feat(helm): update chart external-secrets ( 2.7.0 ➔ 2.8.0 ) by renovate[bot] · Pull Request #3263 · anthr76/infra

renovate · 2026-07-18T21:50:29Z

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	`2.7.0` → `2.8.0`

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.8.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

chore: release helm chart 2.7.0 by @Skarlso in #6529
docs(barbican): correct find semantics and document property/extract by @alekc in #6531
docs(gcp): use external-secrets.io/v1 in SecretStore examples by @alekc in #6563
feat(generators): add GitLab deploy token generator by @alekc in #6493
fix(barbican): validate store config and fix SecretExists error message by @alekc in #6534
docs(beyondtrust): fix capability matrix and document decrypt/separator by @alekc in #6535
feat: Make SecondsToLive optional for Grafana generator by @jaruwat-panturat in #6479
docs: add missing generators to ClusterGenerator spec snippet by @jaruwat-panturat in #6590
docs(doppler): fix download format list and heading levels by @alekc in #6559
docs(fortanix): add to support matrix and tidy provider page by @alekc in #6562
docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @alekc in #6585
docs(volcengine): mark referent authentication as supported by @alekc in #6584
docs(senhasegura): mark deletion + referent in matrix and fix title by @alekc in #6583
docs(scaleway): mark referent auth in matrix and fix headings by @alekc in #6581
docs(pulumi): correct find/referent matrix cells and fix headings by @alekc in #6578
docs(previder): correct find/referent matrix cells and fix headings by @alekc in #6577
docs(1password): mark SDK find support in matrix and promote titles by @alekc in #6568
feat(charts): Add aggregateToAdmin toggle by @illrill in #6586
docs(providers): consolidate 11 conflicting provider-doc PRs by @alekc in #6592
feat(charts): add startupProbe support to webhook deployment by @alpcanaydin in #6612
feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @baraka-akeyless in #6530
docs(kubernetes): fix invalid tab indentation and heading levels by @alekc in #6565
docs(dvls): mark DeletionPolicy supported and fix page title by @alekc in #6557
docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @alekc in #6551
docs(github): add to support matrix, fix auth field, tidy page by @alekc in #6564
docs: Improve explanations of pem_chain by @evrardjp in #6623
feat: Make our stance regarding AI usage more explicit. by @evrardj-roche in #6621
fix(barbican): treat find.name.regexp as a regexp, not an exact match by @arpitjain099 in #6614
chore: update go version 1.26.5 - Fix CVE-2026-39822 by @alekc in #6631
ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @alekc in #6634
chore: updating ok-to-test to allow interim maintainers by @gusfcarvalho in #6638
fix(onepassword): support PushSecret IfNotExists by @civilizedBaboon in #6646
fix(testing): check out PR head in fork e2e instead of main by @alekc in #6647
fix(secretserver): validate store and map fields correctly by @dbinger in #6616
feat(charts): Add optional networkPolicy by @jcpunk in #5779
feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @baraka-akeyless in #6507
feat(provider): implement AWS Certificate Manager provider by @dsp0x4 in #6117
feat: expose more values for custom metadata for vault v2 by @Skarlso in #6652
clean: Remove duplicate code by @evrardj-roche in #6629
feat: configurable leader election lease timings by @izz-linux in #6644
fix(akeyless): support dataFrom.extract.property for nested JSON by @baraka-akeyless in #6633
feat(conjur): Certificate Auth support by @hdabrowski in #6393
docs(aws): restore dropped access section and document missing fields by @alekc in #6517
feat(secretserver): support authentication via access token by @sumanpal97 in #6597
docs(secretserver): document authentication, key formats, property behavior, and limitations by @dbinger in #6619
feat(release): Support reading values from kubernetes CRD by @alekc in #6211
clean: Standardize and friendly name for validations policies by @evrardj-roche in #6630
feat: add CreateOrMerge creation policy for ExternalSecrets by @alekc in #6641
feat(core): accept duration string for SecretStore refreshInterval by @alekc in #6594
fix(beyondtrust): validate store without panicking on API key auth by @emmayusufu in #6553
fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @Ashutosh-3601 in #6421

Dependencies

chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in #6538
chore(deps): bump ubi9/ubi from 1b99266 to 37a1589 by @dependabot[bot] in #6537
chore(deps): bump golang from 5f68ec6 to b305420 in /e2e by @dependabot[bot] in #6539
chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #6540
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @dependabot[bot] in #6542
chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in #6543
chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @dependabot[bot] in #6544
chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #6541
chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6545
chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in #6600
chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6606
chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6603
chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #6607
chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in #6604
chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in #6608
chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #6605
chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6602
chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in #6601
chore(deps): bump ubi9/ubi from 37a1589 to 8bf0e8f by @dependabot[bot] in #6599
chore(deps): bump golang from 1.26.4 to 1.26.5 by @dependabot[bot] in #6636
chore(deps): bump distroless/static from 3592aa8 to d5f030c by @dependabot[bot] in #6635

New Contributors

@alpcanaydin made their first contribution in #6612
@baraka-akeyless made their first contribution in #6530
@arpitjain099 made their first contribution in #6614
@civilizedBaboon made their first contribution in #6646
@dbinger made their first contribution in #6616
@dsp0x4 made their first contribution in #6117
@izz-linux made their first contribution in #6644
@hdabrowski made their first contribution in #6393
@sumanpal97 made their first contribution in #6597
@emmayusufu made their first contribution in #6553
@Ashutosh-3601 made their first contribution in #6421

Full Changelog: external-secrets/external-secrets@v2.7.0...v2.8.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-18T21:51:03Z

civo-mgmt-0 - helmrelease

--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

@@ -66,12 +66,13 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - stssessiontokens
   - uuids
   - vaultdynamicsecrets
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

@@ -31,12 +31,13 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

@@ -31,12 +31,13 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.7.0
+        image: ghcr.io/external-secrets/external-secrets:v2.8.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.7.0
+        image: ghcr.io/external-secrets/external-secrets:v2.8.0
         imagePullPolicy: IfNotPresent
         args:
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.7.0
+        image: ghcr.io/external-secrets/external-secrets:v2.8.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs

github-actions · 2026-07-18T21:51:04Z

civo-mgmt-0 - kustomization

--- k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

+++ k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

@@ -13,13 +13,13 @@

       chart: external-secrets
       interval: 15m
       sourceRef:
         kind: HelmRepository
         name: external-secrets
         namespace: flux-system
-      version: 2.7.0
+      version: 2.8.0
   install:
     crds: CreateReplace
     createNamespace: true
     remediation:
       retries: 3
   interval: 15m

github-actions · 2026-07-18T21:51:11Z

qgr1-cluster-0 - kustomization

--- k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

+++ k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

@@ -13,13 +13,13 @@

       chart: external-secrets
       interval: 15m
       sourceRef:
         kind: HelmRepository
         name: external-secrets
         namespace: flux-system
-      version: 2.7.0
+      version: 2.8.0
   install:
     crds: CreateReplace
     createNamespace: true
     remediation:
       retries: 3
   interval: 15m

github-actions · 2026-07-18T21:51:12Z

qgr1-cluster-0 - helmrelease

--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

@@ -66,12 +66,13 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - stssessiontokens
   - uuids
   - vaultdynamicsecrets
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

@@ -31,12 +31,13 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

@@ -31,12 +31,13 @@

   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - gitlabdeploytokens
   - quayaccesstokens
   - passwords
   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.7.0
+        image: ghcr.io/external-secrets/external-secrets:v2.8.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.7.0
+        image: ghcr.io/external-secrets/external-secrets:v2.8.0
         imagePullPolicy: IfNotPresent
         args:
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.7.0
+        image: ghcr.io/external-secrets/external-secrets:v2.8.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs

renovate Bot added renovate/helm type/minor labels Jul 18, 2026

renovate Bot requested a review from anthr76 as a code owner July 18, 2026 21:50

renovate Bot added renovate/helm type/minor labels Jul 18, 2026

pull-request-size Bot added the size/XS label Jul 18, 2026

feat(helm): update chart external-secrets ( 2.7.0 ➔ 2.8.0 )

7d2b3a5

renovate Bot force-pushed the renovate/external-secrets-2.x branch from bb68fb2 to 7d2b3a5 Compare July 20, 2026 21:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(helm): update chart external-secrets ( 2.7.0 ➔ 2.8.0 ) - #3263

feat(helm): update chart external-secrets ( 2.7.0 ➔ 2.8.0 )#3263
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/external-secrets-2.x

renovate Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.8.0

What's Changed

General

Dependencies

New Contributors

Configuration

Uh oh!

github-actions Bot commented Jul 18, 2026

civo-mgmt-0 - helmrelease

Uh oh!

github-actions Bot commented Jul 18, 2026

civo-mgmt-0 - kustomization

Uh oh!

github-actions Bot commented Jul 18, 2026

qgr1-cluster-0 - kustomization

Uh oh!

github-actions Bot commented Jul 18, 2026

qgr1-cluster-0 - helmrelease

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 18, 2026 •

edited

Loading

`v2.8.0`