External Secrets Files

Image: ghcr.io/external-secrets/external-secrets:v2.8.0 Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.7.0 by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6529
• docs(barbican): correct find semantics and document property/extract by @alekc in https://github.com/external-secrets/external-secrets/pull/6531
• docs(gcp): use external-secrets.io/v1 in SecretStore examples by @alekc in https://github.com/external-secrets/external-secrets/pull/6563
• feat(generators): add GitLab deploy token generator by @alekc in https://github.com/external-secrets/external-secrets/pull/6493
• fix(barbican): validate store config and fix SecretExists error message by @alekc in https://github.com/external-secrets/external-secrets/pull/6534
• docs(beyondtrust): fix capability matrix and document decrypt/separator by @alekc in https://github.com/external-secrets/external-secrets/pull/6535
• feat: Make SecondsToLive optional for Grafana generator by @jaruwat-panturat in https://github.com/external-secrets/external-secrets/pull/6479
• docs: add missing generators to ClusterGenerator spec snippet by @jaruwat-panturat in https://github.com/external-secrets/external-secrets/pull/6590
• docs(doppler): fix download format list and heading levels by @alekc in https://github.com/external-secrets/external-secrets/pull/6559
• docs(fortanix): add to support matrix and tidy provider page by @alekc in https://github.com/external-secrets/external-secrets/pull/6562
• docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @alekc in https://github.com/external-secrets/external-secrets/pull/6585
• docs(volcengine): mark referent authentication as supported by @alekc in https://github.com/external-secrets/external-secrets/pull/6584
• docs(senhasegura): mark deletion + referent in matrix and fix title by @alekc in https://github.com/external-secrets/external-secrets/pull/6583
• docs(scaleway): mark referent auth in matrix and fix headings by @alekc in https://github.com/external-secrets/external-secrets/pull/6581
• docs(pulumi): correct find/referent matrix cells and fix headings by @alekc in https://github.com/external-secrets/external-secrets/pull/6578
• docs(previder): correct find/referent matrix cells and fix headings by @alekc in https://github.com/external-secrets/external-secrets/pull/6577
• docs(1password): mark SDK find support in matrix and promote titles by @alekc in https://github.com/external-secrets/external-secrets/pull/6568
• feat(charts): Add aggregateToAdmin toggle by @illrill in https://github.com/external-secrets/external-secrets/pull/6586
• docs(providers): consolidate 11 conflicting provider-doc PRs by @alekc in https://github.com/external-secrets/external-secrets/pull/6592
• feat(charts): add startupProbe support to webhook deployment by @alpcanaydin in https://github.com/external-secrets/external-secrets/pull/6612
• feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @baraka-akeyless in https://github.com/external-secrets/external-secrets/pull/6530
• docs(kubernetes): fix invalid tab indentation and heading levels by @alekc in https://github.com/external-secrets/external-secrets/pull/6565
• docs(dvls): mark DeletionPolicy supported and fix page title by @alekc in https://github.com/external-secrets/external-secrets/pull/6557
• docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @alekc in https://github.com/external-secrets/external-secrets/pull/6551
• docs(github): add to support matrix, fix auth field, tidy page by @alekc in https://github.com/external-secrets/external-secrets/pull/6564
• docs: Improve explanations of pem_chain by @evrardjp in https://github.com/external-secrets/external-secrets/pull/6623
• feat: Make our stance regarding AI usage more explicit. by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6621
• fix(barbican): treat find.name.regexp as a regexp, not an exact match by @arpitjain099 in https://github.com/external-secrets/external-secrets/pull/6614
• chore: update go version 1.26.5 - Fix CVE-2026-39822 by @alekc in https://github.com/external-secrets/external-secrets/pull/6631
• ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @alekc in https://github.com/external-secrets/external-secrets/pull/6634
• chore: updating ok-to-test to allow interim maintainers by @gusfcarvalho in https://github.com/external-secrets/external-secrets/pull/6638
• fix(onepassword): support PushSecret IfNotExists by @civilizedBaboon in https://github.com/external-secrets/external-secrets/pull/6646
• fix(testing): check out PR head in fork e2e instead of main by @alekc in https://github.com/external-secrets/external-secrets/pull/6647
• fix(secretserver): validate store and map fields correctly by @dbinger in https://github.com/external-secrets/external-secrets/pull/6616
• feat(charts): Add optional networkPolicy by @jcpunk in https://github.com/external-secrets/external-secrets/pull/5779
• feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @baraka-akeyless in https://github.com/external-secrets/external-secrets/pull/6507
• feat(provider): implement AWS Certificate Manager provider by @dsp0x4 in https://github.com/external-secrets/external-secrets/pull/6117
• feat: expose more values for custom metadata for vault v2 by @Skarlso in https://github.com/external-secrets/external-secrets/pull/6652
• clean: Remove duplicate code by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6629
• feat: configurable leader election lease timings by @izz-linux in https://github.com/external-secrets/external-secrets/pull/6644
• fix(akeyless): support dataFrom.extract.property for nested JSON by @baraka-akeyless in https://github.com/external-secrets/external-secrets/pull/6633
• feat(conjur): Certificate Auth support by @hdabrowski in https://github.com/external-secrets/external-secrets/pull/6393
• docs(aws): restore dropped access section and document missing fields by @alekc in https://github.com/external-secrets/external-secrets/pull/6517
• feat(secretserver): support authentication via access token by @sumanpal97 in https://github.com/external-secrets/external-secrets/pull/6597
• docs(secretserver): document authentication, key formats, property behavior, and limitations by @dbinger in https://github.com/external-secrets/external-secrets/pull/6619
• feat(release): Support reading values from kubernetes CRD by @alekc in https://github.com/external-secrets/external-secrets/pull/6211
• clean: Standardize and friendly name for validations policies by @evrardj-roche in https://github.com/external-secrets/external-secrets/pull/6630
• feat: add CreateOrMerge creation policy for ExternalSecrets by @alekc in https://github.com/external-secrets/external-secrets/pull/6641
• feat(core): accept duration string for SecretStore refreshInterval by @alekc in https://github.com/external-secrets/external-secrets/pull/6594
• fix(beyondtrust): validate store without panicking on API key auth by @emmayusufu in https://github.com/external-secrets/external-secrets/pull/6553
• fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @Ashutosh-3601 in https://github.com/external-secrets/external-secrets/pull/6421

Dependencies

• chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6538
• chore(deps): bump ubi9/ubi from 1b99266 to 37a1589 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6537
• chore(deps): bump golang from 5f68ec6 to b305420 in /e2e by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6539
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6540
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6542
• chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6543
• chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6544
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6541
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6545
• chore(deps): bump golang from 3ad5730 to 3ad5730 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6600
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6606
• chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6603
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6607
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6604
• chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6608
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6605
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6602
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6601
• chore(deps): bump ubi9/ubi from 37a1589 to 8bf0e8f by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6599
• chore(deps): bump golang from 1.26.4 to 1.26.5 by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6636
• chore(deps): bump distroless/static from 3592aa8 to d5f030c by @dependabot[bot] in https://github.com/external-secrets/external-secrets/pull/6635

New Contributors

• @alpcanaydin made their first contribution in https://github.com/external-secrets/external-secrets/pull/6612
• @baraka-akeyless made their first contribution in https://github.com/external-secrets/external-secrets/pull/6530
• @arpitjain099 made their first contribution in https://github.com/external-secrets/external-secrets/pull/6614
• @civilizedBaboon made their first contribution in https://github.com/external-secrets/external-secrets/pull/6646
• @dbinger made their first contribution in https://github.com/external-secrets/external-secrets/pull/6616
• @dsp0x4 made their first contribution in https://github.com/external-secrets/external-secrets/pull/6117
• @izz-linux made their first contribution in https://github.com/external-secrets/external-secrets/pull/6644
• @hdabrowski made their first contribution in https://github.com/external-secrets/external-secrets/pull/6393
• @sumanpal97 made their first contribution in https://github.com/external-secrets/external-secrets/pull/6597
• @emmayusufu made their first contribution in https://github.com/external-secrets/external-secrets/pull/6553
• @Ashutosh-3601 made their first contribution in https://github.com/external-secrets/external-secrets/pull/6421

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.7.0...v2.8.0