Image: ghcr.io/external-secrets/external-secrets:v0.5.0

Changes

Breaking Changes

• In v0.5.0, we are introducing a new api version for both ExternalSecrets, SecretStores and ClusterSecretStore resources. There is a breaking change when updating ExternalSecrets versions regarding dataFrom. For more information, please see this guide
• v1alpha1 is deprecated and will be removed once the CRDs are promoted to GA.

Note: If you are deploying external-secrets into a GKE cluster, you might need to add a firewall rule allowing traffic to port 9443 (see https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules)

Global Changes

• Added a Validation and Conversion Webhooks for the project (webhook deployment)
• Added a certificate injector to allow Validating and Conversion Webhook automatic setup (cert-controller deployment)
• Added ClusterExternalSecret resource!
• Added some cool external resources to our docs! If you have any content of your own, please submit a PR :)
• Images are now signed and verified with cosign
• Our charts now support namespaced RBACs (to use with scoped Namespace :))
• Added a creationPolicy: Orphan - to allow Secrets to be maintained even after the ExternalSecret gets deleted.

Global Fixes

• Fixed a bug in templateFrom functionality (not rendering if empty data was provided)

Provider Specific

Kubernetes

• Remote Kubernetes provider was added! Come check it out ;)

Azure Keyvault

• dataFrom now supports find operations - allowing users to Get All Secrets and bind them to a single Kubernetes Secret.
• Implemented compatibility with Azure Workload Identity!

IBM Secrets Manager

• Added support for public_cert and kv secret types

GCP

• Workload Identity now works with clusters in different projects than the Secret Manager!
• Fixed Memory Leak issues with GCP Provider

Hashicorp Vault

• JWT authentication method now supports Kubernetes Service Accounts.
• dataFrom now supports find operations - allowing users to Get All Secrets and bind them to a single Kubernetes Secret.

Yandex Lockbox

• Fixed Yandex Lockbox Connection Leaks

AWS Secrets Manager and Parameter Store

• dataFrom now supports find operations - allowing users to Get All Secrets and bind them to a single Kubernetes Secret.
• Added a deletionPolicy - to allow delete Secrets if the content within a provider is no longer available.