feat(container): update image ghcr.io/external-secrets/charts/external-secrets ( 2.5.0 → 2.7.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/external-secrets/charts/external-secrets	minor	2.5.0 → 2.7.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)

v2.7.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.7.0
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.7.0-ubi-boringssl

What's Changed

General

• chore: release helm charts 2.6.0 by @​Skarlso in #​6427
• test: add Infisical provider e2e suite by @​alekc in #​6415
• docs: fix discrepancies and add missing documentation for GitLab provider by @​alekc in #​6430
• docs: fix discrepancies and add missing documentation for Infisical provider by @​alekc in #​6431
• feat(templating): add hexdec function by @​tstenner in #​6422
• fix(volcengine): honor secretRef.namespace for ClusterSecretStore by @​ruslan-rm in #​6423
• docs(core): correct CRD examples and document missing fields by @​alekc in #​6441
• feat(provider): initial dedicated OpenBao provider by @​phil9909 in #​6405
• feat(onepasswordsdk): implement GetAllSecrets by @​calebmckay in #​6445
• feat(controller): log secret deletions and data-key changes by @​alekc in #​6443
• feat: Add BeyondTrust WorkloadCredentials provider by @​sdahal-bt in #​5999
• fix(charts): truncate component names to stay within 63-char DNS limit by @​alekc in #​6428
• docs(gitops-fluxcd): fix webhook race condition in Flux deployment guide by @​alekc in #​6455
• fix: no need for the field to have a default if it can be omitted by @​knelasevero in #​6453
• fix(templating): preserve mixed-case in generic target paths by @​alekc in #​6459
• docs(generator): document Password secretKeys for multiple keys by @​alekc in #​6440
• docs: Update deprecated field in docs by @​evrardj-roche in #​6456
• chore(deps): Bump passbolt SDK to v0.8.0 by @​cedricherzog-passbolt in #​6447
• chore(charts): Expose storeRequeueInterval in helm charts by @​jfhcagip in #​6140
• feat(openbao): support custom CAs via caBundle and caProvider by @​phil9909 in #​6461
• feat(ngrok): use API filtering for vault and secret lookups by @​jonstacks in #​6376
• fix: remove broken link from blog section by @​riccardomc in #​6465
• chore: fix the template parser for resolving slice notations by @​Skarlso in #​6449
• fix: bump docs deps for python3.13 by @​evrardj-roche in #​6475
• fix(kubernetes): replace entire remote secret when pushing rather than merging by @​riccardomc in #​6485
• feat(infisical): return NoSecretErr on 404 and add PushSecret support by @​alekc in #​6434
• feat(AWS): add replicationLocations to AWS SecretsManager provider by @​cmoscofian in #​6451
• feat(openbao): add auth.userPass auth method by @​phil9909 in #​6492
• chore(deps): Bump github.com/pulumi/esc-sdk/sdk to v0.14.0 by @​phil9909 in #​6495
• chore(onepasswordsdk): fix the caching logic and cleanup the code a bit by @​Skarlso in #​6466
• feat(charts): scope cert-controller RBAC to managed CRDs and webhook secret by @​somaz94 in #​6481
• test(ngrok): Remove over complicated mocks by @​jonstacks in #​6483
• chore: Unpin mike by @​evrardj-roche in #​6477
• docs(akeyless): fix errors and expand provider documentation by @​alekc in #​6506
• chore: update go sys net and crypto libs by @​Skarlso in #​6511
• chore(onepasswordsdk): enable the GetAllSecrets and GetSecret unit test and fix it by @​Skarlso in #​6513
• feat(infisical): allow organization slug to be set in secret scope by @​mathnogueira in #​6508
• feat(templating): decode templateFrom values by @​evrardj-roche in #​6482
• chore(bug): fix missing lgtm runner script from the workflow by @​Skarlso in #​6512
• fix(akeyless): return ReadWrite so PushSecret is routed by @​alekc in #​6515
• feat(openbao): add auth.appRole auth method by @​phil9909 in #​6497
• feat(externalsecret): add SyncWindows to gate periodic refresh by @​alekc in #​6452
• docs(azure): correct Azure Stack example version and note expiry limit by @​alekc in #​6522
• feat(openbao): add support for OpenBao Namespaces by @​phil9909 in #​6527
• fix(github): preserve selected repositories on org secret update by @​alekc in #​6519
• docs(azure): list WorkloadIdentity in authType field description by @​alekc in #​6523
• feat(doppler): include HTTP status in API errors by @​alekc in #​6489

Dependencies

• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​6437
• chore(deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @​dependabot[bot] in #​6438
• chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 by @​dependabot[bot] in #​6435
• chore(deps): bump idna from 3.17 to 3.18 in /hack/api-docs by @​dependabot[bot] in #​6439
• chore(deps): bump ubi9/ubi from 8942b73 to 46d19c1 by @​dependabot[bot] in #​6436
• chore(deps): bump platformdirs from 4.9.6 to 4.10.0 in /hack/api-docs by @​dependabot[bot] in #​6410
• chore(deps): bump golang from f23e8b2 to 7a3e500 by @​dependabot[bot] in #​6468
• chore(deps): bump golang from 5d2b868 to 5f68ec6 in /e2e by @​dependabot[bot] in #​6471
• chore(deps): bump tornado from 6.5.6 to 6.5.7 in /hack/api-docs by @​dependabot[bot] in #​6473
• chore(deps): bump alpine from 3.23.4 to 3.24.0 in /e2e by @​dependabot[bot] in #​6470
• chore(deps): bump alpine from 5b10f43 to a2d49ea by @​dependabot[bot] in #​6469
• chore(deps): bump ubi9/ubi from 46d19c1 to 1b99266 by @​dependabot[bot] in #​6467
• chore(deps): bump alpine from a2d49ea to 28bd5fe in /hack/api-docs by @​dependabot[bot] in #​6472
• chore(deps): bump alpine from 3.24.0 to 3.24.1 in /e2e by @​dependabot[bot] in #​6498
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​6500
• chore(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​6502
• chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​6503
• chore(deps): bump alpine from a2d49ea to 28bd5fe by @​dependabot[bot] in #​6499
• chore(deps): bump golang from 7a3e500 to 3ad5730 by @​dependabot[bot] in #​6501

New Contributors

• @​tstenner made their first contribution in #​6422
• @​ruslan-rm made their first contribution in #​6423
• @​calebmckay made their first contribution in #​6445
• @​sdahal-bt made their first contribution in #​5999
• @​jfhcagip made their first contribution in #​6140
• @​somaz94 made their first contribution in #​6481
• @​mathnogueira made their first contribution in #​6508

Full Changelog: external-secrets/external-secrets@v2.6.0...v2.7.0

v2.6.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.6.0
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.6.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.5.0 by @​Skarlso in #​6352
• feat(keeper): implement provider_api_calls_count metric by @​m-k8s in #​6345
• docs(gcpsm): updates Google Secret Manager authentication guide with WIF usage by @​bharath-b-rh in #​6356
• feat(release): PB-51302 - External secret should support v5-custom-fields resource type by @​cedricherzog-passbolt in #​6377
• feat(testing): OpenBao e2e test by @​phil9909 in #​6396
• docs: Explanation of our labels by @​evrardj-roche in #​6306
• docs: add AGENTS.md and AI setup guide for ESO by @​rowanruseler in #​6141
• fix(makefile): clean up cross-submodule go.mod churn after make test by @​alekc in #​6378
• fix(provider): align TokenRequest body namespace with URL namespace by @​alekc in #​6420
• fix(build): use buildx --load and non-registry image tag by @​alekc in #​6419
• fix(charts): render PDB spec when minAvailable or maxUnavailable is zero by @​blindrood in #​6360
• chore: update go version 1.26.4 by @​Skarlso in #​6426

Dependencies

• chore(deps): bump golang from 91eda97 to 91eda97 by @​dependabot[bot] in #​6363
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /hack/api-docs by @​dependabot[bot] in #​6370
• chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​6364
• chore(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @​dependabot[bot] in #​6365
• chore(deps): bump step-security/harden-runner from 2.19.1 to 2.19.4 by @​dependabot[bot] in #​6366
• chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 by @​dependabot[bot] in #​6368
• chore(deps): bump distroless/static from 47b2d72 to 3592aa8 by @​dependabot[bot] in #​6362
• chore(deps): bump ubi9/ubi from 2323fcf to 151fc1b by @​dependabot[bot] in #​6361
• chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @​dependabot[bot] in #​6367
• chore(deps): bump idna from 3.14 to 3.16 in /hack/api-docs by @​dependabot[bot] in #​6369
• chore(deps): bump golang from 91eda97 to 91eda97 by @​dependabot[bot] in #​6383
• chore(deps): bump golang from 252599a to 386d475 in /e2e by @​dependabot[bot] in #​6389
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @​dependabot[bot] in #​6384
• chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​6387
• chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6386
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​6388
• chore(deps): bump zipp from 3.23.1 to 4.1.0 in /hack/api-docs by @​dependabot[bot] in #​6390
• chore(deps): bump click from 8.3.3 to 8.4.1 in /hack/api-docs by @​dependabot[bot] in #​6391
• chore(deps): bump certifi from 2026.4.22 to 2026.5.20 in /hack/api-docs by @​dependabot[bot] in #​6392
• chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6385
• chore(deps): bump requests from 2.33.1 to 2.34.2 in /hack/api-docs by @​dependabot[bot] in #​6372
• chore(deps): bump tornado from 6.5.5 to 6.5.6 in /hack/api-docs by @​dependabot[bot] in #​6412
• chore(deps): bump ubi9/ubi from 151fc1b to 8942b73 by @​dependabot[bot] in #​6407
• chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 by @​dependabot[bot] in #​6408
• chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​6409
• chore(deps): bump idna from 3.16 to 3.17 in /hack/api-docs by @​dependabot[bot] in #​6411

New Contributors

• @​m-k8s made their first contribution in #​6345
• @​phil9909 made their first contribution in #​6396
• @​blindrood made their first contribution in #​6360

Full Changelog: external-secrets/external-secrets@v2.5.0...v2.6.0

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[igloo-bot]

--- kubernetes/apps/external-secrets/external-secrets/app Kustomization: external-secrets/external-secrets OCIRepository: external-secrets/external-secrets

+++ kubernetes/apps/external-secrets/external-secrets/app Kustomization: external-secrets/external-secrets OCIRepository: external-secrets/external-secrets

@@ -11,9 +11,9 @@

 spec:
   interval: 5m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 2.5.0
+    tag: 2.7.0
   url: oci://ghcr.io/external-secrets/charts/external-secrets
 

[igloo-bot]

--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-cert-controller

@@ -13,12 +13,21 @@

   resources:
   - customresourcedefinitions
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  resourceNames:
+  - externalsecrets.external-secrets.io
+  - secretstores.external-secrets.io
+  - clustersecretstores.external-secrets.io
+  verbs:
   - update
   - patch
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - validatingwebhookconfigurations
@@ -64,12 +73,19 @@

   resources:
   - secrets
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  resourceNames:
+  - external-secrets-webhook
+  verbs:
   - update
   - patch
 - apiGroups:
   - coordination.k8s.io
   resources:
   - leases
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-controller

@@ -75,12 +75,13 @@

   - stssessiontokens
   - uuids
   - vaultdynamicsecrets
   - webhooks
   - grafanas
   - mfas
+  - beyondtrustworkloadcredentialsdynamicsecrets
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-view

@@ -24,12 +24,13 @@

   - watch
   - list
 - apiGroups:
   - generators.external-secrets.io
   resources:
   - acraccesstokens
+  - beyondtrustworkloadcredentialsdynamicsecrets
   - cloudsmithaccesstokens
   - clustergenerators
   - ecrauthorizationtokens
   - fakes
   - gcraccesstokens
   - githubaccesstokens
--- HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

+++ HelmRelease: external-secrets/external-secrets ClusterRole: external-secrets/external-secrets-edit

@@ -39,12 +39,13 @@

   - sshkeys
   - vaultdynamicsecrets
   - webhooks
   - grafanas
   - generatorstates
   - mfas
+  - beyondtrustworkloadcredentialsdynamicsecrets
   - uuids
   verbs:
   - create
   - delete
   - deletecollection
   - patch
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-cert-controller

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.5.0
+        image: ghcr.io/external-secrets/external-secrets:v2.7.0
         imagePullPolicy: IfNotPresent
         args:
         - certcontroller
         - --crd-requeue-interval=5m
         - --service-name=external-secrets-webhook
         - --service-namespace=external-secrets
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.5.0
+        image: ghcr.io/external-secrets/external-secrets:v2.7.0
         imagePullPolicy: IfNotPresent
         args:
         - --enable-leader-election=true
         - --concurrent=1
         - --metrics-addr=:8080
         - --loglevel=info
--- HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

+++ HelmRelease: external-secrets/external-secrets Deployment: external-secrets/external-secrets-webhook

@@ -34,13 +34,13 @@

             - ALL
           readOnlyRootFilesystem: true
           runAsNonRoot: true
           runAsUser: 1000
           seccompProfile:
             type: RuntimeDefault
-        image: ghcr.io/external-secrets/external-secrets:v2.5.0
+        image: ghcr.io/external-secrets/external-secrets:v2.7.0
         imagePullPolicy: IfNotPresent
         args:
         - webhook
         - --port=10250
         - --dns-name=external-secrets-webhook.external-secrets.svc
         - --cert-dir=/tmp/certs