feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.2.0 ) by renovate[bot] · Pull Request #3175 · anthr76/infra

renovate · 2026-02-06T20:31:03Z

This PR contains the following updates:

Package	Update	Change
external-secrets	major	`1.2.1` → `2.2.0`

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.2.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.2.0
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl

What's Changed

General

chore: release charts v2.1.0 by @Skarlso in #6030
chore: fix the stability doc by @Skarlso in #6035
fix(security): Fix vulnerabilities by @othomann in #6052
fix(aws): sync tags and resource policy even when secret value unchanged by @evs-secops in #6025
fix: publish now uses docker build v4 which required some changes by @Skarlso in #6062
feat(gcpsm): auto-detect projectID from GCP metadata server by @patjlm in #5922
chore(templating): Remove years in license and their checks by @evrardj-roche in #5955
docs: Add Roche to official ADOPTERS by @evrardj-roche in #6076
feat: Add Last Sync column to ExternalSecret and PushSecret printers by @jaruwat-panturat in #6068
fix(onepassword): support native item IDs by @chadxz in #6073
feat: extract LGTM processor to external JS file with tests by @mateenali66 in #6074
feat: fail fast if LGTM label does not exist in repository by @mateenali66 in #6078
feat(passbolt): add support for Passbolt V5 API by @cedricherzog-passbolt in #5919
fix(infisical): dataFrom.find.path should filter by secret path not name by @johnvox in #6086
fix: disable the priority queue which misbehaves at scale by @Skarlso in #6083
chore: update go version to 1.26.1 by @Skarlso in #6072
docs(aws): fix PushSecret metadata indentation in resource policy exa... by @Br1an67 in #6056
fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by @Br1an67 in #6036
feat(templating): Add certSANs function to extract SANs from certificates by @mzdeb in #6058
docs: document template.metadata labels/annotations behavior by @lucpas in #6102
fix: CODEOWNERS are seriously out of date by @Skarlso in #6106
feat(helm): add readinessProbe support for external-secrets deployment by @AlexOQ in #5831
fix: update grpc for CVE-2026-33186 by @Skarlso in #6108
feat(azurekv): add expiration time to azure kv secret by @muraliavarma in #5935
feat: add path to cloud.ru provider by @heavyandrew in #5952
fix(add-eso-version): fix separator line pattern in add_eso_version.sh script by @riccardomc in #6113

Dependencies

chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @dependabot[bot] in #6038
chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by @dependabot[bot] in #6047
chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by @dependabot[bot] in #6050
chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by @dependabot[bot] in #6049
chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by @dependabot[bot] in #6039
chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by @dependabot[bot] in #6043
chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in #6040
chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by @dependabot[bot] in #6044
chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6042
chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #6041
chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6046
chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by @dependabot[bot] in #6048
chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by @dependabot[bot] in #6093
chore(deps): bump distroless/static from 28efbe9 to 47b2d72 by @dependabot[bot] in #6088
chore(deps): bump ubi9/ubi from cecb1cd to 6ed9f6f by @dependabot[bot] in #6087
chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by @dependabot[bot] in #6096
chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by @dependabot[bot] in #6094
chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by @dependabot[bot] in #6095
chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by @dependabot[bot] in #6089
chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by @dependabot[bot] in #6092
chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #6090
chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by @dependabot[bot] in #6091

New Contributors

@othomann made their first contribution in #6052
@evs-secops made their first contribution in #6025
@patjlm made their first contribution in #5922
@jaruwat-panturat made their first contribution in #6068
@chadxz made their first contribution in #6073
@mateenali66 made their first contribution in #6074
@cedricherzog-passbolt made their first contribution in #5919
@johnvox made their first contribution in #6086
@Br1an67 made their first contribution in #6056
@mzdeb made their first contribution in #6058
@lucpas made their first contribution in #6102
@AlexOQ made their first contribution in #5831
@muraliavarma made their first contribution in #5935
@heavyandrew made their first contribution in #5952

Full Changelog: external-secrets/external-secrets@v2.1.0...v2.2.0

`v2.1.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.1.0
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.1.0-ubi-boringssl

What's Changed

General

chore(release): Update helm chart by @evrardj-roche in #5981
fix: cosign verify does not use signing config by @gusfcarvalho in #5982
docs: Update release process by @evrardj-roche in #5980
fix: allow cross-namespace push with ClusterSecretStore objects by @Skarlso in #5998
feat(charts): add new flag enable leader for cert-manager by @nutmos in #5863
feat(kubernetes): fall back to system CA roots when no CA is configured by @rajsinghtech in #5961
feat: dedup sbom but keep it monolithic by @moolen in #6004
fix: add missing metrics and fundamentally fix the caching logic by @Skarlso in #5894
docs: designate Oracle Vault provider as 'stable' by @anders-swanson in #6020
docs: Oracle Vault provider capabilities by @anders-swanson in #6023
docs(azurekv): cert-manager pushsecret example and cleanups by @illrill in #5972
feat(kubernetes): implement SecretExists by @Saku2 in #5973
fix(charts): Fix wrongly set annotations for cert-controller metrics service by @josemaia in #6029
feat(providers): Nebius MysteryBox integration by @greenmapc in #5868

Dependencies

chore(deps): bump aquasecurity/trivy-action from 0.34.0 to 0.34.1 by @dependabot[bot] in #5986
chore(deps): bump mkdocs-material from 9.7.1 to 9.7.2 in /hack/api-docs by @dependabot[bot] in #5992
chore(deps): bump ubi9/ubi from b8923f5 to cecb1cd by @dependabot[bot] in #5984
chore(deps): bump helm/kind-action from 1.13.0 to 1.14.0 by @dependabot[bot] in #5985
chore(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 by @dependabot[bot] in #5990
chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 by @dependabot[bot] in #5989
chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @dependabot[bot] in #5987
chore(deps): bump regex from 2026.1.15 to 2026.2.19 in /hack/api-docs by @dependabot[bot] in #5991
chore(deps): bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #5988
chore(deps): bump regex from 2026.2.19 to 2026.2.28 in /hack/api-docs by @dependabot[bot] in #6012
chore(deps): bump mkdocs-material from 9.7.2 to 9.7.3 in /hack/api-docs by @dependabot[bot] in #6014
chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 by @dependabot[bot] in #6015
chore(deps): bump anchore/sbom-action from 0.22.2 to 0.23.0 by @dependabot[bot] in #6016
chore(deps): bump certifi from 2026.1.4 to 2026.2.25 in /hack/api-docs by @dependabot[bot] in #6013
chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #6010
chore(deps): bump hashicorp/setup-terraform from ce70bcf to 5e8dbf3 by @dependabot[bot] in #6011
chore(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in #6009
chore(deps): bump distroless/static from 972618c to 28efbe9 by @dependabot[bot] in #6008

New Contributors

@nutmos made their first contribution in #5863
@rajsinghtech made their first contribution in #5961
@illrill made their first contribution in #5972
@Saku2 made their first contribution in #5973
@greenmapc made their first contribution in #5868

Full Changelog: external-secrets/external-secrets@v2.0.1...v2.1.0

`v2.0.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.0.1
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.1-ubi-boringssl

What's Changed

General

chore: release helm chart for v2.0.0 by @Skarlso in #5932
docs: update the stability doc with the new version by @Skarlso in #5933
chore(doc): add loblaw to adopter md by @FZhg in #5937
chore: bump golang to 1.25.7 because of cve by @Skarlso in #5938
fix: deleting the whole secret when it is empty by @Skarlso in #5927
chore: update controller runtime by @Skarlso in #5930
fix: update cosign and syft for signing by @Skarlso in #5958
fix: the informer can not register use GetInformer instead by @Skarlso in #5931
fix: attempt to fix cosign compatibility issues by @gusfcarvalho in #5959
chore: remove outdated info from stability doc by @Skarlso in #5971
chore(deps): update Masterminds/sprig to 8cb06fe… by @tete17 in #5747
docs(release): Update support matrix by @evrardjp in #5978

Dependencies

chore(deps): bump golang from 20c8a94 to f6751d8 by @dependabot[bot] in #5940
chore(deps): bump ubi9/ubi from c8df11b to b8923f5 by @dependabot[bot] in #5939
chore(deps): bump distroless/static from cd64bec to 972618c by @dependabot[bot] in #5941
chore(deps): bump github/codeql-action from 4.32.0 to 4.32.2 by @dependabot[bot] in #5942
chore(deps): bump anchore/sbom-action from 0.22.1 to 0.22.2 by @dependabot[bot] in #5943
chore(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 by @dependabot[bot] in #5944
chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 by @dependabot[bot] in #5945
chore(deps): bump fossas/fossa-action from 1.7.0 to 1.8.0 by @dependabot[bot] in #5946
chore(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 by @dependabot[bot] in #5947
chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 by @dependabot[bot] in #5965
chore(deps): bump markdown from 3.10.1 to 3.10.2 in /hack/api-docs by @dependabot[bot] in #5968
chore(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by @dependabot[bot] in #5964
chore(deps): bump platformdirs from 4.5.1 to 4.9.2 in /hack/api-docs by @dependabot[bot] in #5967
chore(deps): bump pymdown-extensions from 10.20.1 to 10.21 in /hack/api-docs by @dependabot[bot] in #5969

New Contributors

@FZhg made their first contribution in #5937

Full Changelog: external-secrets/external-secrets@v2.0.0...v2.0.1

`v2.0.0`

Compare Source

BREAKING CHANGE

Please note that this release removed two of the unsupported and unmaintained providers Alibaba and Device42.

Image: ghcr.io/external-secrets/external-secrets:v2.0.0
Image: ghcr.io/external-secrets/external-secrets:v2.0.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.0.0-ubi-boringssl

What's Changed

General

chore: bump charts to 1.3.2 by @gusfcarvalho in #5923
feat(charts): add hostAliases support by @janlauber in #5866
chore: remove unmaintained secret stores by @Skarlso in #5918
docs(infisical): document al provider auth methods by @varonix0 in #5929
chore: Get validating webhook failurePolicy for Secretstore dynamically by @LochanRn in #5605

New Contributors

@LochanRn made their first contribution in #5605

Full Changelog: external-secrets/external-secrets@v1.3.2...v2.0.0

`v1.3.2`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.2
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.2-ubi-boringssl

What's Changed

General

chore: release helm chart for v1.3.1 by @Skarlso in #5860
chore(chart): Add missing tests for readinessProbe by @jcpunk in #5769
docs: Update FluxCD example by @umizoom in #5862
fix(ci): Removed the unused check for Windows in Makefile by @HauptJ in #5870
docs(release): Add actual dates for EOL of 1.x releases in stability and support page by @n4zukker in #5889
docs: Passbolt provider maintenance ownership by @stripthis in #5886
chore: Update Passbolt MaintenanceStatus to MaintenanceStatusMaintained by @stripthis in #5887
fix(security): sanitize json.Unmarshal errors to prevent secret data … by @moolen in #5884
fix: webhook initialization order by @gusfcarvalho in #5901
chore: Cleanup flags by @evrardj-roche in #5845
fix: onepasswordsdk shared tenant by altering the provider in the client cache by @Skarlso in #5921

Dependencies

chore(deps): bump github/codeql-action from 4.31.10 to 4.31.11 by @dependabot[bot] in #5873
chore(deps): bump pymdown-extensions from 10.20 to 10.20.1 in /hack/api-docs by @dependabot[bot] in #5877
chore(deps): bump markdown from 3.10 to 3.10.1 in /hack/api-docs by @dependabot[bot] in #5880
chore(deps): bump ubi9/ubi from 22e9573 to 1f84f5c by @dependabot[bot] in #5871
chore(deps): bump actions/setup-python from 6.1.0 to 6.2.0 by @dependabot[bot] in #5872
chore(deps): bump hashicorp/setup-terraform from 93d5a27 to dcc3150 by @dependabot[bot] in #5875
chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #5876
chore(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #5878
chore(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 by @dependabot[bot] in #5874
chore(deps): bump packaging from 25.0 to 26.0 in /hack/api-docs by @dependabot[bot] in #5879
chore(deps): bump golang from d9b2e14 to 98e6cff by @dependabot[bot] in #5907
chore(deps): bump alpine from 865b95f to 2510918 in /hack/api-docs by @dependabot[bot] in #5914
chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #5909
chore(deps): bump actions/cache from 5.0.2 to 5.0.3 by @dependabot[bot] in #5912
chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in #5910
chore(deps): bump hashicorp/setup-terraform from dcc3150 to ce70bcf by @dependabot[bot] in #5911
chore(deps): bump ubi9/ubi from 1f84f5c to c8df11b by @dependabot[bot] in #5908
chore(deps): bump alpine from 3.23.2 to 3.23.3 in /e2e by @dependabot[bot] in #5915
chore(deps): bump alpine from 865b95f to 2510918 by @dependabot[bot] in #5906
chore(deps): bump pathspec from 1.0.3 to 1.0.4 in /hack/api-docs by @dependabot[bot] in #5916
chore(deps): bump babel from 2.17.0 to 2.18.0 in /hack/api-docs by @dependabot[bot] in #5917
chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 by @dependabot[bot] in #5913

New Contributors

@umizoom made their first contribution in #5862
@HauptJ made their first contribution in #5870
@n4zukker made their first contribution in #5889
@stripthis made their first contribution in #5886

Full Changelog: external-secrets/external-secrets@v1.3.1...v1.3.2

`v1.3.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.3.1
Image: ghcr.io/external-secrets/external-secrets:v1.3.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.3.1-ubi-boringssl

For a Full release please referre to https://github.com/external-secrets/external-secrets/releases/tag/v1.3.0. This is a fix build for the docker publish flow.

What's Changed

General

fix: ignore the in-toto manifest when promoting the docker build by @Skarlso in #5859

Full Changelog: external-secrets/external-secrets@v1.3.0...v1.3.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-02-06T20:31:33Z

civo-mgmt-0 - kustomization

--- k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

+++ k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

@@ -13,13 +13,13 @@

       chart: external-secrets
       interval: 15m
       sourceRef:
         kind: HelmRepository
         name: external-secrets
         namespace: flux-system
-      version: 1.2.1
+      version: 2.2.0
   install:
     crds: CreateReplace
     createNamespace: true
     remediation:
       retries: 3
   interval: 15m

github-actions · 2026-02-06T20:31:35Z

civo-mgmt-0 - helmrelease

--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v1.2.1
+        image: ghcr.io/external-secrets/external-secrets:v2.2.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
@@ -52,13 +52,16 @@

         - --zap-time-encoding=epoch
         - --enable-partial-cache=true
         ports:
         - containerPort: 8080
           protocol: TCP
           name: metrics
+        - containerPort: 8081
+          protocol: TCP
+          name: ready
         readinessProbe:
           httpGet:
-            port: 8081
+            port: ready
             path: /readyz
           initialDelaySeconds: 20
           periodSeconds: 5
 
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v1.2.1
+        image: ghcr.io/external-secrets/external-secrets:v2.2.0
         imagePullPolicy: IfNotPresent
         args:
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v1.2.1
+        image: ghcr.io/external-secrets/external-secrets:v2.2.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs
@@ -53,15 +53,18 @@

         - containerPort: 8080
           protocol: TCP
           name: metrics
         - containerPort: 10250
           protocol: TCP
           name: webhook
+        - containerPort: 8081
+          protocol: TCP
+          name: ready
         readinessProbe:
           httpGet:
-            port: 8081
+            port: ready
             path: /readyz
           initialDelaySeconds: 20
           periodSeconds: 5
         volumeMounts:
         - name: certs
           mountPath: /tmp/certs
--- HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

+++ HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

@@ -29,12 +29,13 @@

       path: /validate-external-secrets-io-v1-secretstore
   admissionReviewVersions:
   - v1
   - v1beta1
   sideEffects: None
   timeoutSeconds: 5
+  failurePolicy: Fail
 - name: validate.clustersecretstore.external-secrets.io
   rules:
   - apiGroups:
     - external-secrets.io
     apiVersions:
     - v1

github-actions · 2026-02-06T20:31:42Z

qgr1-cluster-0 - kustomization

--- k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

+++ k8s/base/external-secrets/external-secrets Kustomization: flux-system/external-secrets-external-secrets HelmRelease: external-secrets/external-secrets

@@ -13,13 +13,13 @@

       chart: external-secrets
       interval: 15m
       sourceRef:
         kind: HelmRepository
         name: external-secrets
         namespace: flux-system
-      version: 1.2.1
+      version: 2.2.0
   install:
     crds: CreateReplace
     createNamespace: true
     remediation:
       retries: 3
   interval: 15m

github-actions · 2026-02-06T20:31:42Z

qgr1-cluster-0 - helmrelease

--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v1.2.1
+        image: ghcr.io/external-secrets/external-secrets:v2.2.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
@@ -52,13 +52,16 @@

         - --zap-time-encoding=epoch
         - --enable-partial-cache=true
         ports:
         - containerPort: 8080
           protocol: TCP
           name: metrics
+        - containerPort: 8081
+          protocol: TCP
+          name: ready
         readinessProbe:
           httpGet:
-            port: 8081
+            port: ready
             path: /readyz
           initialDelaySeconds: 20
           periodSeconds: 5
 
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v1.2.1
+        image: ghcr.io/external-secrets/external-secrets:v2.2.0
         imagePullPolicy: IfNotPresent
         args:
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v1.2.1
+        image: ghcr.io/external-secrets/external-secrets:v2.2.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs
@@ -53,15 +53,18 @@

         - containerPort: 8080
           protocol: TCP
           name: metrics
         - containerPort: 10250
           protocol: TCP
           name: webhook
+        - containerPort: 8081
+          protocol: TCP
+          name: ready
         readinessProbe:
           httpGet:
-            port: 8081
+            port: ready
             path: /readyz
           initialDelaySeconds: 20
           periodSeconds: 5
         volumeMounts:
         - name: certs
           mountPath: /tmp/certs
--- HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

+++ HelmRelease: external-secrets/external-secrets ValidatingWebhookConfiguration: external-secrets/secretstore-validate

@@ -29,12 +29,13 @@

       path: /validate-external-secrets-io-v1-secretstore
   admissionReviewVersions:
   - v1
   - v1beta1
   sideEffects: None
   timeoutSeconds: 5
+  failurePolicy: Fail
 - name: validate.clustersecretstore.external-secrets.io
   rules:
   - apiGroups:
     - external-secrets.io
     apiVersions:
     - v1

renovate bot requested a review from anthr76 as a code owner February 6, 2026 20:31

renovate bot added renovate/helm type/major labels Feb 6, 2026

pull-request-size bot added the size/XS label Feb 6, 2026

renovate bot changed the title ~~feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.0.0 )~~ feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.0.1 ) Feb 20, 2026

renovate bot force-pushed the renovate/external-secrets-2.x branch from 235c9cd to 28c8788 Compare February 20, 2026 16:52

renovate bot force-pushed the renovate/external-secrets-2.x branch from 28c8788 to 12e9226 Compare March 7, 2026 20:57

renovate bot changed the title ~~feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.0.1 )~~ feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.1.0 ) Mar 7, 2026

renovate bot force-pushed the renovate/external-secrets-2.x branch from 12e9226 to 749a2fc Compare March 9, 2026 17:04

feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.2.0 )

4ffcd79

renovate bot changed the title ~~feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.1.0 )~~ feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.2.0 ) Mar 20, 2026

renovate bot force-pushed the renovate/external-secrets-2.x branch from 749a2fc to 4ffcd79 Compare March 20, 2026 17:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.2.0 )#3175

feat(helm)!: Update chart external-secrets ( 1.2.1 ➔ 2.2.0 )#3175
renovate[bot] wants to merge 1 commit intomainfrom
renovate/external-secrets-2.x

renovate bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.2.0

What's Changed

General

Dependencies

New Contributors

v2.1.0

What's Changed

General

Dependencies

New Contributors

v2.0.1

What's Changed

General

Dependencies

New Contributors

v2.0.0

BREAKING CHANGE

What's Changed

General

New Contributors

v1.3.2

What's Changed

General

Dependencies

New Contributors

v1.3.1

What's Changed

General

Configuration

Uh oh!

github-actions bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

civo-mgmt-0 - kustomization

Uh oh!

github-actions bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

civo-mgmt-0 - helmrelease

Uh oh!

github-actions bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

qgr1-cluster-0 - kustomization

Uh oh!

github-actions bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

qgr1-cluster-0 - helmrelease

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Feb 6, 2026 •

edited

Loading

`v2.2.0`

`v2.1.0`

`v2.0.1`

`v2.0.0`

`v1.3.2`

`v1.3.1`

github-actions bot commented Feb 6, 2026 •

edited

Loading

github-actions bot commented Feb 6, 2026 •

edited

Loading

github-actions bot commented Feb 6, 2026 •

edited

Loading

github-actions bot commented Feb 6, 2026 •

edited

Loading