. Thats why I'm confused about what the issue is. |
Contributor
|
Oh gotcha. Yeah I'm looking too, but I can't find what would cause this yet. There must be something else going on somewhere ugh. |
Contributor
|
Hm. Referent auth already adds a func referentAuthName(f *framework.Framework) string {
return "referent-auth-" + f.Namespace.Name
}And you do: tc.ExternalSecret.Spec.SecretStoreRef.Name = referentAuthName(tc.Framework) + "-new-sdk"Maybe try removing that dash because otherwise the secret name will be incorrect? |
Contributor
|
Maybe it's fine because you do also: Name: referentAuthName(s.framework) + "-new-sdk",So it should be the same weird |
Contributor
|
It's weird, because the EXPECTED secret is empty, not the fetched one :D |
Contributor
|
There might be a problem when creating the secret store maybe. There might be an authentication issue as well. The logs are difficult to gather. I need to check previous runs if the auth errors are there too. Maybe it's expected, unsure. |
Contributor
Author
I could commit a change removing the dash? I didn't catch that. |
Contributor
Author
Does that make sense? I didn't dig into the esv values pulled to make the expected secret. |
Contributor
Author
|
If it helps, I've been able to sync external secrets and push secrets with a key in my environment. So this seems to be more an issue with the test, CI, test environment. |
moolen
reviewed
Sep 5, 2025
| It("should sync keyvault objects with type=key using new SDK", func() { | ||
| ff(func(tc *framework.TestCase) { | ||
| secretKey := "azkv-key-new-sdk" | ||
| keyBytes, _ := json.Marshal(jwk) |
Member
There was a problem hiding this comment.
Member
There was a problem hiding this comment.
{
"kid": "https://eso-e2e-keyvault.vault.azure.net/keys/e2e-tests-eso-azure-keytype-qnrd7-keytest/ffb5cfae884d457186e44ca293a221f1",
"kty": "RSA",
"key_ops": ["encrypt","decrypt","sign","verify","wrapKey","unwrapKey"],
"n": "oiDBW7Urre8j_-nB0r2CazAOkZJxjscVpqH0OhpAoiK8vmDkcR298SN9aBSuI2z4LCSHKDNZ9vMkH7lKtNm1uo1uV2P0RzObKgF0iPZ2t0deIq-ULk4xTURImLG7NNKQ1uaK6a236tVONOLxvris89ZX_ZxVmtenMnCUoW-EbRriHhqB3XHPhu8HJIBZ9v2x88NYYT-ssNyrOphXIHR6JGpcy0ynjvdsJXpiHDTd0Fn9C2gXueTHFZHm6G9pafmKTeLqI4c-OMbcU6u6-6HeFgYmhfWg66QFTWJxkl7vEkWujUciwUoRYgGYW1d_UjU4InmFuEtBGAMmTV-WbtTcbQ",
"e": "AQAB"
}
vs.
{
"e": "AQAB",
"key_ops": ["encrypt","decrypt","sign","verify","wrapKey","unwrapKey"],
"kid": "https://eso-e2e-keyvault.vault.azure.net/keys/e2e-tests-eso-azure-keytype-qnrd7-keytest/ffb5cfae884d457186e44ca293a221f1",
"kty": "RSA",
"n": "oiDBW7Urre8j_-nB0r2CazAOkZJxjscVpqH0OhpAoiK8vmDkcR298SN9aBSuI2z4LCSHKDNZ9vMkH7lKtNm1uo1uV2P0RzObKgF0iPZ2t0deIq-ULk4xTURImLG7NNKQ1uaK6a236tVONOLxvris89ZX_ZxVmtenMnCUoW-EbRriHhqB3XHPhu8HJIBZ9v2x88NYYT-ssNyrOphXIHR6JGpcy0ynjvdsJXpiHDTd0Fn9C2gXueTHFZHm6G9pafmKTeLqI4c-OMbcU6u6-6HeFgYmhfWg66QFTWJxkl7vEkWujUciwUoRYgGYW1d_UjU4InmFuEtBGAMmTV-WbtTcbQ"
}
Contributor
There was a problem hiding this comment.
But the compare where it fails, essentially marshals this into an actual object and THEN compares them. It doesn't seem like that would care about the ordering. It's not a byte compare. 🤔
Member
There was a problem hiding this comment.
the e2e tests compare the Kind=Secret .data (here).
Where is it marshaled into an object and then compared?
Contributor
There was a problem hiding this comment.
Goddamn it I was LOOKING at that. How the hell didn't I see it?!?!
Contributor
There was a problem hiding this comment.
Okay, but that's fine. We should marshal it into map[string]interface and then do a deep equal?
Member
There was a problem hiding this comment.
In the using new SDK test i'd marshal/unmarshal into the new type and pass that to the expectedSecret. At least temporarily. The e2e provider implementation should be rewritten once we remove the old sdk - and then this workaround becomes obsolete. From what it looks like the new sdk implementation seems to be fully compatible 🎉 well done @hauswio
Contributor
There was a problem hiding this comment.
@hauswio Do you understand how to update the test? :)
Contributor
Author
There was a problem hiding this comment.
@Skarlso I think so. Let me know if the update matches yalls expectation.
Contributor
There was a problem hiding this comment.
Yah, I think that matches. Let's see if it passes.
Signed-off-by: hauswio <william.o.haus.civ@army.mil>
Contributor
|
/ok-to-test sha=1a02d9149f8c4c2cf6cdeb16a1d76cbdf57a600b |
1 similar comment
Contributor
|
/ok-to-test sha=1a02d9149f8c4c2cf6cdeb16a1d76cbdf57a600b |
Contributor
|
Hmmm, oh-o... The e2e test is failing to launch. 🤔 Let's hope it's just a hiccup. I'll try again in half an hour. |
Contributor
|
Ah it's because of check diff. |
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
Contributor
|
/ok-to-test sha=edff033338dcb1261bfa86c90d58d41939572502 |
Contributor
|
The runner is not working. I initiated a revert for the token update on the flow #5269. |
|
Contributor
|
/ok-to-test sha=b14ebdfd5bf6737af1034616d4bab342ad38989e |
Contributor
Contributor
|
Thank you so much for this excellent work! Lovely! |
Skarlso
approved these changes
Sep 8, 2025
alexlebens
pushed a commit
to alexlebens/infrastructure
that referenced
this pull request
Sep 23, 2025
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `0.19.2` -> `0.20.1` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v0.20.1`](https://github.com/external-secrets/external-secrets/releases/tag/v0.20.1) [Compare Source](external-secrets/external-secrets@v0.19.2...v0.20.1) Image: `ghcr.io/external-secrets/external-secrets:v0.20.1` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl` <!-- Release notes generated using configuration in .github/release.yml at main --> #### What's Changed ##### General - chore: release 0.19.2 by [@​moolen](https://github.com/moolen) in [#​5136](external-secrets/external-secrets#5136) - chore: update readme by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5137](external-secrets/external-secrets#5137) - fix(kubernetes): make auth field optional by [@​mhrabovcin](https://github.com/mhrabovcin) in [#​5064](external-secrets/external-secrets#5064) - chore: Fix Markdown spelling issues found by codespell by [@​mjtrangoni](https://github.com/mjtrangoni) in [#​5139](external-secrets/external-secrets#5139) - Fix yaml codeblock for oracle-vault provider docs by [@​muckelba](https://github.com/muckelba) in [#​5146](external-secrets/external-secrets#5146) - feat: add liveness probe to eso controller by [@​Skarlso](https://github.com/Skarlso) in [#​4930](external-secrets/external-secrets#4930) - fix(helm): add boolean for processClusterGenerator by [@​DrummyFloyd](https://github.com/DrummyFloyd) in [#​5144](external-secrets/external-secrets#5144) - chore: add Cisco to ADOPTERS.md by [@​sriaradhyula](https://github.com/sriaradhyula) in [#​5159](external-secrets/external-secrets#5159) - docs: Fix provider stability and support table by [@​jonstacks](https://github.com/jonstacks) in [#​5161](external-secrets/external-secrets#5161) - feat(helm): Add control of response to missing prometheus CRDs by [@​jcpunk](https://github.com/jcpunk) in [#​5087](external-secrets/external-secrets#5087) - chore: Added release notes configuration by [@​bonddim](https://github.com/bonddim) in [#​5148](external-secrets/external-secrets#5148) - chore: bump bitwarden helm chart version by [@​Skarlso](https://github.com/Skarlso) in [#​5044](external-secrets/external-secrets#5044) - chore(docs): update `ADOPTERS.md` to include SAP by [@​jakobmoellerdev](https://github.com/jakobmoellerdev) in [#​5165](external-secrets/external-secrets#5165) - feat: add externalsecret namespace for webhook provider by [@​matheusmazzoni](https://github.com/matheusmazzoni) in [#​5155](external-secrets/external-secrets#5155) - fix: add unknown status for secret store by [@​alvin-rw](https://github.com/alvin-rw) in [#​5070](external-secrets/external-secrets#5070) - Fix pushing to an AWS Secrets Manager Secret when there are no secret values by [@​nirajsapkota](https://github.com/nirajsapkota) in [#​4878](external-secrets/external-secrets#4878) - add extralabels for dashboard to be scraped by multiple grafana instances by [@​L1ghtman2k](https://github.com/L1ghtman2k) in [#​5138](external-secrets/external-secrets#5138) - fix: the api docs are not referencing sshkey generator by [@​Skarlso](https://github.com/Skarlso) in [#​5170](external-secrets/external-secrets#5170) - Update github.md by [@​gecube](https://github.com/gecube) in [#​5171](external-secrets/external-secrets#5171) - Update anchore-engine-credentials.md by [@​gecube](https://github.com/gecube) in [#​5172](external-secrets/external-secrets#5172) - docs: update infisical docs to clarify missing system:auth-delegator need by [@​Skarlso](https://github.com/Skarlso) in [#​5174](external-secrets/external-secrets#5174) - Adding support different type auth sources by [@​preved911](https://github.com/preved911) in [#​4877](external-secrets/external-secrets#4877) - fix: stability update document did not update the stability table correctly by [@​Skarlso](https://github.com/Skarlso) in [#​5176](external-secrets/external-secrets#5176) - Add esv1.AnnotationForceSync for CES and ES by [@​ntnn](https://github.com/ntnn) in [#​5156](external-secrets/external-secrets#5156) - fix: helm build failing by [@​Skarlso](https://github.com/Skarlso) in [#​5178](external-secrets/external-secrets#5178) - fix: remove release- branch automation by [@​moolen](https://github.com/moolen) in [#​5182](external-secrets/external-secrets#5182) - chore: update dependencies by [@​eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#​5181](external-secrets/external-secrets#5181) - docs: update bitwarden documentation for dataFrom field usage by [@​Skarlso](https://github.com/Skarlso) in [#​5196](external-secrets/external-secrets#5196) - feat: add contributor ladder by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5150](external-secrets/external-secrets#5150) - feat: support vault provider check and set for push secrets by [@​webstradev](https://github.com/webstradev) in [#​5197](external-secrets/external-secrets#5197) - chore(docs): update helm charts by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5203](external-secrets/external-secrets#5203) - chore(ci): fix sonarqube security warnings in helm.yml by [@​webstradev](https://github.com/webstradev) in [#​5202](external-secrets/external-secrets#5202) - chore: add pull request maintenance auto labelling and sizes by [@​Skarlso](https://github.com/Skarlso) in [#​5200](external-secrets/external-secrets#5200) - fix: update the label verification step by [@​Skarlso](https://github.com/Skarlso) in [#​5209](external-secrets/external-secrets#5209) - feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by [@​tuxtof](https://github.com/tuxtof) in [#​5168](external-secrets/external-secrets#5168) - feat: improve error message for json marshalling/unmarshalling by [@​webstradev](https://github.com/webstradev) in [#​5211](external-secrets/external-secrets#5211) - chore: enhance `helm-values-schema-json` schema plugin management logic by [@​jakobmoellerdev](https://github.com/jakobmoellerdev) in [#​5212](external-secrets/external-secrets#5212) - fix(aws): stop incrementing the UUID for versions by [@​Skarlso](https://github.com/Skarlso) in [#​5175](external-secrets/external-secrets#5175) - feat: enable secure serving for metrics \[issue 4614] by [@​rkferreira](https://github.com/rkferreira) in [#​5169](external-secrets/external-secrets#5169) - fix(infisical): fix TokenAuth auth method by escaping the token revocation by [@​arthlr](https://github.com/arthlr) in [#​5217](external-secrets/external-secrets#5217) - fix: tilt build was failing to rebuild by [@​Skarlso](https://github.com/Skarlso) in [#​5225](external-secrets/external-secrets#5225) - feat: add selectable fields to the CRDs by [@​Skarlso](https://github.com/Skarlso) in [#​5226](external-secrets/external-secrets#5226) - ref: removing Yandex Cloud specific common types declaration duplication by [@​preved911](https://github.com/preved911) in [#​4905](external-secrets/external-secrets#4905) - fix: missing codeowners file from .github folder by [@​Skarlso](https://github.com/Skarlso) in [#​5228](external-secrets/external-secrets#5228) - feat: add setting remote namespace to metadata for kubernetes provider by [@​Skarlso](https://github.com/Skarlso) in [#​5224](external-secrets/external-secrets#5224) - feat: add support for certs only in pkcs12 by [@​devnopt](https://github.com/devnopt) in [#​4875](external-secrets/external-secrets#4875) - docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by [@​ionicsolutions](https://github.com/ionicsolutions) in [#​5208](external-secrets/external-secrets#5208) - feat: Allow adding finalizers from template by [@​malovme](https://github.com/malovme) in [#​5140](external-secrets/external-secrets#5140) - fix: controller-runtime update by [@​gusfcarvalho](https://github.com/gusfcarvalho) in [#​5239](external-secrets/external-secrets#5239) - chore: update dependencies by [@​eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#​5229](external-secrets/external-secrets#5229) - fix: Prevent secretstore reconcile loop when provider error response is dynamic by [@​dakotaharden](https://github.com/dakotaharden) in [#​5247](external-secrets/external-secrets#5247) - feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by [@​matheusmazzoni](https://github.com/matheusmazzoni) in [#​5163](external-secrets/external-secrets#5163) - fix: keepersecurity support for shortcuts by [@​pepordev](https://github.com/pepordev) in [#​5245](external-secrets/external-secrets#5245) - feat: add support for GCP Workload Identity Federation by [@​bharath-b-rh](https://github.com/bharath-b-rh) in [#​4654](external-secrets/external-secrets#4654) - feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by [@​alliseeisgold](https://github.com/alliseeisgold) in [#​5022](external-secrets/external-secrets#5022) - chore(charts): Adds new make target for installing unittest plugin by [@​bharath-b-rh](https://github.com/bharath-b-rh) in [#​5250](external-secrets/external-secrets#5250) - docs(templating): added clarifying comments to Github generator example by [@​nielstenboom](https://github.com/nielstenboom) in [#​5248](external-secrets/external-secrets#5248) - feat(release): add new workflow to label first time contributor issues by [@​mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#​5243](external-secrets/external-secrets#5243) - feat(security): Adds an option to make HTTP2 configurable by [@​siddhibhor-56](https://github.com/siddhibhor-56) in [#​5231](external-secrets/external-secrets#5231) - feat: add retry for onepassword on authorization error by [@​Skarlso](https://github.com/Skarlso) in [#​5253](external-secrets/external-secrets#5253) - fix: handle namespace deletion race conditions with finalizers by [@​framsouza](https://github.com/framsouza) in [#​5154](external-secrets/external-secrets#5154) - docs: update stability and support by [@​anders-swanson](https://github.com/anders-swanson) in [#​5257](external-secrets/external-secrets#5257) - fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by [@​kgal-akl](https://github.com/kgal-akl) in [#​5263](external-secrets/external-secrets#5263) - feat: support Pod Identity authentication for Vault Provider by [@​webstradev](https://github.com/webstradev) in [#​5201](external-secrets/external-secrets#5201) - feat: add domain field to secretserver provider by [@​rkferreira](https://github.com/rkferreira) in [#​5258](external-secrets/external-secrets#5258) - chore(release): Migrate to actions/create-github-app-token action by [@​mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#​5264](external-secrets/external-secrets#5264) - chore: just updating the crd conformance tests by [@​Skarlso](https://github.com/Skarlso) in [#​5265](external-secrets/external-secrets#5265) - chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by [@​Skarlso](https://github.com/Skarlso) in [#​5269](external-secrets/external-secrets#5269) - chore: azure sdk update by [@​hauswio](https://github.com/hauswio) in [#​5162](external-secrets/external-secrets#5162) - feat: add support for fetching Secret by Path on Delinea Secret Server provider by [@​DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#​5270](external-secrets/external-secrets#5270) - feat: migrate from tibdex to actions/create-github-app-token by [@​rkferreira](https://github.com/rkferreira) in [#​5286](external-secrets/external-secrets#5286) - fix: license headers across all Go files - standardize format, add missing copyright, fix typos by [@​Copilot](https://github.com/Copilot) in [#​5288](external-secrets/external-secrets#5288) - fix: the boilerplate was missing the right license format by [@​Skarlso](https://github.com/Skarlso) in [#​5289](external-secrets/external-secrets#5289) - chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by [@​Copilot](https://github.com/Copilot) in [#​5290](external-secrets/external-secrets#5290) - chore(docs): remove GitHub Discussions references and update support channels by [@​jakobmoellerdev](https://github.com/jakobmoellerdev) in [#​5292](external-secrets/external-secrets#5292) - docs: updated the ladder with two new tracks: documentation and community by [@​Skarlso](https://github.com/Skarlso) in [#​5298](external-secrets/external-secrets#5298) - docs(release): create upgrading section by [@​rkferreira](https://github.com/rkferreira) in [#​5310](external-secrets/external-secrets#5310) - docs: readme update for health of the project by [@​Skarlso](https://github.com/Skarlso) in [#​5309](external-secrets/external-secrets#5309) - fix: validate namespace in secretRef by [@​moolen](https://github.com/moolen) in [#​5311](external-secrets/external-secrets#5311) - docs: add burnout prevention strategies and mitigation policy document by [@​Skarlso](https://github.com/Skarlso) in [#​5307](external-secrets/external-secrets#5307) - feat: add missing go sbom by [@​moolen](https://github.com/moolen) in [#​5313](external-secrets/external-secrets#5313) - feat: make vault e2e tests run locally by [@​moolen](https://github.com/moolen) in [#​5246](external-secrets/external-secrets#5246) - chore: update dependencies by [@​eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#​5324](external-secrets/external-secrets#5324) - feat: add Cloudsmith generator for container registry authentication by [@​cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) in [#​5267](external-secrets/external-secrets#5267) - feat: Add lgtm review automation step to ci workflows. by [@​webstradev](https://github.com/webstradev) in [#​5251](external-secrets/external-secrets#5251) - feat(provider): add Volcengine provider support by [@​kevinyancn](https://github.com/kevinyancn) in [#​5306](external-secrets/external-secrets#5306) - test: add more information to potentially flaky test by [@​Skarlso](https://github.com/Skarlso) in [#​5330](external-secrets/external-secrets#5330) - fix(docs): Fix typo in controller options doc by [@​tspearconquest](https://github.com/tspearconquest) in [#​5299](external-secrets/external-secrets#5299) - chore(testing): Add licence.check make target by [@​jonstacks](https://github.com/jonstacks) in [#​5335](external-secrets/external-secrets#5335) - docs(gitlab-variables): document environment scope fallback by [@​s1nyx](https://github.com/s1nyx) in [#​5300](external-secrets/external-secrets#5300) ##### Dependencies - chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5190](external-secrets/external-secrets#5190) - chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5191](external-secrets/external-secrets#5191) - chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5189](external-secrets/external-secrets#5189) - chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5188](external-secrets/external-secrets#5188) - chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5187](external-secrets/external-secrets#5187) - chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5186](external-secrets/external-secrets#5186) - chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5184](external-secrets/external-secrets#5184) - chore(deps): bump golang from 1.24.6 to 1.25.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5194](external-secrets/external-secrets#5194) - chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5195](external-secrets/external-secrets#5195) - chore(deps): bump ubi8/ubi from `4f0a4e4` to `7010e70` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5193](external-secrets/external-secrets#5193) - chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5192](external-secrets/external-secrets#5192) - chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5198](external-secrets/external-secrets#5198) - chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5199](external-secrets/external-secrets#5199) - chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5234](external-secrets/external-secrets#5234) - chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5236](external-secrets/external-secrets#5236) - chore(deps): bump ubi8/ubi from `7010e70` to `534c2c0` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5237](external-secrets/external-secrets#5237) - chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5238](external-secrets/external-secrets#5238) - chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5242](external-secrets/external-secrets#5242) - chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5241](external-secrets/external-secrets#5241) - chore(deps): bump distroless/static from `2e114d2` to `f2ff10a` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5240](external-secrets/external-secrets#5240) - chore(deps): bump golang from 1.25.0 to 1.25.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5275](external-secrets/external-secrets#5275) - chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5274](external-secrets/external-secrets#5274) - chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5273](external-secrets/external-secrets#5273) - chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5276](external-secrets/external-secrets#5276) - chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5279](external-secrets/external-secrets#5279) - chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5278](external-secrets/external-secrets#5278) - chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5277](external-secrets/external-secrets#5277) - chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5281](external-secrets/external-secrets#5281) - chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5280](external-secrets/external-secrets#5280) - chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5282](external-secrets/external-secrets#5282) - chore(deps): bump golang from `b6ed3fd` to `b6ed3fd` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5318](external-secrets/external-secrets#5318) - chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5317](external-secrets/external-secrets#5317) - chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5319](external-secrets/external-secrets#5319) - chore(deps): bump distroless/static from `f2ff10a` to `87bce11` by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5320](external-secrets/external-secrets#5320) - chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5323](external-secrets/external-secrets#5323) - chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5321](external-secrets/external-secrets#5321) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5322](external-secrets/external-secrets#5322) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5339](external-secrets/external-secrets#5339) - chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5344](external-secrets/external-secrets#5344) - chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5345](external-secrets/external-secrets#5345) - chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5343](external-secrets/external-secrets#5343) - chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5340](external-secrets/external-secrets#5340) - chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5341](external-secrets/external-secrets#5341) - chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5346](external-secrets/external-secrets#5346) - chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​5342](external-secrets/external-secrets#5342) #### New Contributors - [@​mjtrangoni](https://github.com/mjtrangoni) made their first contribution in [#​5139](external-secrets/external-secrets#5139) - [@​muckelba](https://github.com/muckelba) made their first contribution in [#​5146](external-secrets/external-secrets#5146) - [@​DrummyFloyd](https://github.com/DrummyFloyd) made their first contribution in [#​5144](external-secrets/external-secrets#5144) - [@​sriaradhyula](https://github.com/sriaradhyula) made their first contribution in [#​5159](external-secrets/external-secrets#5159) - [@​jonstacks](https://github.com/jonstacks) made their first contribution in [#​5161](external-secrets/external-secrets#5161) - [@​matheusmazzoni](https://github.com/matheusmazzoni) made their first contribution in [#​5155](external-secrets/external-secrets#5155) - [@​nirajsapkota](https://github.com/nirajsapkota) made their first contribution in [#​4878](external-secrets/external-secrets#4878) - [@​L1ghtman2k](https://github.com/L1ghtman2k) made their first contribution in [#​5138](external-secrets/external-secrets#5138) - [@​gecube](https://github.com/gecube) made their first contribution in [#​5171](external-secrets/external-secrets#5171) - [@​preved911](https://github.com/preved911) made their first contribution in [#​4877](external-secrets/external-secrets#4877) - [@​ntnn](https://github.com/ntnn) made their first contribution in [#​5156](external-secrets/external-secrets#5156) - [@​webstradev](https://github.com/webstradev) made their first contribution in [#​5197](external-secrets/external-secrets#5197) - [@​rkferreira](https://github.com/rkferreira) made their first contribution in [#​5169](external-secrets/external-secrets#5169) - [@​arthlr](https://github.com/arthlr) made their first contribution in [#​5217](external-secrets/external-secrets#5217) - [@​devnopt](https://github.com/devnopt) made their first contribution in [#​4875](external-secrets/external-secrets#4875) - [@​dakotaharden](https://github.com/dakotaharden) made their first contribution in [#​5247](external-secrets/external-secrets#5247) - [@​bharath-b-rh](https://github.com/bharath-b-rh) made their first contribution in [#​4654](external-secrets/external-secrets#4654) - [@​alliseeisgold](https://github.com/alliseeisgold) made their first contribution in [#​5022](external-secrets/external-secrets#5022) - [@​nielstenboom](https://github.com/nielstenboom) made their first contribution in [#​5248](external-secrets/external-secrets#5248) - [@​siddhibhor-56](https://github.com/siddhibhor-56) made their first contribution in [#​5231](external-secrets/external-secrets#5231) - [@​framsouza](https://github.com/framsouza) made their first contribution in [#​5154](external-secrets/external-secrets#5154) - [@​kgal-akl](https://github.com/kgal-akl) made their first contribution in [#​5263](external-secrets/external-secrets#5263) - [@​hauswio](https://github.com/hauswio) made their first contribution in [#​5162](external-secrets/external-secrets#5162) - [@​Copilot](https://github.com/Copilot) made their first contribution in [#​5288](external-secrets/external-secrets#5288) - [@​cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) made their first contribution in [#​5267](external-secrets/external-secrets#5267) - [@​kevinyancn](https://github.com/kevinyancn) made their first contribution in [#​5306](external-secrets/external-secrets#5306) - [@​s1nyx](https://github.com/s1nyx) made their first contribution in [#​5300](external-secrets/external-secrets#5300) **Full Changelog**: <external-secrets/external-secrets@v0.19.2...v0.20.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xMTYuNiIsInVwZGF0ZWRJblZlciI6IjQxLjExNi42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFydCJdfQ==--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1555 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem Statement
Azure sdk update and custom cloud support
Related Issue
Fixes #5151
Proposed Changes
and Key Vault specific packages
Both SDK implementations support all Key Vault operations:
filtering
metadata
All three authentication methods work with both SDKs:
auth
exchange
Both implementations support all Azure environments:
The new SDK supports custom endpoint via the AzureStackCloud environment
Migration Path for Users
Current Users (No Action Required)
Opt-in to New SDK
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
name: azure-keyvault
spec:
provider:
azurekv:
vaultUrl: "https://my-vault.vault.azure.net/"
useAzureSDK: true # Enable new SDK
authType: ServicePrincipal
# ... rest of configuration
Architecture:
Checklist
git commit --signoffmake testmake reviewable