chore(chart-deps): update external-secrets to version 2.8.0 - #3450
chore(chart-deps): update external-secrets to version 2.8.0#3450svcAPLBot wants to merge 24 commits into
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR updates the vendored/wrapper external-secrets Helm chart to v2.8.0, syncing chart metadata, values/schema, templates, and CRDs to match the upstream release.
Changes:
- Bump chart version/appVersion to 2.8.0 and update the chart-index dependency reference.
- Add new configurable options (leader election timings, startupProbe for webhook, NetworkPolicies for controller/webhook/certController, RBAC aggregation toggle).
- Refresh CRDs/templates to include new generators/providers and updated schema validations.
Reviewed changes
Copilot reviewed 27 out of 27 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| charts/external-secrets/values.yaml | Adds new values for leader election, startup probes, and NetworkPolicy configuration. |
| charts/external-secrets/values.schema.json | Extends values JSON schema to cover new options (networkPolicy, leader election timing, startupProbe fields, RBAC toggle). |
| charts/external-secrets/templates/webhook-networkpolicy.yaml | New webhook NetworkPolicy template. |
| charts/external-secrets/templates/webhook-deployment.yaml | Adds optional startupProbe for webhook deployment. |
| charts/external-secrets/templates/rbac.yaml | Adds gitlabdeploytokens generator RBAC and gates aggregate-to-admin on a values flag. |
| charts/external-secrets/templates/networkpolicy.yaml | New controller NetworkPolicy template. |
| charts/external-secrets/templates/deployment.yaml | Adds leader election timing CLI flags. |
| charts/external-secrets/templates/crds/secretstore.yaml | Updates templated SecretStore CRD schema (new fields/providers/validations). |
| charts/external-secrets/templates/crds/pushsecret.yaml | Updates templated PushSecret CRD generator enums. |
| charts/external-secrets/templates/crds/grafana.yaml | Updates templated Grafana generator CRD schema. |
| charts/external-secrets/templates/crds/gitlabdeploytoken.yaml | Adds templated GitLab deploy token generator CRD. |
| charts/external-secrets/templates/crds/externalsecret.yaml | Updates templated ExternalSecret CRD enums/policies. |
| charts/external-secrets/templates/crds/clustersecretstore.yaml | Updates templated ClusterSecretStore CRD schema (new fields/providers/validations). |
| charts/external-secrets/templates/crds/clusterpushsecret.yaml | Updates templated ClusterPushSecret CRD generator enums. |
| charts/external-secrets/templates/crds/clustergenerator.yaml | Updates templated ClusterGenerator CRD schema (adds GitLab deploy token + Grafana TTL). |
| charts/external-secrets/templates/crds/clusterexternalsecret.yaml | Updates templated ClusterExternalSecret CRD enums/policies. |
| charts/external-secrets/templates/cert-controller-networkpolicy.yaml | New cert-controller NetworkPolicy template. |
| charts/external-secrets/templates/cert-controller-deployment.yaml | Simplifies cert-controller startupProbe port wiring; uses new timing fields. |
| charts/external-secrets/README.md | Regenerated chart README reflecting new options and version bump. |
| charts/external-secrets/crds/secretstore.yaml | Updates packaged SecretStore CRD YAML. |
| charts/external-secrets/crds/pushsecret.yaml | Updates packaged PushSecret CRD YAML. |
| charts/external-secrets/crds/grafana.yaml | Updates packaged Grafana generator CRD YAML. |
| charts/external-secrets/crds/gitlabdeploytoken.yaml | Adds packaged GitLab deploy token generator CRD YAML. |
| charts/external-secrets/crds/externalsecret.yaml | Updates packaged ExternalSecret CRD YAML. |
| charts/external-secrets/crds/clustersecretstore.yaml | Updates packaged ClusterSecretStore CRD YAML. |
| charts/external-secrets/Chart.yaml | Bumps chart version and appVersion to 2.8.0. |
| chart/chart-index/Chart.yaml | Updates the external-secrets dependency version reference to 2.8.0. |
| spec: | ||
| egress: | ||
| {{- with .Values.networkPolicy.egress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| ingress: | ||
| {{- with .Values.networkPolicy.ingress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| {{- include "external-secrets.selectorLabels" . | nindent 6 }} | ||
| policyTypes: | ||
| - Egress | ||
| - Ingress |
| spec: | ||
| egress: | ||
| {{- with .Values.certController.networkPolicy.egress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| ingress: | ||
| {{- with .Values.certController.networkPolicy.ingress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 6 }} | ||
| policyTypes: | ||
| - Egress | ||
| - Ingress |
| egress: [] | ||
|
|
||
| # -- Pod priority class name. | ||
| priorityClassName: "" |
| spec: | ||
| egress: | ||
| {{- with .Values.webhook.networkPolicy.egress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| ingress: | ||
| {{- with .Values.webhook.networkPolicy.ingress }} | ||
| {{- toYaml . | nindent 4 }} | ||
| {{- end }} | ||
| podSelector: | ||
| matchLabels: | ||
| {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }} | ||
| policyTypes: | ||
| - Egress | ||
| - Ingress |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
charts/external-secrets/templates/networkpolicy.yaml:21
- If
networkPolicy.enabledis set to true whilenetworkPolicy.egressis left as the default empty list ([]), thewithblock does not render and this template outputs anegress:key with no value, producing invalid YAML. Same issue can occur foringresswhen it is empty. Renderegress/ingressunconditionally so empty lists become[].
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:21
- If
webhook.networkPolicy.enabledis set to true whilewebhook.networkPolicy.egressis left as the default empty list ([]), thewithblock does not render and this template outputs anegress:key with no value, producing invalid YAML. Same issue can occur foringresswhen it is empty. Renderegress/ingressunconditionally so empty lists become[].
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.webhook.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:21
- If
certController.networkPolicy.enabledis set to true whilecertController.networkPolicy.egressis left as the default empty list ([]), thewithblock does not render and this template outputs anegress:key with no value, producing invalid YAML. Same issue can occur foringresswhen it is empty. Renderegress/ingressunconditionally so empty lists become[].
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.certController.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
There was a problem hiding this comment.
🟡 Not ready to approve
The newly added NetworkPolicy templates can render invalid YAML when ingress/egress are configured as empty lists, which can break Helm installs/upgrades when the feature is enabled.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Comments suppressed due to low confidence (5)
charts/external-secrets/templates/networkpolicy.yaml:21
- This template can render invalid YAML when networkPolicy.egress or networkPolicy.ingress is set to an empty list (the default use-case for "deny all"), because the key is always emitted but the
withblock renders nothing, resulting inegress:/ingress:beingnullinstead of an array. Kubernetes NetworkPolicy requires these fields to be arrays when present.
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:21
- This template can render invalid YAML when webhook.networkPolicy.egress or webhook.networkPolicy.ingress is set to an empty list, because the key is always emitted but the
withblock renders nothing, resulting inegress:/ingress:beingnullinstead of an array.
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.webhook.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:21
- This template can render invalid YAML when certController.networkPolicy.egress or certController.networkPolicy.ingress is set to an empty list, because the key is always emitted but the
withblock renders nothing, resulting inegress:/ingress:beingnullinstead of an array.
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.certController.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/values.yaml:826
- The
# -- Pod priority class name.comment is indented undercertController.networkPolicy, but thepriorityClassNamevalue is a sibling ofnetworkPolicy. This makes the comment apply to the wrong key and also causes the generated README entry for certController.priorityClassName to lose its description.
egress: []
# -- Pod priority class name.
priorityClassName: ""
charts/external-secrets/README.md:82
- The generated values table entry for
certController.priorityClassNamehas an empty description, which makes the README less useful (it previously documented this as the pod priority class name). This is likely a side-effect of the mis-indented comment in values.yaml; after fixing that, please regenerate the README so this row includes the correct description.
| certController.priorityClassName | string | `""` | |
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Low
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The newly added NetworkPolicy templates can render invalid Kubernetes manifests when ingress/egress lists are empty (null instead of array), which would break deployments when enabled.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (4)
charts/external-secrets/templates/networkpolicy.yaml:17
- The NetworkPolicy template always renders
egress:/ingress:keys, but the content is wrapped inwith. If a user setsnetworkPolicy.egress(oringress) to an empty list, Helm will render the key with a null value (e.g.egress: <null>), which fails Kubernetes schema validation (these fields must be arrays when present). Render an explicit array (defaulting to[]) instead of conditionally omitting the value.
spec:
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:17
- Same issue as the controller NetworkPolicy:
egress:/ingress:are always emitted, but the values are wrapped inwith. An empty list will render as a null value and the NetworkPolicy will be rejected by the API server. Default these lists to[](or omit the keys entirely) so the rendered manifest is valid for empty rulesets.
spec:
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:17
- Same issue as the other NetworkPolicy templates:
egress:/ingress:are always present, but the content is conditional. When the configured list is empty, the field becomes null in the rendered manifest and will fail validation. Default to an empty list ([]) so enabling the NetworkPolicy produces a valid resource even with no rules.
spec:
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/values.yaml:826
priorityClassName's description comment is indented as if it were part ofcertController.networkPolicy, which causes the generated README to lose the description forcertController.priorityClassName. Align the comment indentation with thepriorityClassNamekey so doc generation can associate the description correctly.
# -- Pod priority class name.
priorityClassName: ""
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The new NetworkPolicy templates render invalid YAML (egress: null) when enabled=true with default empty egress lists, which can cause failed installs/upgrades.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (3)
charts/external-secrets/templates/networkpolicy.yaml:17
spec.egress/spec.ingressare always emitted, but the body is only rendered inside awith. When the value is an empty list (defaultegress: []),withdoes not execute and the manifest renders asegress: null, which fails NetworkPolicy schema validation (expects an array). Render the arrays unconditionally so empty lists become[].
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:17
spec.egress/spec.ingressare always emitted, but the body is only rendered inside awith. When the value is an empty list (defaultegress: []),withdoes not execute and the manifest renders asegress: null, which fails NetworkPolicy schema validation (expects an array). Render the arrays unconditionally so empty lists become[].
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:17
spec.egress/spec.ingressare always emitted, but the body is only rendered inside awith. When the value is an empty list (defaultegress: []),withdoes not execute and the manifest renders asegress: null, which fails NetworkPolicy schema validation (expects an array). Render the arrays unconditionally so empty lists become[].
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The newly added NetworkPolicy templates can render invalid manifests when enabled with default empty egress/ingress arrays, which could break installs.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (5)
charts/external-secrets/templates/networkpolicy.yaml:18
- If networkPolicy.enabled is set to true while egress/ingress remain the default empty arrays, the current
withblocks renderegress:/ingress:with no value (null). That produces invalid NetworkPolicy YAML/JSON for many API servers and can break chart installs. Render the arrays directly (so empty arrays become[]) or omit the fields entirely when empty.
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/webhook-networkpolicy.yaml:18
- If webhook.networkPolicy.enabled is set to true while egress/ingress remain empty arrays, the current
withblocks renderegress:/ingress:with no value (null). This can produce an invalid NetworkPolicy manifest and break installs. Render the arrays directly (so empty arrays become[]) or omit the fields when empty.
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/values.yaml:826
- The
# -- Pod priority class name.doc comment is currently indented as if it belongs tocertController.networkPolicy(it comes right afternetworkPolicy.egress). This causes generated docs (README) to lose the description forcertController.priorityClassName. Dedent the comment to align withpriorityClassName.
egress: []
# -- Pod priority class name.
priorityClassName: ""
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:18
- If certController.networkPolicy.enabled is set to true while egress/ingress remain empty arrays, the current
withblocks renderegress:/ingress:with no value (null). This can yield an invalid NetworkPolicy manifest and break installs. Render the arrays directly (so empty arrays become[]) or omit the fields when empty.
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/Chart.yaml:2
- The PR description says "TODO: Update app version in apps.yaml", but this change set doesn't update
apps.yaml(andapps.yamlcurrently has no external-secrets entry). Either updateapps.yamlto track external-secrets' appVersion or remove/clarify the TODO so version sources of truth are consistent.
apiVersion: v2
appVersion: v2.8.0
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The new NetworkPolicy templates can render invalid YAML/manifests when egress/ingress values are empty lists (default), which would break installs when users enable these policies.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (4)
charts/external-secrets/templates/networkpolicy.yaml:17
- When
.Values.networkPolicy.egress(or ingress) is an empty list (the default in values.yaml), the template still renders theegress:key with no list items, which becomesegress: nullin YAML. Kubernetes expectsegress/ingressto be an array when present, so enabling the NetworkPolicy with default values will produce an invalid manifest.
spec:
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:17
- When
.Values.certController.networkPolicy.egress(or ingress) is an empty list (the default in values.yaml), the template still renders theegress:key with no list items, which becomesegress: nullin YAML. Kubernetes expectsegress/ingressto be an array when present, so enabling this NetworkPolicy with default values will produce an invalid manifest.
spec:
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:17
- When
.Values.webhook.networkPolicy.egress(or ingress) is an empty list (the default in values.yaml), the template still renders theegress:key with no list items, which becomesegress: nullin YAML. Kubernetes expectsegress/ingressto be an array when present, so enabling this NetworkPolicy with default values will produce an invalid manifest.
spec:
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/values.yaml:826
- The
# -- Pod priority class name.comment is mis-indented undercertController.networkPolicy, whilepriorityClassNameis a sibling field ofnetworkPolicy. This breaks readability and also causes generated docs (README) to lose the description forcertController.priorityClassName.
egress: []
# -- Pod priority class name.
priorityClassName: ""
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The newly added NetworkPolicy templates can render egress:/ingress: as null for empty lists (invalid for array fields) and there is a values.yaml indentation issue that breaks documentation generation for certController.priorityClassName.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (4)
charts/external-secrets/templates/networkpolicy.yaml:18
- The
networkPolicy.egress/ingressblocks are wrapped inwith, so when a user sets either value to an empty list ([]) Helm rendersegress:/ingress:asnull(no list), which is invalid for the NetworkPolicy array fields and can fail Kubernetes schema validation. Render an explicit empty list (or always render the list) instead of omitting the value.
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/webhook-networkpolicy.yaml:18
- The
webhook.networkPolicy.egress/ingressblocks are wrapped inwith, so setting either value to an empty list ([]) rendersegress:/ingress:asnull(no list), which is invalid for the NetworkPolicy array fields and can fail Kubernetes schema validation. Render an explicit empty list (or always render the list) instead of omitting the value.
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:18
- The
certController.networkPolicy.egress/ingressblocks are wrapped inwith, so setting either value to an empty list ([]) rendersegress:/ingress:asnull(no list), which is invalid for the NetworkPolicy array fields and can fail Kubernetes schema validation. Render an explicit empty list (or always render the list) instead of omitting the value.
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/values.yaml:826
- The
priorityClassNamecomment is indented undercertController.networkPolicy, so it no longer documentscertController.priorityClassNameand causes generated docs (README) to lose the description. Unindent the comment to align withpriorityClassName.
# -- Pod priority class name.
priorityClassName: ""
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The newly added NetworkPolicy templates can render invalid YAML (egress:/ingress: as null) when enabled with default empty lists.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (3)
charts/external-secrets/templates/networkpolicy.yaml:18
- When the NetworkPolicy is enabled and
*.networkPolicy.egress(oringress) is an empty list (the chart default), the currentwithblock rendersegress:/ingress:with a null value, which is not a valid NetworkPolicy spec. Render the arrays directly so empty lists become[]rather thannull.
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/webhook-networkpolicy.yaml:18
- When the webhook NetworkPolicy is enabled and
webhook.networkPolicy.egress(oringress) is an empty list (the chart default), the currentwithblock rendersegress:/ingress:with a null value, which is not a valid NetworkPolicy spec. Render the arrays directly so empty lists become[]rather thannull.
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:18
- When the cert-controller NetworkPolicy is enabled and
certController.networkPolicy.egress(oringress) is an empty list (the chart default), the currentwithblock rendersegress:/ingress:with a null value, which is not a valid NetworkPolicy spec. Render the arrays directly so empty lists become[]rather thannull.
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Not ready to approve
The new NetworkPolicy templates can render egress/ingress as null when lists are empty (risking API validation errors), and there’s a values.yaml indentation issue that breaks/misleads generated documentation.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (4)
charts/external-secrets/templates/networkpolicy.yaml:18
- The egress/ingress blocks render
egress:/ingress:unconditionally, but the content is gated by awith. With the defaultnetworkPolicy.egress: [], Helm will outputegress:with a null value, which can fail Kubernetes schema validation (expects an array) when networkPolicy is enabled. Render an explicit empty list ([]) or always render the list value viatoYamlso the field is always an array.
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/webhook-networkpolicy.yaml:18
- Same issue as the controller NetworkPolicy template:
egress:/ingress:are always emitted, but list rendering is inside awith. If either list is empty, the manifest will contain a null value instead of an array, which can be rejected by the API server. Render an explicit empty list ([]) or always render the list viatoYaml.
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:18
- Same issue as the other NetworkPolicy templates: the
egress:/ingress:fields are emitted unconditionally but may end up null if the corresponding list is empty due to thewith. This can lead to schema validation errors when enabling the NetworkPolicy. Render explicit empty lists or always render the list value viatoYaml.
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
charts/external-secrets/values.yaml:826
- The "Pod priority class name" comment is indented as if it were part of
certController.networkPolicy, butpriorityClassNameis a sibling field. This makes the values file misleading for users editing networkPolicy settings.
# -- Pod priority class name.
priorityClassName: ""
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟡 Changes recommended
The newly added NetworkPolicy templates can render invalid YAML when ingress/egress values are empty lists (the default for egress), which can break installs when NetworkPolicies are enabled.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (4)
charts/external-secrets/templates/networkpolicy.yaml:21
egress:/ingress:are always emitted, but the contents are wrapped inwith. When the value is an empty list (the default foregress), Helm treats it as falsey so nothing is rendered, leavingegress:with no value (invalid YAML) and breaking installs whennetworkPolicy.enabledis true. Render[]for empty lists (or omit the key entirely) instead of leaving it null.
egress:
{{- with .Values.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/webhook-networkpolicy.yaml:21
- Same issue as
templates/networkpolicy.yaml:egress:andingress:keys are always emitted, but empty lists are falsey insidewith, producingegress:with no value (invalid YAML) whenwebhook.networkPolicy.egressis[](the default).
egress:
{{- with .Values.webhook.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.webhook.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/templates/cert-controller-networkpolicy.yaml:21
- Same issue as the other NetworkPolicy templates: if
certController.networkPolicy.egressoringressis set to an empty list, thewithblock renders nothing and the YAML ends up with a key that has no value (egress:/ingress:), which is invalid.
egress:
{{- with .Values.certController.networkPolicy.egress }}
{{- toYaml . | nindent 4 }}
{{- end }}
ingress:
{{- with .Values.certController.networkPolicy.ingress }}
{{- toYaml . | nindent 4 }}
{{- end }}
charts/external-secrets/values.yaml:826
- The
certController.priorityClassNamedescription comment is indented undercertController.networkPolicy, so doc generation treats it as belonging to the wrong key (and the README row loses its description). Align the# --comment indentation withpriorityClassName.
# -- Pod priority class name.
priorityClassName: ""
- Files reviewed: 27/27 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
This PR updates the dependency external-secrets to version 2.8.0.
TODO: Update app version in apps.yaml.