chore(deps): update helm release external-secrets to v2.11.0

[renovate]

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	2.10.0 → 2.11.0

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.11.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.11.0
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi-boringssl

What's Changed

General

• chore: release helm chart for 2.10.0 by @​Skarlso in #​6882
• docs: use --hostname all in the Bitwarden webhook example by @​ggiesen in #​6850
• fix(ci): zizmor no-op blocks gates by @​evrardj-roche in #​6889
• feat(barbican): Support OpenStack Barbican authentication via Application Credentials by @​JaviMore in #​6082
• clean: replace k8s.io/utils pointer helpers with the new builtin by @​alekc in #​6902
• feat(webhook): return not supported error for GetAllSecrets by @​Abderraoufzekkour in #​6817
• fix(keepersecurity): return NoSecretErr for missing records by @​alliasgher in #​6816
• fix: doc builds may set different user/group ownership on git repo objects by @​evrardj-roche in #​6901
• fix: Use local GCP import for Vault modules by @​evrardj-roche in #​6904
• fix: guarantee replaces by @​evrardj-roche in #​6905
• chore: bump grpc by @​evrardj-roche in #​6909
• fix: bump Makefile license-eye image to 0.9.0 by @​dronenb in #​6855
• feat(infisical): add option to keep duplicate secret keys by @​mathnogueira in #​6908
• ref: move provider constants by @​evrardj-roche in #​6883
• feat: allow specifying namespace for grafana dashboard ConfigMap by @​okwilkins in #​6920
• fix(keepersecurity): make folderID optional except when creating new records via push by @​LGKentang in #​6921
• docs(templating): remove duplicate a in TemplateFrom Literal note by @​mrchatam in #​6953
• feat(ci): close pull requests that drop a template section by @​alekc in #​6881
• feat(charts): add global.imageRegistry to the external-secrets chart by @​alekc in #​6983
• chore: update skywalking-eyes by @​evrardj-roche in #​6970
• ref: fix Sonarqube linting alerts by @​evrardj-roche in #​6974
• chore: Revert #​6908 by @​evrardj-roche in #​6991
• chore: prepare release support matrix by @​evrardj-roche in #​6993

Dependencies

• chore(deps): bump golang from 484ef60 to ded31c6 in /e2e by @​dependabot[bot] in #​6892
• chore(deps): bump ubi9/ubi from 5426a8f to 25a147d by @​dependabot[bot] in #​6890
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @​dependabot[bot] in #​6895
• chore(deps): bump the codeql group across 1 directory with 3 updates by @​dependabot[bot] in #​6893
• chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​6896
• chore(deps): bump golang from 1.27.0-bookworm to 1.27.1-bookworm in /e2e by @​dependabot[bot] in #​6923
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @​dependabot[bot] in #​6925
• chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @​dependabot[bot] in #​6927
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @​dependabot[bot] in #​6924
• chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @​dependabot[bot] in #​6926
• chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @​dependabot[bot] in #​6928
• chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​6929
• chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @​dependabot[bot] in #​6960
• chore(deps): bump ubi9/ubi from 25a147d to c5cc9c2 by @​dependabot[bot] in #​6956

New Contributors

• @​ggiesen made their first contribution in #​6850
• @​JaviMore made their first contribution in #​6082
• @​Abderraoufzekkour made their first contribution in #​6817
• @​okwilkins made their first contribution in #​6920
• @​LGKentang made their first contribution in #​6921
• @​mrchatam made their first contribution in #​6953

Full Changelog: external-secrets/external-secrets@v2.10.0...v2.11.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

21 changed · 0 added · 0 removed

Rendered with kustomize build + helm template (source of truth = git), so Helm-expanded workloads are included. Shows what Flux will apply — not a diff against live cluster state (drift is alerted on separately), and not CRD-defaulted / webhook-mutated output. Secret values are redacted; per-render noise (webhook caBundles, checksum/* annotations, render timestamps) is normalized out.

🟡 changed — admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/-/externalsecret-validate

--- a/admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/-/externalsecret-validate
+++ b/admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/-/externalsecret-validate
@@ -5,9 +5,9 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-webhook
-    app.kubernetes.io/version: v2.10.0
+    app.kubernetes.io/version: v2.11.0
     external-secrets.io/component: webhook
-    helm.sh/chart: external-secrets-2.10.0
+    helm.sh/chart: external-secrets-2.11.0
   name: externalsecret-validate
 webhooks:
 - admissionReviewVersions:

🟡 changed — admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/-/secretstore-validate

--- a/admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/-/secretstore-validate
+++ b/admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/-/secretstore-validate
@@ -5,9 +5,9 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-webhook
-    app.kubernetes.io/version: v2.10.0
+    app.kubernetes.io/version: v2.11.0
     external-secrets.io/component: webhook
-    helm.sh/chart: external-secrets-2.10.0
+    helm.sh/chart: external-secrets-2.11.0
   name: secretstore-validate
 webhooks:
 - admissionReviewVersions:

🟡 changed — apps/v1/Deployment/security/external-secrets

--- a/apps/v1/Deployment/security/external-secrets
+++ b/apps/v1/Deployment/security/external-secrets
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets
   namespace: security
 spec:
@@ -22,8 +22,8 @@
         app.kubernetes.io/instance: external-secrets
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: external-secrets
-        app.kubernetes.io/version: v2.10.0
-        helm.sh/chart: external-secrets-2.10.0
+        app.kubernetes.io/version: v2.11.0
+        helm.sh/chart: external-secrets-2.11.0
     spec:
       automountServiceAccountToken: true
       containers:
@@ -32,7 +32,7 @@
         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
-        image: ghcr.io/external-secrets/external-secrets:v2.10.0
+        image: ghcr.io/external-secrets/external-secrets:v2.11.0
         imagePullPolicy: IfNotPresent
         name: external-secrets
         ports:

🟡 changed — apps/v1/Deployment/security/external-secrets-cert-controller

--- a/apps/v1/Deployment/security/external-secrets-cert-controller
+++ b/apps/v1/Deployment/security/external-secrets-cert-controller
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-cert-controller
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-cert-controller
   namespace: security
 spec:
@@ -22,8 +22,8 @@
         app.kubernetes.io/instance: external-secrets
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: external-secrets-cert-controller
-        app.kubernetes.io/version: v2.10.0
-        helm.sh/chart: external-secrets-2.10.0
+        app.kubernetes.io/version: v2.11.0
+        helm.sh/chart: external-secrets-2.11.0
     spec:
       automountServiceAccountToken: true
       containers:
@@ -39,7 +39,7 @@
         - --loglevel=info
         - --zap-time-encoding=epoch
         - --enable-partial-cache=true
-        image: ghcr.io/external-secrets/external-secrets:v2.10.0
+        image: ghcr.io/external-secrets/external-secrets:v2.11.0
         imagePullPolicy: IfNotPresent
         name: cert-controller
         ports:

🟡 changed — apps/v1/Deployment/security/external-secrets-webhook

--- a/apps/v1/Deployment/security/external-secrets-webhook
+++ b/apps/v1/Deployment/security/external-secrets-webhook
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-webhook
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-webhook
   namespace: security
 spec:
@@ -22,8 +22,8 @@
         app.kubernetes.io/instance: external-secrets
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: external-secrets-webhook
-        app.kubernetes.io/version: v2.10.0
-        helm.sh/chart: external-secrets-2.10.0
+        app.kubernetes.io/version: v2.11.0
+        helm.sh/chart: external-secrets-2.11.0
     spec:
       automountServiceAccountToken: true
       containers:
@@ -37,7 +37,7 @@
         - --healthz-addr=:8081
         - --loglevel=info
         - --zap-time-encoding=epoch
-        image: ghcr.io/external-secrets/external-secrets:v2.10.0
+        image: ghcr.io/external-secrets/external-secrets:v2.11.0
         imagePullPolicy: IfNotPresent
         name: webhook
         ports:

🟡 changed — helm.toolkit.fluxcd.io/v2/HelmRelease/security/external-secrets

--- a/helm.toolkit.fluxcd.io/v2/HelmRelease/security/external-secrets
+++ b/helm.toolkit.fluxcd.io/v2/HelmRelease/security/external-secrets
@@ -10,7 +10,7 @@
       sourceRef:
         kind: HelmRepository
         name: external-secrets
-      version: 2.10.0
+      version: 2.11.0
   driftDetection:
     mode: enabled
   install:

🟡 changed — policy/v1/PodDisruptionBudget/security/external-secrets-pdb

--- a/policy/v1/PodDisruptionBudget/security/external-secrets-pdb
+++ b/policy/v1/PodDisruptionBudget/security/external-secrets-pdb
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-pdb
   namespace: security
 spec:

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-cert-controller

--- a/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-cert-controller
+++ b/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-cert-controller
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-cert-controller
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-cert-controller
 rules:
 - apiGroups:

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-controller

--- a/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-controller
+++ b/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-controller
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-controller
 rules:
 - apiGroups:

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-edit

--- a/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-edit
+++ b/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-edit
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
     rbac.authorization.k8s.io/aggregate-to-admin: 'true'
     rbac.authorization.k8s.io/aggregate-to-edit: 'true'
   name: external-secrets-edit

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-servicebindings

--- a/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-servicebindings
+++ b/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-servicebindings
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
     servicebinding.io/controller: 'true'
   name: external-secrets-servicebindings
 rules:

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-view

--- a/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-view
+++ b/rbac.authorization.k8s.io/v1/ClusterRole/-/external-secrets-view
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
     rbac.authorization.k8s.io/aggregate-to-admin: 'true'
     rbac.authorization.k8s.io/aggregate-to-edit: 'true'
     rbac.authorization.k8s.io/aggregate-to-view: 'true'

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRoleBinding/-/external-secrets-cert-controller

--- a/rbac.authorization.k8s.io/v1/ClusterRoleBinding/-/external-secrets-cert-controller
+++ b/rbac.authorization.k8s.io/v1/ClusterRoleBinding/-/external-secrets-cert-controller
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-cert-controller
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-cert-controller
 roleRef:
   apiGroup: rbac.authorization.k8s.io

🟡 changed — rbac.authorization.k8s.io/v1/ClusterRoleBinding/-/external-secrets-controller

--- a/rbac.authorization.k8s.io/v1/ClusterRoleBinding/-/external-secrets-controller
+++ b/rbac.authorization.k8s.io/v1/ClusterRoleBinding/-/external-secrets-controller
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-controller
 roleRef:
   apiGroup: rbac.authorization.k8s.io

🟡 changed — rbac.authorization.k8s.io/v1/Role/security/external-secrets-leaderelection

--- a/rbac.authorization.k8s.io/v1/Role/security/external-secrets-leaderelection
+++ b/rbac.authorization.k8s.io/v1/Role/security/external-secrets-leaderelection
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-leaderelection
   namespace: security
 rules:

🟡 changed — rbac.authorization.k8s.io/v1/RoleBinding/security/external-secrets-leaderelection

--- a/rbac.authorization.k8s.io/v1/RoleBinding/security/external-secrets-leaderelection
+++ b/rbac.authorization.k8s.io/v1/RoleBinding/security/external-secrets-leaderelection
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-leaderelection
   namespace: security
 roleRef:

🟡 changed — v1/Secret/security/external-secrets-webhook

--- a/v1/Secret/security/external-secrets-webhook
+++ b/v1/Secret/security/external-secrets-webhook
@@ -5,8 +5,8 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-webhook
-    app.kubernetes.io/version: v2.10.0
+    app.kubernetes.io/version: v2.11.0
     external-secrets.io/component: webhook
-    helm.sh/chart: external-secrets-2.10.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-webhook
   namespace: security

🟡 changed — v1/Service/security/external-secrets-webhook

--- a/v1/Service/security/external-secrets-webhook
+++ b/v1/Service/security/external-secrets-webhook
@@ -5,9 +5,9 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-webhook
-    app.kubernetes.io/version: v2.10.0
+    app.kubernetes.io/version: v2.11.0
     external-secrets.io/component: webhook
-    helm.sh/chart: external-secrets-2.10.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-webhook
   namespace: security
 spec:

🟡 changed — v1/ServiceAccount/security/external-secrets

--- a/v1/ServiceAccount/security/external-secrets
+++ b/v1/ServiceAccount/security/external-secrets
@@ -5,7 +5,7 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets
   namespace: security

🟡 changed — v1/ServiceAccount/security/external-secrets-cert-controller

--- a/v1/ServiceAccount/security/external-secrets-cert-controller
+++ b/v1/ServiceAccount/security/external-secrets-cert-controller
@@ -5,7 +5,7 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-cert-controller
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-cert-controller
   namespace: security

🟡 changed — v1/ServiceAccount/security/external-secrets-webhook

--- a/v1/ServiceAccount/security/external-secrets-webhook
+++ b/v1/ServiceAccount/security/external-secrets-webhook
@@ -5,7 +5,7 @@
     app.kubernetes.io/instance: external-secrets
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: external-secrets-webhook
-    app.kubernetes.io/version: v2.10.0
-    helm.sh/chart: external-secrets-2.10.0
+    app.kubernetes.io/version: v2.11.0
+    helm.sh/chart: external-secrets-2.11.0
   name: external-secrets-webhook
   namespace: security