External Secrets Files

WARNING This release has been accidentally created as immutable, which causes us to not be able to push our usual manifest and provenance files in here. While the images are available and signed, we will publish a new version of the release (v0.20.1) to remediate this.

Image: ghcr.io/external-secrets/external-secrets:v0.20.0 Image: ghcr.io/external-secrets/external-secrets:v0.20.0-ubi Image: ghcr.io/external-secrets/external-secrets:v0.20.0-ubi-boringssl

What's Changed

General

• chore: release 0.19.2 by @moolen in https://github.com/external-secrets/external-secrets/pull/5136
• chore: update readme by @gusfcarvalho in https://github.com/external-secrets/external-secrets/pull/5137
• fix(kubernetes): make auth field optional by @mhrabovcin in https://github.com/external-secrets/external-secrets/pull/5064
• chore: Fix Markdown spelling issues found by codespell by @mjtrangoni in https://github.com/external-secrets/external-secrets/pull/5139
• Fix yaml codeblock for oracle-vault provider docs by @muckelba in https://github.com/external-secrets/external-secrets/pull/5146
• feat: add liveness probe to eso controller by @Skarlso in https://github.com/external-secrets/external-secrets/pull/4930
• fix(helm): add boolean for processClusterGenerator by @DrummyFloyd in https://github.com/external-secrets/external-secrets/pull/5144
• chore: add Cisco to ADOPTERS.md by @sriaradhyula in https://github.com/external-secrets/external-secrets/pull/5159
• docs: Fix provider stability and support table by @jonstacks in https://github.com/external-secrets/external-secrets/pull/5161
• feat(helm): Add control of response to missing prometheus CRDs by @jcpunk in https://github.com/external-secrets/external-secrets/pull/5087
• chore: Added release notes configuration by @bonddim in https://github.com/external-secrets/external-secrets/pull/5148
• chore: bump bitwarden helm chart version by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5044
• chore(docs): update ADOPTERS.md to include SAP by @jakobmoellerdev in https://github.com/external-secrets/external-secrets/pull/5165
• feat: add externalsecret namespace for webhook provider by @matheusmazzoni in https://github.com/external-secrets/external-secrets/pull/5155
• fix: add unknown status for secret store by @alvin-rw in https://github.com/external-secrets/external-secrets/pull/5070
• Fix pushing to an AWS Secrets Manager Secret when there are no secret values by @nirajsapkota in https://github.com/external-secrets/external-secrets/pull/4878
• add extralabels for dashboard to be scraped by multiple grafana instances by @L1ghtman2k in https://github.com/external-secrets/external-secrets/pull/5138
• fix: the api docs are not referencing sshkey generator by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5170
• Update github.md by @gecube in https://github.com/external-secrets/external-secrets/pull/5171
• Update anchore-engine-credentials.md by @gecube in https://github.com/external-secrets/external-secrets/pull/5172
• docs: update infisical docs to clarify missing system:auth-delegator need by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5174
• Adding support different type auth sources by @preved911 in https://github.com/external-secrets/external-secrets/pull/4877
• fix: stability update document did not update the stability table correctly by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5176
• Add esv1.AnnotationForceSync for CES and ES by @ntnn in https://github.com/external-secrets/external-secrets/pull/5156
• fix: helm build failing by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5178
• fix: remove release- branch automation by @moolen in https://github.com/external-secrets/external-secrets/pull/5182
• chore: update dependencies by @eso-service-account-app[bot] in https://github.com/external-secrets/external-secrets/pull/5181
• docs: update bitwarden documentation for dataFrom field usage by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5196
• feat: add contributor ladder by @gusfcarvalho in https://github.com/external-secrets/external-secrets/pull/5150
• feat: support vault provider check and set for push secrets by @webstradev in https://github.com/external-secrets/external-secrets/pull/5197
• chore(docs): update helm charts by @gusfcarvalho in https://github.com/external-secrets/external-secrets/pull/5203
• chore(ci): fix sonarqube security warnings in helm.yml by @webstradev in https://github.com/external-secrets/external-secrets/pull/5202
• chore: add pull request maintenance auto labelling and sizes by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5200
• fix: update the label verification step by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5209
• feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by @tuxtof in https://github.com/external-secrets/external-secrets/pull/5168
• feat: improve error message for json marshalling/unmarshalling by @webstradev in https://github.com/external-secrets/external-secrets/pull/5211
• chore: enhance helm-values-schema-json schema plugin management logic by @jakobmoellerdev in https://github.com/external-secrets/external-secrets/pull/5212
• fix(aws): stop incrementing the UUID for versions by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5175
• feat: enable secure serving for metrics [issue 4614] by @rkferreira in https://github.com/external-secrets/external-secrets/pull/5169
• fix(infisical): fix TokenAuth auth method by escaping the token revocation by @arthlr in https://github.com/external-secrets/external-secrets/pull/5217
• fix: tilt build was failing to rebuild by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5225
• feat: add selectable fields to the CRDs by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5226
• ref: removing Yandex Cloud specific common types declaration duplication by @preved911 in https://github.com/external-secrets/external-secrets/pull/4905
• fix: missing codeowners file from .github folder by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5228
• feat: add setting remote namespace to metadata for kubernetes provider by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5224
• feat: add support for certs only in pkcs12 by @devnopt in https://github.com/external-secrets/external-secrets/pull/4875
• docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by @ionicsolutions in https://github.com/external-secrets/external-secrets/pull/5208
• feat: Allow adding finalizers from template by @malovme in https://github.com/external-secrets/external-secrets/pull/5140
• fix: controller-runtime update by @gusfcarvalho in https://github.com/external-secrets/external-secrets/pull/5239
• chore: update dependencies by @eso-service-account-app[bot] in https://github.com/external-secrets/external-secrets/pull/5229
• fix: Prevent secretstore reconcile loop when provider error response is dynamic by @dakotaharden in https://github.com/external-secrets/external-secrets/pull/5247
• feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by @matheusmazzoni in https://github.com/external-secrets/external-secrets/pull/5163
• fix: keepersecurity support for shortcuts by @pepordev in https://github.com/external-secrets/external-secrets/pull/5245
• feat: add support for GCP Workload Identity Federation by @bharath-b-rh in https://github.com/external-secrets/external-secrets/pull/4654
• feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by @alliseeisgold in https://github.com/external-secrets/external-secrets/pull/5022
• chore(charts): Adds new make target for installing unittest plugin by @bharath-b-rh in https://github.com/external-secrets/external-secrets/pull/5250
• docs(templating): added clarifying comments to Github generator example by @nielstenboom in https://github.com/external-secrets/external-secrets/pull/5248
• feat(release): add new workflow to label first time contributor issues by @mouhsen-ibrahim in https://github.com/external-secrets/external-secrets/pull/5243
• feat(security): Adds an option to make HTTP2 configurable by @siddhibhor-56 in https://github.com/external-secrets/external-secrets/pull/5231
• feat: add retry for onepassword on authorization error by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5253
• fix: handle namespace deletion race conditions with finalizers by @framsouza in https://github.com/external-secrets/external-secrets/pull/5154
• docs: update stability and support by @anders-swanson in https://github.com/external-secrets/external-secrets/pull/5257
• fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by @kgal-akl in https://github.com/external-secrets/external-secrets/pull/5263
• feat: support Pod Identity authentication for Vault Provider by @webstradev in https://github.com/external-secrets/external-secrets/pull/5201
• feat: add domain field to secretserver provider by @rkferreira in https://github.com/external-secrets/external-secrets/pull/5258
• chore(release): Migrate to actions/create-github-app-token action by @mouhsen-ibrahim in https://github.com/external-secrets/external-secrets/pull/5264
• chore: just updating the crd conformance tests by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5265
• chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5269
• chore: azure sdk update by @hauswio in https://github.com/external-secrets/external-secrets/pull/5162
• feat: add support for fetching Secret by Path on Delinea Secret Server provider by @DelineaSahilWankhede in https://github.com/external-secrets/external-secrets/pull/5270
• feat: migrate from tibdex to actions/create-github-app-token by @rkferreira in https://github.com/external-secrets/external-secrets/pull/5286
• fix: license headers across all Go files - standardize format, add missing copyright, fix typos by @Copilot in https://github.com/external-secrets/external-secrets/pull/5288
• fix: the boilerplate was missing the right license format by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5289
• chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by @Copilot in https://github.com/external-secrets/external-secrets/pull/5290
• chore(docs): remove GitHub Discussions references and update support channels by @jakobmoellerdev in https://github.com/external-secrets/external-secrets/pull/5292
• docs: updated the ladder with two new tracks: documentation and community by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5298
• docs(release): create upgrading section by @rkferreira in https://github.com/external-secrets/external-secrets/pull/5310
• docs: readme update for health of the project by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5309
• fix: validate namespace in secretRef by @moolen in https://github.com/external-secrets/external-secrets/pull/5311
• docs: add burnout prevention strategies and mitigation policy document by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5307
• feat: add missing go sbom by @moolen in https://github.com/external-secrets/external-secrets/pull/5313
• feat: make vault e2e tests run locally by @moolen in https://github.com/external-secrets/external-secrets/pull/5246
• chore: update dependencies by @eso-service-account-app[bot] in https://github.com/external-secrets/external-secrets/pull/5324
• feat: add Cloudsmith generator for container registry authentication by @cloudsmith-iduffy in https://github.com/external-secrets/external-secrets/pull/5267
• feat: Add lgtm review automation step to ci workflows. by @webstradev in https://github.com/external-secrets/external-secrets/pull/5251
• feat(provider): add Volcengine provider support by @kevinyancn in https://github.com/external-secrets/external-secrets/pull/5306
• test: add more information to potentially flaky test by @Skarlso in https://github.com/external-secrets/external-secrets/pull/5330
• fix(docs): Fix typo in controller options doc by @tspearconquest in https://github.com/external-secrets/external-secrets/pull/5299
• chore(testing): Add licence.check make target by @jonstacks in https://github.com/external-secrets/external-secrets/pull/5335
• docs(gitlab-variables): document environment scope fallback by @s1nyx in https://github.com/external-secrets/external-secrets/pull/5300

Dependencies

• chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5190
• chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5191
• chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5189
• chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5188
• chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5187
• chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5186
• chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5184
• chore(deps): bump golang from 1.24.6 to 1.25.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5194
• chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5195
• chore(deps): bump ubi8/ubi from 4f0a4e4 to 7010e70 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5193
• chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5192
• chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5198
• chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5199
• chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5234
• chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5236
• chore(deps): bump ubi8/ubi from 7010e70 to 534c2c0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5237
• chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5238
• chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5242
• chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5241
• chore(deps): bump distroless/static from 2e114d2 to f2ff10a by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5240
• chore(deps): bump golang from 1.25.0 to 1.25.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5275
• chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5274
• chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5273
• chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5276
• chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5279
• chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5278
• chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5277
• chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5281
• chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5280
• chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5282
• chore(deps): bump golang from b6ed3fd to b6ed3fd by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5318
• chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5317
• chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5319
• chore(deps): bump distroless/static from f2ff10a to 87bce11 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5320
• chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5323
• chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5321
• chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5322
• chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5339
• chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5344
• chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5345
• chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5343
• chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5340
• chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5341
• chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5346
• chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/5342

New Contributors

• @mjtrangoni made their first contribution in https://github.com/external-secrets/external-secrets/pull/5139
• @muckelba made their first contribution in https://github.com/external-secrets/external-secrets/pull/5146
• @DrummyFloyd made their first contribution in https://github.com/external-secrets/external-secrets/pull/5144
• @sriaradhyula made their first contribution in https://github.com/external-secrets/external-secrets/pull/5159
• @jonstacks made their first contribution in https://github.com/external-secrets/external-secrets/pull/5161
• @matheusmazzoni made their first contribution in https://github.com/external-secrets/external-secrets/pull/5155
• @nirajsapkota made their first contribution in https://github.com/external-secrets/external-secrets/pull/4878
• @L1ghtman2k made their first contribution in https://github.com/external-secrets/external-secrets/pull/5138
• @gecube made their first contribution in https://github.com/external-secrets/external-secrets/pull/5171
• @preved911 made their first contribution in https://github.com/external-secrets/external-secrets/pull/4877
• @ntnn made their first contribution in https://github.com/external-secrets/external-secrets/pull/5156
• @webstradev made their first contribution in https://github.com/external-secrets/external-secrets/pull/5197
• @rkferreira made their first contribution in https://github.com/external-secrets/external-secrets/pull/5169
• @arthlr made their first contribution in https://github.com/external-secrets/external-secrets/pull/5217
• @devnopt made their first contribution in https://github.com/external-secrets/external-secrets/pull/4875
• @dakotaharden made their first contribution in https://github.com/external-secrets/external-secrets/pull/5247
• @bharath-b-rh made their first contribution in https://github.com/external-secrets/external-secrets/pull/4654
• @alliseeisgold made their first contribution in https://github.com/external-secrets/external-secrets/pull/5022
• @nielstenboom made their first contribution in https://github.com/external-secrets/external-secrets/pull/5248
• @siddhibhor-56 made their first contribution in https://github.com/external-secrets/external-secrets/pull/5231
• @framsouza made their first contribution in https://github.com/external-secrets/external-secrets/pull/5154
• @kgal-akl made their first contribution in https://github.com/external-secrets/external-secrets/pull/5263
• @hauswio made their first contribution in https://github.com/external-secrets/external-secrets/pull/5162
• @Copilot made their first contribution in https://github.com/external-secrets/external-secrets/pull/5288
• @cloudsmith-iduffy made their first contribution in https://github.com/external-secrets/external-secrets/pull/5267
• @kevinyancn made their first contribution in https://github.com/external-secrets/external-secrets/pull/5306
• @s1nyx made their first contribution in https://github.com/external-secrets/external-secrets/pull/5300

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v0.19.2...v0.20.0