feat(container): update image ghcr.io/external-secrets/charts/external-secrets ( 0.19.2 ➔ 0.20.1 ) by unsc-oni-ancilla[bot] · Pull Request #3377 · binaryn3xus/HomeOps

unsc-oni-ancilla · 2025-09-22T13:15:43Z

This PR contains the following updates:

Package	Update	Change
ghcr.io/external-secrets/charts/external-secrets	minor	`0.19.2` -> `0.20.1`

Release Notes

external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)

`v0.20.1`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v0.20.1
Image: ghcr.io/external-secrets/external-secrets:v0.20.1-ubi
Image: ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl

What's Changed

General

chore: release 0.19.2 by @moolen in #5136
chore: update readme by @gusfcarvalho in #5137
fix(kubernetes): make auth field optional by @mhrabovcin in #5064
chore: Fix Markdown spelling issues found by codespell by @mjtrangoni in #5139
Fix yaml codeblock for oracle-vault provider docs by @muckelba in #5146
feat: add liveness probe to eso controller by @Skarlso in #4930
fix(helm): add boolean for processClusterGenerator by @DrummyFloyd in #5144
chore: add Cisco to ADOPTERS.md by @sriaradhyula in #5159
docs: Fix provider stability and support table by @jonstacks in #5161
feat(helm): Add control of response to missing prometheus CRDs by @jcpunk in #5087
chore: Added release notes configuration by @bonddim in #5148
chore: bump bitwarden helm chart version by @Skarlso in #5044
chore(docs): update ADOPTERS.md to include SAP by @jakobmoellerdev in #5165
feat: add externalsecret namespace for webhook provider by @matheusmazzoni in #5155
fix: add unknown status for secret store by @alvin-rw in #5070
Fix pushing to an AWS Secrets Manager Secret when there are no secret values by @nirajsapkota in #4878
add extralabels for dashboard to be scraped by multiple grafana instances by @L1ghtman2k in #5138
fix: the api docs are not referencing sshkey generator by @Skarlso in #5170
Update github.md by @gecube in #5171
Update anchore-engine-credentials.md by @gecube in #5172
docs: update infisical docs to clarify missing system:auth-delegator need by @Skarlso in #5174
Adding support different type auth sources by @preved911 in #4877
fix: stability update document did not update the stability table correctly by @Skarlso in #5176
Add esv1.AnnotationForceSync for CES and ES by @ntnn in #5156
fix: helm build failing by @Skarlso in #5178
fix: remove release- branch automation by @moolen in #5182
chore: update dependencies by @eso-service-account-app[bot] in #5181
docs: update bitwarden documentation for dataFrom field usage by @Skarlso in #5196
feat: add contributor ladder by @gusfcarvalho in #5150
feat: support vault provider check and set for push secrets by @webstradev in #5197
chore(docs): update helm charts by @gusfcarvalho in #5203
chore(ci): fix sonarqube security warnings in helm.yml by @webstradev in #5202
chore: add pull request maintenance auto labelling and sizes by @Skarlso in #5200
fix: update the label verification step by @Skarlso in #5209
feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by @tuxtof in #5168
feat: improve error message for json marshalling/unmarshalling by @webstradev in #5211
chore: enhance helm-values-schema-json schema plugin management logic by @jakobmoellerdev in #5212
fix(aws): stop incrementing the UUID for versions by @Skarlso in #5175
feat: enable secure serving for metrics [issue 4614] by @rkferreira in #5169
fix(infisical): fix TokenAuth auth method by escaping the token revocation by @arthlr in #5217
fix: tilt build was failing to rebuild by @Skarlso in #5225
feat: add selectable fields to the CRDs by @Skarlso in #5226
ref: removing Yandex Cloud specific common types declaration duplication by @preved911 in #4905
fix: missing codeowners file from .github folder by @Skarlso in #5228
feat: add setting remote namespace to metadata for kubernetes provider by @Skarlso in #5224
feat: add support for certs only in pkcs12 by @devnopt in #4875
docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by @ionicsolutions in #5208
feat: Allow adding finalizers from template by @malovme in #5140
fix: controller-runtime update by @gusfcarvalho in #5239
chore: update dependencies by @eso-service-account-app[bot] in #5229
fix: Prevent secretstore reconcile loop when provider error response is dynamic by @dakotaharden in #5247
feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by @matheusmazzoni in #5163
fix: keepersecurity support for shortcuts by @pepordev in #5245
feat: add support for GCP Workload Identity Federation by @bharath-b-rh in #4654
feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by @alliseeisgold in #5022
chore(charts): Adds new make target for installing unittest plugin by @bharath-b-rh in #5250
docs(templating): added clarifying comments to Github generator example by @nielstenboom in #5248
feat(release): add new workflow to label first time contributor issues by @mouhsen-ibrahim in #5243
feat(security): Adds an option to make HTTP2 configurable by @siddhibhor-56 in #5231
feat: add retry for onepassword on authorization error by @Skarlso in #5253
fix: handle namespace deletion race conditions with finalizers by @framsouza in #5154
docs: update stability and support by @anders-swanson in #5257
fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by @kgal-akl in #5263
feat: support Pod Identity authentication for Vault Provider by @webstradev in #5201
feat: add domain field to secretserver provider by @rkferreira in #5258
chore(release): Migrate to actions/create-github-app-token action by @mouhsen-ibrahim in #5264
chore: just updating the crd conformance tests by @Skarlso in #5265
chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by @Skarlso in #5269
chore: azure sdk update by @hauswio in #5162
feat: add support for fetching Secret by Path on Delinea Secret Server provider by @DelineaSahilWankhede in #5270
feat: migrate from tibdex to actions/create-github-app-token by @rkferreira in #5286
fix: license headers across all Go files - standardize format, add missing copyright, fix typos by @Copilot in #5288
fix: the boilerplate was missing the right license format by @Skarlso in #5289
chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by @Copilot in #5290
chore(docs): remove GitHub Discussions references and update support channels by @jakobmoellerdev in #5292
docs: updated the ladder with two new tracks: documentation and community by @Skarlso in #5298
docs(release): create upgrading section by @rkferreira in #5310
docs: readme update for health of the project by @Skarlso in #5309
fix: validate namespace in secretRef by @moolen in #5311
docs: add burnout prevention strategies and mitigation policy document by @Skarlso in #5307
feat: add missing go sbom by @moolen in #5313
feat: make vault e2e tests run locally by @moolen in #5246
chore: update dependencies by @eso-service-account-app[bot] in #5324
feat: add Cloudsmith generator for container registry authentication by @cloudsmith-iduffy in #5267
feat: Add lgtm review automation step to ci workflows. by @webstradev in #5251
feat(provider): add Volcengine provider support by @kevinyancn in #5306
test: add more information to potentially flaky test by @Skarlso in #5330
fix(docs): Fix typo in controller options doc by @tspearconquest in #5299
chore(testing): Add licence.check make target by @jonstacks in #5335
docs(gitlab-variables): document environment scope fallback by @s1nyx in #5300

Dependencies

chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by @dependabot[bot] in #5190
chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by @dependabot[bot] in #5191
chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by @dependabot[bot] in #5189
chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in #5188
chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by @dependabot[bot] in #5187
chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by @dependabot[bot] in #5186
chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in #5184
chore(deps): bump golang from 1.24.6 to 1.25.0 by @dependabot[bot] in #5194
chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by @dependabot[bot] in #5195
chore(deps): bump ubi8/ubi from 4f0a4e4 to 7010e70 by @dependabot[bot] in #5193
chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by @dependabot[bot] in #5192
chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #5198
chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by @dependabot[bot] in #5199
chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by @dependabot[bot] in #5234
chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @dependabot[bot] in #5236
chore(deps): bump ubi8/ubi from 7010e70 to 534c2c0 by @dependabot[bot] in #5237
chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @dependabot[bot] in #5238
chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by @dependabot[bot] in #5242
chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by @dependabot[bot] in #5241
chore(deps): bump distroless/static from 2e114d2 to f2ff10a by @dependabot[bot] in #5240
chore(deps): bump golang from 1.25.0 to 1.25.1 by @dependabot[bot] in #5275
chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in #5274
chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by @dependabot[bot] in #5273
chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #5276
chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by @dependabot[bot] in #5279
chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in #5278
chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by @dependabot[bot] in #5277
chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by @dependabot[bot] in #5281
chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by @dependabot[bot] in #5280
chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by @dependabot[bot] in #5282
chore(deps): bump golang from b6ed3fd to b6ed3fd by @dependabot[bot] in #5318
chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by @dependabot[bot] in #5317
chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by @dependabot[bot] in #5319
chore(deps): bump distroless/static from f2ff10a to 87bce11 by @dependabot[bot] in #5320
chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by @dependabot[bot] in #5323
chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @dependabot[bot] in #5321
chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @dependabot[bot] in #5322
chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @dependabot[bot] in #5339
chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by @dependabot[bot] in #5344
chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by @dependabot[bot] in #5345
chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #5343
chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @dependabot[bot] in #5340
chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 by @dependabot[bot] in #5341
chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs by @dependabot[bot] in #5346
chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by @dependabot[bot] in #5342

New Contributors

@mjtrangoni made their first contribution in #5139
@muckelba made their first contribution in #5146
@DrummyFloyd made their first contribution in #5144
@sriaradhyula made their first contribution in #5159
@jonstacks made their first contribution in #5161
@matheusmazzoni made their first contribution in #5155
@nirajsapkota made their first contribution in #4878
@L1ghtman2k made their first contribution in #5138
@gecube made their first contribution in #5171
@preved911 made their first contribution in #4877
@ntnn made their first contribution in #5156
@webstradev made their first contribution in #5197
@rkferreira made their first contribution in #5169
@arthlr made their first contribution in #5217
@devnopt made their first contribution in #4875
@dakotaharden made their first contribution in #5247
@bharath-b-rh made their first contribution in #4654
@alliseeisgold made their first contribution in #5022
@nielstenboom made their first contribution in #5248
@siddhibhor-56 made their first contribution in #5231
@framsouza made their first contribution in #5154
@kgal-akl made their first contribution in #5263
@hauswio made their first contribution in #5162
@Copilot made their first contribution in #5288
@cloudsmith-iduffy made their first contribution in #5267
@kevinyancn made their first contribution in #5306
@s1nyx made their first contribution in #5300

Full Changelog: external-secrets/external-secrets@v0.19.2...v0.20.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

…l-secrets ( 0.19.2 ➔ 0.20.1 )

unsc-oni-ancilla · 2025-09-22T13:16:16Z

--- kubernetes/apps/external-secrets/external-secrets/app Kustomization: external-secrets/external-secrets OCIRepository: external-secrets/external-secrets

+++ kubernetes/apps/external-secrets/external-secrets/app Kustomization: external-secrets/external-secrets OCIRepository: external-secrets/external-secrets

@@ -11,9 +11,9 @@

 spec:
   interval: 5m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.19.2
+    tag: 0.20.1
   url: oci://ghcr.io/external-secrets/charts/external-secrets

unsc-oni-ancilla · 2025-09-22T13:16:18Z

--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

@@ -60,12 +60,13 @@

   - delete
   - deletecollection
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
   - quayaccesstokens
@@ -87,12 +88,19 @@

   - serviceaccounts
   - namespaces
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - ''
+  resources:
+  - namespaces
+  verbs:
+  - update
+  - patch
 - apiGroups:
   - ''
   resources:
   - configmaps
   verbs:
   - get
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

@@ -24,12 +24,13 @@

   - watch
   - list
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
   - quayaccesstokens
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

@@ -25,12 +25,13 @@

   - patch
   - update
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
   - quayaccesstokens
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v0.19.2
+        image: ghcr.io/external-secrets/external-secrets:v0.20.1
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v0.19.2
+        image: ghcr.io/external-secrets/external-secrets:v0.20.1
         imagePullPolicy: IfNotPresent
         args:
         - --enable-leader-election=true
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v0.19.2
+        image: ghcr.io/external-secrets/external-secrets:v0.20.1
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs

feat(container): update image ghcr.io/external-secrets/charts/externa…

e892a4d

…l-secrets ( 0.19.2 ➔ 0.20.1 )

unsc-oni-ancilla bot added renovate/container type/minor area/kubernetes Changes made in the kubernetes directory area/bootstrap labels Sep 22, 2025

binaryn3xus merged commit f093afb into main Sep 24, 2025
11 checks passed

binaryn3xus deleted the renovate/ghcr.io-external-secrets-charts-external-secrets-0.x branch September 24, 2025 15:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat(container): update image ghcr.io/external-secrets/charts/external-secrets ( 0.19.2 ➔ 0.20.1 )#3377

feat(container): update image ghcr.io/external-secrets/charts/external-secrets ( 0.19.2 ➔ 0.20.1 )#3377
binaryn3xus merged 1 commit intomainfrom
renovate/ghcr.io-external-secrets-charts-external-secrets-0.x

unsc-oni-ancilla bot commented Sep 22, 2025

Uh oh!

unsc-oni-ancilla bot commented Sep 22, 2025

Uh oh!

unsc-oni-ancilla bot commented Sep 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

Conversation

unsc-oni-ancilla bot commented Sep 22, 2025

Release Notes

v0.20.1

What's Changed

General

Dependencies

New Contributors

Configuration

Uh oh!

unsc-oni-ancilla bot commented Sep 22, 2025

Uh oh!

unsc-oni-ancilla bot commented Sep 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v0.20.1`