feat(helm): update external-secrets ( 0.9.18 → 0.20.4 )

[parsec-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	0.9.18 → 0.20.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

external-secrets/external-secrets (external-secrets)

v0.20.4

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.4
Image: ghcr.io/external-secrets/external-secrets:v0.20.4-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.4-ubi-boringssl

What's Changed

General

• fix: re-enable secretserver e2e tests by @​moolen in #​5442
• chore: update dependencies by @​eso-service-account-app[bot] in #​5462
• chore: release helm chart for v0.20.3 by @​Skarlso in #​5467
• docs: remove jwt token authentication option from STSSessionToken generator by @​liununu in #​5468
• feat: re-implement e2e managed tests by @​moolen in #​5444
• docs: Update Segura DSM Branding by @​chellin-segura in #​5469
• ref: simplify and document transform rewrite method by @​riccardomc in #​5450
• fix: put back the expires into the github generator by @​Skarlso in #​5472
• chore(charts): remove unused values from chart by @​rkferreira in #​5334
• feat(generators): add hex generator by @​unique-jakub in #​5314
• fix: use GetClientCertificate in Vault Auth by @​shaxbee in #​5441
• feat(aws): add defining a resource policy via metadata for secretsmanager by @​Skarlso in #​5399
• fix: Webhook provider PushSecret not working by @​Skarlso in #​5445
• fix: remove the finalizer on namespace deletion by @​Skarlso in #​5473
• chore: update dependencies by @​eso-service-account-app[bot] in #​5487
• fix: missing config-file for github action scanning by @​Skarlso in #​5376
• chore(build): Update ubi Docker builds to UBI9 by @​IdanAdar in #​5465
• fix: typo in GitHub provider documentation by @​gecube in #​5493
• fix(oracle): prevent TCP connections leakage by @​adutchak in #​5491
• docs(controller-options): typo in controller-options by @​aslafy-z in #​5496
• chore(linter): fix linter issue in api and cmd package by @​Lumexralph in #​5413
• fix: remove extra json convert check by @​Skarlso in #​5501

Dependencies

• chore(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @​dependabot[bot] in #​5454
• chore(deps): bump ubi8/ubi from 534c2c0 to 2f698e1 by @​dependabot[bot] in #​5452
• chore(deps): bump golang from 1.25.1 to 1.25.2 by @​dependabot[bot] in #​5456
• chore(deps): bump alpine from 4bcff63 to 4b7ce07 by @​dependabot[bot] in #​5451
• chore(deps): bump github/codeql-action from 3.30.6 to 4.30.8 by @​dependabot[bot] in #​5455
• chore(deps): bump alpine from 3.22.1 to 3.22.2 in /e2e by @​dependabot[bot] in #​5457
• chore(deps): bump golang from 1.25.1-bookworm to 1.25.2-bookworm in /e2e by @​dependabot[bot] in #​5460
• chore(deps): bump click from 8.1.8 to 8.3.0 in /hack/api-docs by @​dependabot[bot] in #​5458
• chore(deps): bump platformdirs from 4.4.0 to 4.5.0 in /hack/api-docs by @​dependabot[bot] in #​5459
• chore(deps): bump idna from 3.10 to 3.11 in /hack/api-docs by @​dependabot[bot] in #​5461
• chore(deps): bump softprops/action-gh-release from 2.3.4 to 2.4.1 by @​dependabot[bot] in #​5453
• chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @​dependabot[bot] in #​5481
• chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @​dependabot[bot] in #​5480
• chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.8 by @​dependabot[bot] in #​5483
• chore(deps): bump mkdocs-material from 9.6.21 to 9.6.22 in /hack/api-docs by @​dependabot[bot] in #​5485
• chore(deps): bump charset-normalizer from 3.4.3 to 3.4.4 in /hack/api-docs by @​dependabot[bot] in #​5486
• chore(deps): bump apache/skywalking-eyes from 0.7.0 to 0.8.0 by @​dependabot[bot] in #​5484
• chore(deps): bump aws-actions/configure-aws-credentials from 06083b7 to 5dc01db by @​dependabot[bot] in #​5482

New Contributors

• @​liununu made their first contribution in #​5468
• @​chellin-segura made their first contribution in #​5469
• @​unique-jakub made their first contribution in #​5314
• @​adutchak made their first contribution in #​5491

Full Changelog: external-secrets/external-secrets@v0.20.3...v0.20.4

v0.20.3

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.3
Image: ghcr.io/external-secrets/external-secrets:v0.20.3-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.3-ubi-boringssl

What's Changed

General

• chore: release helm chart for v0.20.2 by @​Skarlso in #​5403
• fix(ci): Remove PAUL by @​evrardjp in #​5406
• docs: add note on Vault 1.21 audience requirement for roles by @​AddRain1 in #​5411
• docs: extend bitwarden example and integration to accomodate the ssh key feature by @​luilegeant in #​5414
• chore: update dependencies by @​eso-service-account-app[bot] in #​5427
• docs(getting-started): Change apply to use File (-f) instead of Kustomize (-k) by @​smellems in #​5433
• docs(release): Resolve incorrect references in documentation samples by @​blast-hardcheese in #​5431
• docs: Update scaleway json doc by @​RobinFrcd in #​5429
• chore(previder): Update Previder Provider dependency and fix ReadOnly token by @​gkwmiddelkamp in #​5327
• chore(linter): fix revive linter issues in pkg by @​Lumexralph in #​5412
• chore: move to new GCP account, temporarily disable delinea by @​moolen in #​5438
• chore(actions): always run helm test and update make check-diff by @​Skarlso in #​5440
• fix: make port in the schema file either a string of an integer by @​Skarlso in #​5439
• fix: use maps.Equal instead of bytes.Compare for JSON value by @​Skarlso in #​5448
• chore(docs): update refresh interval format by @​Skarlso in #​5447
• chore(docs): update ADOPTERS.md to include Criteo by @​alikhil in #​5446

Dependencies

• chore(deps): bump softprops/action-gh-release from 2.3.3 to 2.3.4 by @​dependabot[bot] in #​5417
• chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 by @​dependabot[bot] in #​5420
• chore(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @​dependabot[bot] in #​5418
• chore(deps): bump golang from 6ad9415 to c423747 in /e2e by @​dependabot[bot] in #​5423
• chore(deps): bump mkdocs-material from 9.6.20 to 9.6.21 in /hack/api-docs by @​dependabot[bot] in #​5425
• chore(deps): bump certifi from 2025.8.3 to 2025.10.5 in /hack/api-docs by @​dependabot[bot] in #​5424
• chore(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @​dependabot[bot] in #​5422
• chore(deps): bump actions/stale from 10.0.0 to 10.1.0 by @​dependabot[bot] in #​5416
• chore(deps): bump peter-evans/create-or-update-comment from 4.0.0 to 5.0.0 by @​dependabot[bot] in #​5421
• chore(deps): bump golang from b6ed3fd to b6ed3fd by @​dependabot[bot] in #​5419

New Contributors

• @​AddRain1 made their first contribution in #​5411
• @​luilegeant made their first contribution in #​5414
• @​smellems made their first contribution in #​5433
• @​blast-hardcheese made their first contribution in #​5431
• @​RobinFrcd made their first contribution in #​5429
• @​alikhil made their first contribution in #​5446

Full Changelog: external-secrets/external-secrets@v0.20.2...v0.20.3

v0.20.2

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.2
Image: ghcr.io/external-secrets/external-secrets:v0.20.2-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.2-ubi-boringssl

What's Changed

General

• fix(typo): Google misspelled by @​evrardjp in #​5348
• chore: update helm charts v0.20.1 by @​Skarlso in #​5352
• chore(docs): update stability and support table for 0.20.x by @​jakobmoellerdev in #​5354
• chore: update dependencies by @​eso-service-account-app[bot] in #​5349
• chore(docs): update the release flow by @​Skarlso in #​5358
• feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider by @​felipeosantos in #​3895
• feat(ci): use separate github app for lgtm workflow. by @​webstradev in #​5365
• fix(ci): listing required roles should NOT mention/tag the roles, just name them. by @​webstradev in #​5363
• fix(ci): run lgtm label remover in pull_request_target context instead by @​webstradev in #​5366
• chore: update codeql action to also run for actions by @​Skarlso in #​5360
• feat(oracle): switch provider to maintained status by @​anders-swanson in #​5367
• fix: liveness probe would include invalid value enable by @​Skarlso in #​5369
• feat: introduce priorityPolicy in merge rewrite by @​riccardomc in #​5329
• docs: update community meeting section by @​webstradev in #​5364
• docs: issue-5350: Updates CRD and docs with write-only limitation for github provider by @​bharath-b-rh in #​5361
• fix: IBM Cloud Secrets Manager Imported Cert does not always require intermediate cert by @​varksvader in #​5370
• feat(gcp): get latest enabled secret by @​itaispiegel in #​5131
• feat(ci): zizmor github actions vuln scanner by @​arielrahamim in #​5368
• chore(docs): update pull request approval process by @​Skarlso in #​5374
• fix(release): Validate GCP GetSecret json format by @​Gabrielmadrid73 in #​5336
• fix(charts): exclude 'address' key from livenessProbe definition by @​baprx in #​5377
• feat: add ngrok provider by @​jonstacks in #​5160
• chore: update dependencies by @​eso-service-account-app[bot] in #​5386
• docs(release): CyberArk Conjur name change updates by @​akosasi in #​5359
• chore: bump go, e2e: flux/argo & restructure e2e-bin build by @​moolen in #​5333
• fix: remove unused secret by @​moolen in #​5391
• feat(charts): add startupProbe to cert controller by @​KyriosGN0 in #​5297
• fix: issue-5388: Fixes GCP Workload Identity Federation auth issue by @​bharath-b-rh in #​5392
• chore(lint): fix revive lint errors (pkg/providers) by @​Lumexralph in #​5362
• feat: make cert auth mount path configurable by @​shaxbee in #​5400

Dependencies

• chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @​dependabot[bot] in #​5379
• chore(deps): bump pyyaml from 6.0.2 to 6.0.3 in /hack/api-docs by @​dependabot[bot] in #​5380
• chore(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @​dependabot[bot] in #​5381
• chore(deps): bump github/codeql-action from 3.30.3 to 3.30.5 by @​dependabot[bot] in #​5384
• chore(deps): bump markupsafe from 3.0.2 to 3.0.3 in /hack/api-docs by @​dependabot[bot] in #​5383
• chore(deps): bump mkdocs-macros-plugin from 1.3.9 to 1.4.0 in /hack/api-docs by @​dependabot[bot] in #​5385
• chore(deps): bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​5382

New Contributors

• @​evrardjp made their first contribution in #​5348
• @​felipeosantos made their first contribution in #​3895
• @​varksvader made their first contribution in #​5370
• @​itaispiegel made their first contribution in #​5131
• @​arielrahamim made their first contribution in #​5368
• @​Gabrielmadrid73 made their first contribution in #​5336
• @​baprx made their first contribution in #​5377
• @​akosasi made their first contribution in #​5359
• @​Lumexralph made their first contribution in #​5362
• @​shaxbee made their first contribution in #​5400

Full Changelog: external-secrets/external-secrets@v0.20.0...v0.20.2

v0.20.1

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.1
Image: ghcr.io/external-secrets/external-secrets:v0.20.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl

What's Changed

General

• chore: release 0.19.2 by @​moolen in #​5136
• chore: update readme by @​gusfcarvalho in #​5137
• fix(kubernetes): make auth field optional by @​mhrabovcin in #​5064
• chore: Fix Markdown spelling issues found by codespell by @​mjtrangoni in #​5139
• Fix yaml codeblock for oracle-vault provider docs by @​muckelba in #​5146
• feat: add liveness probe to eso controller by @​Skarlso in #​4930
• fix(helm): add boolean for processClusterGenerator by @​DrummyFloyd in #​5144
• chore: add Cisco to ADOPTERS.md by @​sriaradhyula in #​5159
• docs: Fix provider stability and support table by @​jonstacks in #​5161
• feat(helm): Add control of response to missing prometheus CRDs by @​jcpunk in #​5087
• chore: Added release notes configuration by @​bonddim in #​5148
• chore: bump bitwarden helm chart version by @​Skarlso in #​5044
• chore(docs): update ADOPTERS.md to include SAP by @​jakobmoellerdev in #​5165
• feat: add externalsecret namespace for webhook provider by @​matheusmazzoni in #​5155
• fix: add unknown status for secret store by @​alvin-rw in #​5070
• Fix pushing to an AWS Secrets Manager Secret when there are no secret values by @​nirajsapkota in #​4878
• add extralabels for dashboard to be scraped by multiple grafana instances by @​L1ghtman2k in #​5138
• fix: the api docs are not referencing sshkey generator by @​Skarlso in #​5170
• Update github.md by @​gecube in #​5171
• Update anchore-engine-credentials.md by @​gecube in #​5172
• docs: update infisical docs to clarify missing system:auth-delegator need by @​Skarlso in #​5174
• Adding support different type auth sources by @​preved911 in #​4877
• fix: stability update document did not update the stability table correctly by @​Skarlso in #​5176
• Add esv1.AnnotationForceSync for CES and ES by @​ntnn in #​5156
• fix: helm build failing by @​Skarlso in #​5178
• fix: remove release- branch automation by @​moolen in #​5182
• chore: update dependencies by @​eso-service-account-app[bot] in #​5181
• docs: update bitwarden documentation for dataFrom field usage by @​Skarlso in #​5196
• feat: add contributor ladder by @​gusfcarvalho in #​5150
• feat: support vault provider check and set for push secrets by @​webstradev in #​5197
• chore(docs): update helm charts by @​gusfcarvalho in #​5203
• chore(ci): fix sonarqube security warnings in helm.yml by @​webstradev in #​5202
• chore: add pull request maintenance auto labelling and sizes by @​Skarlso in #​5200
• fix: update the label verification step by @​Skarlso in #​5209
• feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by @​tuxtof in #​5168
• feat: improve error message for json marshalling/unmarshalling by @​webstradev in #​5211
• chore: enhance helm-values-schema-json schema plugin management logic by @​jakobmoellerdev in #​5212
• fix(aws): stop incrementing the UUID for versions by @​Skarlso in #​5175
• feat: enable secure serving for metrics [issue 4614] by @​rkferreira in #​5169
• fix(infisical): fix TokenAuth auth method by escaping the token revocation by @​arthlr in #​5217
• fix: tilt build was failing to rebuild by @​Skarlso in #​5225
• feat: add selectable fields to the CRDs by @​Skarlso in #​5226
• ref: removing Yandex Cloud specific common types declaration duplication by @​preved911 in #​4905
• fix: missing codeowners file from .github folder by @​Skarlso in #​5228
• feat: add setting remote namespace to metadata for kubernetes provider by @​Skarlso in #​5224
• feat: add support for certs only in pkcs12 by @​devnopt in #​4875
• docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by @​ionicsolutions in #​5208
• feat: Allow adding finalizers from template by @​malovme in #​5140
• fix: controller-runtime update by @​gusfcarvalho in #​5239
• chore: update dependencies by @​eso-service-account-app[bot] in #​5229
• fix: Prevent secretstore reconcile loop when provider error response is dynamic by @​dakotaharden in #​5247
• feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by @​matheusmazzoni in #​5163
• fix: keepersecurity support for shortcuts by @​pepordev in #​5245
• feat: add support for GCP Workload Identity Federation by @​bharath-b-rh in #​4654
• feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by @​alliseeisgold in #​5022
• chore(charts): Adds new make target for installing unittest plugin by @​bharath-b-rh in #​5250
• docs(templating): added clarifying comments to Github generator example by @​nielstenboom in #​5248
• feat(release): add new workflow to label first time contributor issues by @​mouhsen-ibrahim in #​5243
• feat(security): Adds an option to make HTTP2 configurable by @​siddhibhor-56 in #​5231
• feat: add retry for onepassword on authorization error by @​Skarlso in #​5253
• fix: handle namespace deletion race conditions with finalizers by @​framsouza in #​5154
• docs: update stability and support by @​anders-swanson in #​5257
• fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by @​kgal-akl in #​5263
• feat: support Pod Identity authentication for Vault Provider by @​webstradev in #​5201
• feat: add domain field to secretserver provider by @​rkferreira in #​5258
• chore(release): Migrate to actions/create-github-app-token action by @​mouhsen-ibrahim in #​5264
• chore: just updating the crd conformance tests by @​Skarlso in #​5265
• chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by @​Skarlso in #​5269
• chore: azure sdk update by @​hauswio in #​5162
• feat: add support for fetching Secret by Path on Delinea Secret Server provider by @​DelineaSahilWankhede in #​5270
• feat: migrate from tibdex to actions/create-github-app-token by @​rkferreira in #​5286
• fix: license headers across all Go files - standardize format, add missing copyright, fix typos by @​Copilot in #​5288
• fix: the boilerplate was missing the right license format by @​Skarlso in #​5289
• chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by @​Copilot in #​5290
• chore(docs): remove GitHub Discussions references and update support channels by @​jakobmoellerdev in #​5292
• docs: updated the ladder with two new tracks: documentation and community by @​Skarlso in #​5298
• docs(release): create upgrading section by @​rkferreira in #​5310
• docs: readme update for health of the project by @​Skarlso in #​5309
• fix: validate namespace in secretRef by @​moolen in #​5311
• docs: add burnout prevention strategies and mitigation policy document by @​Skarlso in #​5307
• feat: add missing go sbom by @​moolen in #​5313
• feat: make vault e2e tests run locally by @​moolen in #​5246
• chore: update dependencies by @​eso-service-account-app[bot] in #​5324
• feat: add Cloudsmith generator for container registry authentication by @​cloudsmith-iduffy in #​5267
• feat: Add lgtm review automation step to ci workflows. by @​webstradev in #​5251
• feat(provider): add Volcengine provider support by @​kevinyancn in #​5306
• test: add more information to potentially flaky test by @​Skarlso in #​5330
• fix(docs): Fix typo in controller options doc by @​tspearconquest in #​5299
• chore(testing): Add licence.check make target by @​jonstacks in #​5335
• docs(gitlab-variables): document environment scope fallback by @​s1nyx in #​5300

Dependencies

• chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by @​dependabot[bot] in #​5190
• chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by @​dependabot[bot] in #​5191
• chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by @​dependabot[bot] in #​5189
• chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​5188
• chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by @​dependabot[bot] in #​5187
• chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by @​dependabot[bot] in #​5186
• chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @​dependabot[bot] in #​5184
• chore(deps): bump golang from 1.24.6 to 1.25.0 by @​dependabot[bot] in #​5194
• chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by @​dependabot[bot] in #​5195
• chore(deps): bump ubi8/ubi from 4f0a4e4 to 7010e70 by @​dependabot[bot] in #​5193
• chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by @​dependabot[bot] in #​5192
• chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @​dependabot[bot] in #​5198
• chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by @​dependabot[bot] in #​5199
• chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by @​dependabot[bot] in #​5234
• chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @​dependabot[bot] in #​5236
• chore(deps): bump ubi8/ubi from 7010e70 to 534c2c0 by @​dependabot[bot] in #​5237
• chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @​dependabot[bot] in #​5238
• chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by @​dependabot[bot] in #​5242
• chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by @​dependabot[bot] in #​5241
• chore(deps): bump distroless/static from 2e114d2 to f2ff10a by @​dependabot[bot] in #​5240
• chore(deps): bump golang from 1.25.0 to 1.25.1 by @​dependabot[bot] in #​5275
• chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @​dependabot[bot] in #​5274
• chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by @​dependabot[bot] in #​5273
• chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @​dependabot[bot] in #​5276
• chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by @​dependabot[bot] in #​5279
• chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @​dependabot[bot] in #​5278
• chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by @​dependabot[bot] in #​5277
• chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by @​dependabot[bot] in #​5281
• chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by @​dependabot[bot] in #​5280
• chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by @​dependabot[bot] in #​5282
• chore(deps): bump golang from b6ed3fd to b6ed3fd by @​dependabot[bot] in #​5318
• chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by @​dependabot[bot] in #​5317
• chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by @​dependabot[bot] in #​5319
• chore(deps): bump distroless/static from f2ff10a to 87bce11 by @​dependabot[bot] in #​5320
• chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by @​dependabot[bot] in #​5323
• chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @​dependabot[bot] in #​5321
• chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @​dependabot[bot] in #​5322
• chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @​dependabot[bot] in #​5339
• chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by @​dependabot[bot] in #​5344
• chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by @​dependabot[bot] in #​5345
• chore(dep

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

--- kubernetes/apps/external-secrets/external-secrets/app Kustomization: flux-system/external-secrets HelmRelease: external-secrets/external-secrets

+++ kubernetes/apps/external-secrets/external-secrets/app Kustomization: flux-system/external-secrets HelmRelease: external-secrets/external-secrets

@@ -13,13 +13,13 @@

     spec:
       chart: external-secrets
       sourceRef:
         kind: HelmRepository
         name: external-secrets
         namespace: flux-system
-      version: 0.9.18
+      version: 0.14.3
   install:
     remediation:
       retries: 3
   interval: 30m
   uninstall:
     keepHistory: false

[github-actions]

--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-cert-controller

@@ -20,15 +20,23 @@

   - patch
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - validatingwebhookconfigurations
   verbs:
-  - get
   - list
   - watch
+  - get
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  resourceNames:
+  - secretstore-validate
+  - externalsecret-validate
+  verbs:
   - update
   - patch
 - apiGroups:
   - ''
   resources:
   - endpoints
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

@@ -36,25 +36,44 @@

   - clusterexternalsecrets/status
   - clusterexternalsecrets/finalizers
   - pushsecrets
   - pushsecrets/status
   - pushsecrets/finalizers
   verbs:
+  - get
   - update
   - patch
 - apiGroups:
   - generators.external-secrets.io
   resources:
+  - generatorstates
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+  - deletecollection
+- apiGroups:
+  - generators.external-secrets.io
+  resources:
   - acraccesstokens
+  - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - quayaccesstokens
   - passwords
+  - stssessiontokens
+  - uuids
   - vaultdynamicsecrets
   - webhooks
+  - grafanas
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

@@ -23,18 +23,22 @@

   - watch
   - list
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - quayaccesstokens
   - passwords
   - vaultdynamicsecrets
   - webhooks
+  - grafanas
+  - generatorstates
   verbs:
   - get
   - watch
   - list
 
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

@@ -24,19 +24,23 @@

   - patch
   - update
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
+  - quayaccesstokens
   - passwords
   - vaultdynamicsecrets
   - webhooks
+  - grafanas
+  - generatorstates
   verbs:
   - create
   - delete
   - deletecollection
   - patch
   - update
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,23 +34,26 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v0.9.18
+        image: oci.external-secrets.io/external-secrets/external-secrets:v0.14.3
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
         - --secret-name=external-secrets-webhook
         - --secret-namespace=external-secrets
         - --metrics-addr=:8080
         - --healthz-addr=:8081
+        - --loglevel=info
+        - --zap-time-encoding=epoch
+        - --enable-partial-cache=true
         ports:
         - containerPort: 8080
           protocol: TCP
           name: metrics
         readinessProbe:
           httpGet:
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,17 +34,19 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v0.9.18
+        image: oci.external-secrets.io/external-secrets/external-secrets:v0.14.3
         imagePullPolicy: IfNotPresent
         args:
         - --concurrent=1
         - --metrics-addr=:8080
+        - --loglevel=info
+        - --zap-time-encoding=epoch
         ports:
         - containerPort: 8080
           protocol: TCP
           name: metrics
       dnsPolicy: ClusterFirst
 
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,22 +34,24 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v0.9.18
+        image: oci.external-secrets.io/external-secrets/external-secrets:v0.14.3
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs
         - --check-interval=5m
         - --metrics-addr=:8080
         - --healthz-addr=:8081
+        - --loglevel=info
+        - --zap-time-encoding=epoch
         ports:
         - containerPort: 8080
           protocol: TCP
           name: metrics
         - containerPort: 10250
           protocol: TCP
--- HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

+++ HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

@@ -1,12 +1,15 @@

 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: secretstore-validate
   labels:
+    app.kubernetes.io/name: external-secrets-webhook
+    app.kubernetes.io/instance: external-secrets
+    app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 webhooks:
 - name: validate.secretstore.external-secrets.io
   rules:
   - apiGroups:
     - external-secrets.io
--- HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/externalsecret-validate

+++ HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/externalsecret-validate

@@ -1,12 +1,15 @@

 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: externalsecret-validate
   labels:
+    app.kubernetes.io/name: external-secrets-webhook
+    app.kubernetes.io/instance: external-secrets
+    app.kubernetes.io/managed-by: Helm
     external-secrets.io/component: webhook
 webhooks:
 - name: validate.externalsecret.external-secrets.io
   rules:
   - apiGroups:
     - external-secrets.io