Update image ghcr.io/external-secrets/charts/external-secrets (2.7.0 ➔ 2.8.0)

[mav-bot]

This PR contains the following updates:

Package	Update	Change
ghcr.io/external-secrets/charts/external-secrets	minor	2.7.0 → 2.8.0

---

Release Notes

external-secrets/external-secrets (ghcr.io/external-secrets/charts/external-secrets)

v2.8.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.7.0 by @​Skarlso in #​6529
• docs(barbican): correct find semantics and document property/extract by @​alekc in #​6531
• docs(gcp): use external-secrets.io/v1 in SecretStore examples by @​alekc in #​6563
• feat(generators): add GitLab deploy token generator by @​alekc in #​6493
• fix(barbican): validate store config and fix SecretExists error message by @​alekc in #​6534
• docs(beyondtrust): fix capability matrix and document decrypt/separator by @​alekc in #​6535
• feat: Make SecondsToLive optional for Grafana generator by @​jaruwat-panturat in #​6479
• docs: add missing generators to ClusterGenerator spec snippet by @​jaruwat-panturat in #​6590
• docs(doppler): fix download format list and heading levels by @​alekc in #​6559
• docs(fortanix): add to support matrix and tidy provider page by @​alekc in #​6562
• docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @​alekc in #​6585
• docs(volcengine): mark referent authentication as supported by @​alekc in #​6584
• docs(senhasegura): mark deletion + referent in matrix and fix title by @​alekc in #​6583
• docs(scaleway): mark referent auth in matrix and fix headings by @​alekc in #​6581
• docs(pulumi): correct find/referent matrix cells and fix headings by @​alekc in #​6578
• docs(previder): correct find/referent matrix cells and fix headings by @​alekc in #​6577
• docs(1password): mark SDK find support in matrix and promote titles by @​alekc in #​6568
• feat(charts): Add aggregateToAdmin toggle by @​illrill in #​6586
• docs(providers): consolidate 11 conflicting provider-doc PRs by @​alekc in #​6592
• feat(charts): add startupProbe support to webhook deployment by @​alpcanaydin in #​6612
• feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @​baraka-akeyless in #​6530
• docs(kubernetes): fix invalid tab indentation and heading levels by @​alekc in #​6565
• docs(dvls): mark DeletionPolicy supported and fix page title by @​alekc in #​6557
• docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @​alekc in #​6551
• docs(github): add to support matrix, fix auth field, tidy page by @​alekc in #​6564
• docs: Improve explanations of pem_chain by @​evrardjp in #​6623
• feat: Make our stance regarding AI usage more explicit. by @​evrardj-roche in #​6621
• fix(barbican): treat find.name.regexp as a regexp, not an exact match by @​arpitjain099 in #​6614
• chore: update go version 1.26.5 - Fix CVE-2026-39822 by @​alekc in #​6631
• ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @​alekc in #​6634
• chore: updating ok-to-test to allow interim maintainers by @​gusfcarvalho in #​6638
• fix(onepassword): support PushSecret IfNotExists by @​civilizedBaboon in #​6646
• fix(testing): check out PR head in fork e2e instead of main by @​alekc in #​6647
• fix(secretserver): validate store and map fields correctly by @​dbinger in #​6616
• feat(charts): Add optional networkPolicy by @​jcpunk in #​5779
• feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @​baraka-akeyless in #​6507
• feat(provider): implement AWS Certificate Manager provider by @​dsp0x4 in #​6117
• feat: expose more values for custom metadata for vault v2 by @​Skarlso in #​6652
• clean: Remove duplicate code by @​evrardj-roche in #​6629
• feat: configurable leader election lease timings by @​izz-linux in #​6644
• fix(akeyless): support dataFrom.extract.property for nested JSON by @​baraka-akeyless in #​6633
• feat(conjur): Certificate Auth support by @​hdabrowski in #​6393
• docs(aws): restore dropped access section and document missing fields by @​alekc in #​6517
• feat(secretserver): support authentication via access token by @​sumanpal97 in #​6597
• docs(secretserver): document authentication, key formats, property behavior, and limitations by @​dbinger in #​6619
• feat(release): Support reading values from kubernetes CRD by @​alekc in #​6211
• clean: Standardize and friendly name for validations policies by @​evrardj-roche in #​6630
• feat: add CreateOrMerge creation policy for ExternalSecrets by @​alekc in #​6641
• feat(core): accept duration string for SecretStore refreshInterval by @​alekc in #​6594
• fix(beyondtrust): validate store without panicking on API key auth by @​emmayusufu in #​6553
• fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @​Ashutosh-3601 in #​6421

Dependencies

• chore(deps): bump golang from 3ad5730 to 3ad5730 by @​dependabot[bot] in #​6538
• chore(deps): bump ubi9/ubi from 1b99266 to 37a1589 by @​dependabot[bot] in #​6537
• chore(deps): bump golang from 5f68ec6 to b305420 in /e2e by @​dependabot[bot] in #​6539
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​6540
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @​dependabot[bot] in #​6542
• chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @​dependabot[bot] in #​6543
• chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @​dependabot[bot] in #​6544
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​6541
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @​dependabot[bot] in #​6545
• chore(deps): bump golang from 3ad5730 to 3ad5730 by @​dependabot[bot] in #​6600
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6606
• chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6603
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @​dependabot[bot] in #​6607
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @​dependabot[bot] in #​6604
• chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @​dependabot[bot] in #​6608
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @​dependabot[bot] in #​6605
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in #​6602
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @​dependabot[bot] in #​6601
• chore(deps): bump ubi9/ubi from 37a1589 to 8bf0e8f by @​dependabot[bot] in #​6599
• chore(deps): bump golang from 1.26.4 to 1.26.5 by @​dependabot[bot] in #​6636
• chore(deps): bump distroless/static from 3592aa8 to d5f030c by @​dependabot[bot] in #​6635

New Contributors

• @​alpcanaydin made their first contribution in #​6612
• @​baraka-akeyless made their first contribution in #​6530
• @​arpitjain099 made their first contribution in #​6614
• @​civilizedBaboon made their first contribution in #​6646
• @​dbinger made their first contribution in #​6616
• @​dsp0x4 made their first contribution in #​6117
• @​izz-linux made their first contribution in #​6644
• @​hdabrowski made their first contribution in #​6393
• @​sumanpal97 made their first contribution in #​6597
• @​emmayusufu made their first contribution in #​6553
• @​Ashutosh-3601 made their first contribution in #​6421

Full Changelog: external-secrets/external-secrets@v2.7.0...v2.8.0

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[mav-bot]

konflate — summary

Note

+1 added · 15 changed · −0 removed — 16 resources · 2 apps · 9 CRDs

Image changes

image	from	to
ghcr.io/external-secrets/external-secrets	v2.7.0	v2.8.0

_{konflate · rendered 75f7aa7 · advisory, not a gate}

[mav-bot]

HelmRelease diff

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-controller
! - one list entry removed:
- - resources:
-   - acraccesstokens
-   - cloudsmithaccesstokens
-   - clustergenerators
-   - ecrauthorizationtokens
-   - fakes
-   - gcraccesstokens
-   - githubaccesstokens
-   - quayaccesstokens
-   - passwords
-   - sshkeys
-   - stssessiontokens
-   - uuids
-   - vaultdynamicsecrets
-   - webhooks
-   - grafanas
-   - mfas
-   - beyondtrustworkloadcredentialsdynamicsecrets
-   apiGroups:
-   - generators.external-secrets.io
-   verbs:
-   - get
-   - list
-   - watch
! + one list entry added:
+ - resources:
+   - acraccesstokens
+   - cloudsmithaccesstokens
+   - clustergenerators
+   - ecrauthorizationtokens
+   - fakes
+   - gcraccesstokens
+   - githubaccesstokens
+   - gitlabdeploytokens
+   - quayaccesstokens
+   - passwords
+   - sshkeys
+   - stssessiontokens
+   - uuids
+   - vaultdynamicsecrets
+   - webhooks
+   - grafanas
+   - mfas
+   - beyondtrustworkloadcredentialsdynamicsecrets
+   apiGroups:
+   - generators.external-secrets.io
+   verbs:
+   - get
+   - list
+   - watch

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-view
! - one list entry removed:
- - resources:
-   - acraccesstokens
-   - beyondtrustworkloadcredentialsdynamicsecrets
-   - cloudsmithaccesstokens
-   - clustergenerators
-   - ecrauthorizationtokens
-   - fakes
-   - gcraccesstokens
-   - githubaccesstokens
-   - quayaccesstokens
-   - passwords
-   - sshkeys
-   - vaultdynamicsecrets
-   - webhooks
-   - grafanas
-   - generatorstates
-   - mfas
-   - uuids
-   apiGroups:
-   - generators.external-secrets.io
-   verbs:
-   - get
-   - watch
-   - list
! + one list entry added:
+ - resources:
+   - acraccesstokens
+   - beyondtrustworkloadcredentialsdynamicsecrets
+   - cloudsmithaccesstokens
+   - clustergenerators
+   - ecrauthorizationtokens
+   - fakes
+   - gcraccesstokens
+   - githubaccesstokens
+   - gitlabdeploytokens
+   - quayaccesstokens
+   - passwords
+   - sshkeys
+   - vaultdynamicsecrets
+   - webhooks
+   - grafanas
+   - generatorstates
+   - mfas
+   - uuids
+   apiGroups:
+   - generators.external-secrets.io
+   verbs:
+   - get
+   - watch
+   - list

@@ rules @@
# rbac.authorization.k8s.io/v1/ClusterRole/external-secrets-edit
! - one list entry removed:
- - resources:
-   - acraccesstokens
-   - cloudsmithaccesstokens
-   - clustergenerators
-   - ecrauthorizationtokens
-   - fakes
-   - gcraccesstokens
-   - githubaccesstokens
-   - quayaccesstokens
-   - passwords
-   - sshkeys
-   - vaultdynamicsecrets
-   - webhooks
-   - grafanas
-   - generatorstates
-   - mfas
-   - beyondtrustworkloadcredentialsdynamicsecrets
-   - uuids
-   apiGroups:
-   - generators.external-secrets.io
-   verbs:
-   - create
-   - delete
-   - deletecollection
-   - patch
-   - update
! + one list entry added:
+ - resources:
+   - acraccesstokens
+   - cloudsmithaccesstokens
+   - clustergenerators
+   - ecrauthorizationtokens
+   - fakes
+   - gcraccesstokens
+   - githubaccesstokens
+   - gitlabdeploytokens
+   - quayaccesstokens
+   - passwords
+   - sshkeys
+   - vaultdynamicsecrets
+   - webhooks
+   - grafanas
+   - generatorstates
+   - mfas
+   - beyondtrustworkloadcredentialsdynamicsecrets
+   - uuids
+   apiGroups:
+   - generators.external-secrets.io
+   verbs:
+   - create
+   - delete
+   - deletecollection
+   - patch
+   - update

@@ spec.template.spec.containers.cert-controller.image @@
# apps/v1/Deployment/security/external-secrets-cert-controller
! ± value change
- ghcr.io/external-secrets/external-secrets:v2.7.0
+ ghcr.io/external-secrets/external-secrets:v2.8.0

@@ spec.template.spec.containers.external-secrets.image @@
# apps/v1/Deployment/security/external-secrets
! ± value change
- ghcr.io/external-secrets/external-secrets:v2.7.0
+ ghcr.io/external-secrets/external-secrets:v2.8.0

@@ spec.template.spec.containers.webhook.image @@
# apps/v1/Deployment/security/external-secrets-webhook
! ± value change
- ghcr.io/external-secrets/external-secrets:v2.7.0
+ ghcr.io/external-secrets/external-secrets:v2.8.0

_{Generated for 75f7aa7 · workflow run}

[mav-bot]

Kustomization diff

@@ spec.ref.tag @@
# source.toolkit.fluxcd.io/v1/OCIRepository/security/external-secrets
! ± value change
- 2.7.0
+ 2.8.0

_{Generated for 75f7aa7 · workflow run}