feat(helm): update external-secrets ( 0.14.3 → 0.16.1 ) #731
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
--- kubernetes/apps/cluster-system/external-secrets/external-secrets/app Kustomization: flux-system/external-secrets HelmRelease: cluster-system/external-secrets
+++ kubernetes/apps/cluster-system/external-secrets/external-secrets/app Kustomization: flux-system/external-secrets HelmRelease: cluster-system/external-secrets
@@ -13,13 +13,13 @@
spec:
chart: external-secrets
sourceRef:
kind: HelmRepository
name: external-secrets
namespace: flux-system
- version: 0.14.3
+ version: 0.16.1
install:
remediation:
retries: 3
interval: 30m
upgrade:
cleanupOnFail: true |
--- HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-controller
+++ HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-controller
@@ -13,12 +13,13 @@
resources:
- secretstores
- clustersecretstores
- externalsecrets
- clusterexternalsecrets
- pushsecrets
+ - clusterpushsecrets
verbs:
- get
- list
- watch
- apiGroups:
- external-secrets.io
@@ -35,12 +36,15 @@
- clusterexternalsecrets
- clusterexternalsecrets/status
- clusterexternalsecrets/finalizers
- pushsecrets
- pushsecrets/status
- pushsecrets/finalizers
+ - clusterpushsecrets
+ - clusterpushsecrets/status
+ - clusterpushsecrets/finalizers
verbs:
- get
- update
- patch
- apiGroups:
- generators.external-secrets.io
@@ -122,7 +126,15 @@
resources:
- externalsecrets
verbs:
- create
- update
- delete
+- apiGroups:
+ - external-secrets.io
+ resources:
+ - pushsecrets
+ verbs:
+ - create
+ - update
+ - delete
--- HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-view
+++ HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-view
@@ -15,12 +15,13 @@
- external-secrets.io
resources:
- externalsecrets
- secretstores
- clustersecretstores
- pushsecrets
+ - clusterpushsecrets
verbs:
- get
- watch
- list
- apiGroups:
- generators.external-secrets.io
--- HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-edit
+++ HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-edit
@@ -14,12 +14,13 @@
- external-secrets.io
resources:
- externalsecrets
- secretstores
- clustersecretstores
- pushsecrets
+ - clusterpushsecrets
verbs:
- create
- delete
- deletecollection
- patch
- update
--- HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-servicebindings
+++ HelmRelease: cluster-system/external-secrets ClusterRole: cluster-system/external-secrets-servicebindings
@@ -10,11 +10,12 @@
app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
- external-secrets.io
resources:
- externalsecrets
+ - pushsecrets
verbs:
- get
- list
- watch
--- HelmRelease: cluster-system/external-secrets Deployment: cluster-system/external-secrets-cert-controller
+++ HelmRelease: cluster-system/external-secrets Deployment: cluster-system/external-secrets-cert-controller
@@ -34,13 +34,13 @@
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
- image: ghcr.io/external-secrets/external-secrets:v0.14.3
+ image: ghcr.io/external-secrets/external-secrets:v0.16.1
imagePullPolicy: IfNotPresent
args:
- certcontroller
- --crd-requeue-interval=5m
- --service-name=external-secrets-webhook
- --service-namespace=cluster-system
--- HelmRelease: cluster-system/external-secrets Deployment: cluster-system/external-secrets
+++ HelmRelease: cluster-system/external-secrets Deployment: cluster-system/external-secrets
@@ -34,13 +34,13 @@
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
- image: ghcr.io/external-secrets/external-secrets:v0.14.3
+ image: ghcr.io/external-secrets/external-secrets:v0.16.1
imagePullPolicy: IfNotPresent
args:
- --concurrent=1
- --metrics-addr=:8080
- --loglevel=info
- --zap-time-encoding=epoch
--- HelmRelease: cluster-system/external-secrets Deployment: cluster-system/external-secrets-webhook
+++ HelmRelease: cluster-system/external-secrets Deployment: cluster-system/external-secrets-webhook
@@ -34,13 +34,13 @@
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
- image: ghcr.io/external-secrets/external-secrets:v0.14.3
+ image: ghcr.io/external-secrets/external-secrets:v0.16.1
imagePullPolicy: IfNotPresent
args:
- webhook
- --port=10250
- --dns-name=external-secrets-webhook.cluster-system.svc
- --cert-dir=/tmp/certs
--- HelmRelease: cluster-system/external-secrets ValidatingWebhookConfiguration: cluster-system/secretstore-validate
+++ HelmRelease: cluster-system/external-secrets ValidatingWebhookConfiguration: cluster-system/secretstore-validate
@@ -11,48 +11,48 @@
webhooks:
- name: validate.secretstore.external-secrets.io
rules:
- apiGroups:
- external-secrets.io
apiVersions:
- - v1beta1
+ - v1
operations:
- CREATE
- UPDATE
- DELETE
resources:
- secretstores
scope: Namespaced
clientConfig:
service:
namespace: cluster-system
name: external-secrets-webhook
- path: /validate-external-secrets-io-v1beta1-secretstore
+ path: /validate-external-secrets-io-v1-secretstore
admissionReviewVersions:
- v1
- v1beta1
sideEffects: None
timeoutSeconds: 5
- name: validate.clustersecretstore.external-secrets.io
rules:
- apiGroups:
- external-secrets.io
apiVersions:
- - v1beta1
+ - v1
operations:
- CREATE
- UPDATE
- DELETE
resources:
- clustersecretstores
scope: Cluster
clientConfig:
service:
namespace: cluster-system
name: external-secrets-webhook
- path: /validate-external-secrets-io-v1beta1-clustersecretstore
+ path: /validate-external-secrets-io-v1-clustersecretstore
admissionReviewVersions:
- v1
- v1beta1
sideEffects: None
timeoutSeconds: 5
--- HelmRelease: cluster-system/external-secrets ValidatingWebhookConfiguration: cluster-system/externalsecret-validate
+++ HelmRelease: cluster-system/external-secrets ValidatingWebhookConfiguration: cluster-system/externalsecret-validate
@@ -11,25 +11,25 @@
webhooks:
- name: validate.externalsecret.external-secrets.io
rules:
- apiGroups:
- external-secrets.io
apiVersions:
- - v1beta1
+ - v1
operations:
- CREATE
- UPDATE
- DELETE
resources:
- externalsecrets
scope: Namespaced
clientConfig:
service:
namespace: cluster-system
name: external-secrets-webhook
- path: /validate-external-secrets-io-v1beta1-externalsecret
+ path: /validate-external-secrets-io-v1-externalsecret
admissionReviewVersions:
- v1
- v1beta1
sideEffects: None
timeoutSeconds: 5
failurePolicy: Fail |
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/external-secrets-0.x
branch
from
3bbdf1f to
d8fb1cd
Compare
renovate
bot
force-pushed
the
renovate/external-secrets-0.x
branch
from
d8fb1cd to
708d29d
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/external-secrets-0.x
branch
from
708d29d to
d492133
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.14.3->0.16.1Release Notes
external-secrets/external-secrets (external-secrets)
v0.16.1Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v0.16.1Image:
ghcr.io/external-secrets/external-secrets:v0.16.1-ubiImage:
ghcr.io/external-secrets/external-secrets:v0.16.1-ubi-boringsslWhat's Changed
Full Changelog: external-secrets/external-secrets@v0.16.0...v0.16.1
Guide to Promoting to 0.16
Pre Upgrade checks
Make sure you are not using any
v1alpha1resources across all of your infrastructure.You can do that by performing manual inspection on your manifests, tooling, etc.
Make sure there are no storedVersions on v1alpha1 for
externalsecrets,clusterexternalsecrets,secretstoresandclustersecretstorescrds:Run the following command:
If that command returns not safe, remove v1alpha1 from your stored versions. Make sure this status is persisted after you verify these commands.
Upgrading
CRDs as part of external-secrets installation
If you're installing external-secrets CRDs with helm (
installCRDs=true- the default), all you need to do isThe same goes if you're using argocd or flux and managing crds directly with helm. The above should just work.
CRDs installed separately
If CRDs are installed separately, the first step you need to do is bump the crds:
Verify no error occurs. After that, you can freely migrate external-secrets to
v0.16.1.Troubleshooting
conversion webhook for external-secrets.io/v1, Kind=ExternalSecret failed: the server could not find the requested resource
Root cause: the CRD installation process failed.
Double check your CRD installation process finished successfully
v0.16.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v0.16.0Image:
ghcr.io/external-secrets/external-secrets:v0.16.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v0.16.0-ubi-boringsslWhat's Changed
95ea148to3d0f463by @dependabot in https://github.com/external-secrets/external-secrets/pull/460275e6700to00eccd4in /e2e by @dependabot in https://github.com/external-secrets/external-secrets/pull/46447772cb5to7772cb5by @dependabot in https://github.com/external-secrets/external-secrets/pull/4649New Contributors
Full Changelog: external-secrets/external-secrets@v0.15.1...v0.16.0
v0.15.1Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v0.15.1Image:
ghcr.io/external-secrets/external-secrets:v0.15.1-ubiImage:
ghcr.io/external-secrets/external-secrets:v0.15.1-ubi-boringsslWhat's Changed
ClusterPushSecretreconciler when using scoped RBAC in helm chart by @mrsimo in https://github.com/external-secrets/external-secrets/pull/4571webhook.create: falsewarning comment by @thecosmicfrog in https://github.com/external-secrets/external-secrets/pull/45795993454to8bd1b63by @dependabot in https://github.com/external-secrets/external-secrets/pull/4581New Contributors
Full Changelog: external-secrets/external-secrets@v0.15.0...v0.15.1
v0.15.0Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v0.15.0Image:
ghcr.io/external-secrets/external-secrets:v0.15.0-ubiImage:
ghcr.io/external-secrets/external-secrets:v0.15.0-ubi-boringsslWhat's Changed
ecbeb81to5993454by @dependabot in https://github.com/external-secrets/external-secrets/pull/45533f2b64eto95ea148by @dependabot in https://github.com/external-secrets/external-secrets/pull/4554New Contributors
Full Changelog: external-secrets/external-secrets@v0.14.4...v0.15.0
v0.14.4Compare Source
Image:
ghcr.io/external-secrets/external-secrets:v0.14.4Image:
ghcr.io/external-secrets/external-secrets:v0.14.4-ubiImage:
ghcr.io/external-secrets/external-secrets:v0.14.4-ubi-boringsslWhat's Changed
881aaf5toecbeb81by @dependabot in https://github.com/external-secrets/external-secrets/pull/4496New Contributors
Full Changelog: external-secrets/external-secrets@v0.14.3...v0.14.4
Configuration
📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.