From 9085a6bda259bf524ceae9035ca233d0ed698fdb Mon Sep 17 00:00:00 2001 From: Manos Kousteris Date: Wed, 2 Sep 2026 12:10:22 +0300 Subject: [PATCH] fix: honor provider build tags in Dockerfile.standalone go build -o external-secrets main.go had no -tags flag. Since v1.x, every provider registration lives behind a Go build constraint (pkg/register/.go: //go:build || all_providers, see AGENTS.md), so a bare go build compiles an empty pkg/register and zero providers register at runtime. Every ClusterSecretStore/SecretStore then fails reconciliation with: could not get provider client: failed to find registered store backend for type: vault, name: Same root cause, same error shape as external-secrets/external-secrets#5807 (webhook provider, `make run` dev build), fixed there for the Makefile/ Tiltfile default in external-secrets/external-secrets#5851 - but that fix never touched Dockerfile.standalone, which still builds with no tags at all. Adds ARG PROVIDER=all_providers (matching the Makefile's own default) and passes it through as -tags, so a plain `docker build -f Dockerfile.standalone .` keeps working out of the box, while `--build-arg PROVIDER=vault` (or any other provider name) still lets you build a slimmer binary. --- Dockerfile.standalone | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile.standalone b/Dockerfile.standalone index 5ac6f67e2fd..581496277d4 100644 --- a/Dockerfile.standalone +++ b/Dockerfile.standalone @@ -1,16 +1,19 @@ # This version of Dockerfile is for building without external dependencies. # Build a multi-platform image e.g. `docker buildx build --push --platform linux/arm64,linux/amd64 --tag external-secrets:dev --file Dockerfile.standalone .` +# Providers are gated behind Go build tags (see pkg/register/.go and AGENTS.md); pass +# --build-arg PROVIDER=[,...] to build a slimmer binary with only the providers you need. FROM golang:1.25.6-alpine@sha256:d9b2e14101f27ec8d09674cd01186798d227bb0daec90e032aeb1cd22ac0f029 AS builder # Add metadata LABEL maintainer="cncf-externalsecretsop-maintainers@lists.cncf.io" \ description="External Secrets Operator is a Kubernetes operator that integrates external secret management systems" ARG TARGETOS ARG TARGETARCH +ARG PROVIDER=all_providers ENV CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} WORKDIR /app COPY . /app/ RUN go mod download -RUN go build -o external-secrets main.go +RUN go build -tags ${PROVIDER} -o external-secrets main.go FROM gcr.io/distroless/static@sha256:cd64bec9cec257044ce3a8dd3620cf83b387920100332f2b041f19c4d2febf93 AS app COPY --from=builder /app/external-secrets /bin/external-secrets