This MR contains the following updates:

Package	Update	Change
bb-common	minor	`1.5.0` → `1.6.0`
external-secrets	minor	`2.10.0` → `2.11.0`
gluon	patch	`1.1.7` → `1.1.8`
registry1.dso.mil/ironbank/opensource/external-secrets/external-secrets (source)	minor	`v2.10.0` → `v2.11.0`

Complete MR checklist

Assignee

Followed upgrade instructions outlined in docs/DEVELOPMENT_MAINTENANCE.md
Update Docs with new/updated steps as needed
Tested and Validated Changes made with supporting info like logs or screenshots from test pipelines

Add supporting info below

Reviewer only

Tested and Validated changes

Release Notes

external-secrets/external-secrets (external-secrets)

`v2.11.0`

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.11.0 Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi Image: ghcr.io/external-secrets/external-secrets:v2.11.0-ubi-boringssl

What's Changed

General

chore: release helm chart for 2.10.0 by @Skarlso in #6882
docs: use --hostname all in the Bitwarden webhook example by @ggiesen in #6850
fix(ci): zizmor no-op blocks gates by @evrardj-roche in #6889
feat(barbican): Support OpenStack Barbican authentication via Application Credentials by @JaviMore in #6082
clean: replace k8s.io/utils pointer helpers with the new builtin by @alekc in #6902
feat(webhook): return not supported error for GetAllSecrets by @Abderraoufzekkour in #6817
fix(keepersecurity): return NoSecretErr for missing records by @alliasgher in #6816
fix: doc builds may set different user/group ownership on git repo objects by @evrardj-roche in #6901
fix: Use local GCP import for Vault modules by @evrardj-roche in #6904
fix: guarantee replaces by @evrardj-roche in #6905
chore: bump grpc by @evrardj-roche in #6909
fix: bump Makefile license-eye image to 0.9.0 by @dronenb in #6855
feat(infisical): add option to keep duplicate secret keys by @mathnogueira in #6908
ref: move provider constants by @evrardj-roche in #6883
feat: allow specifying namespace for grafana dashboard ConfigMap by @okwilkins in #6920
fix(keepersecurity): make folderID optional except when creating new records via push by @LGKentang in #6921
docs(templating): remove duplicate a in TemplateFrom Literal note by @mrchatam in #6953
feat(ci): close pull requests that drop a template section by @alekc in #6881
feat(charts): add global.imageRegistry to the external-secrets chart by @alekc in #6983
chore: update skywalking-eyes by @evrardj-roche in #6970
ref: fix Sonarqube linting alerts by @evrardj-roche in #6974
chore: Revert #6908 by @evrardj-roche in #6991
chore: prepare release support matrix by @evrardj-roche in #6993

Dependencies

chore(deps): bump golang from 484ef60 to ded31c6 in /e2e by @dependabot[bot] in #6892
chore(deps): bump ubi9/ubi from 5426a8f to 25a147d by @dependabot[bot] in #6890
chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in #6895
chore(deps): bump the codeql group across 1 directory with 3 updates by @dependabot[bot] in #6893
chore(deps): bump azure/login from 3.0.1 to 3.0.2 by @dependabot[bot] in #6896
chore(deps): bump golang from 1.27.0-bookworm to 1.27.1-bookworm in /e2e by @dependabot[bot] in #6923
chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 by @dependabot[bot] in #6925
chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #6927
chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #6924
chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #6926
chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in #6928
chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #6929
chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #6960
chore(deps): bump ubi9/ubi from 25a147d to c5cc9c2 by @dependabot[bot] in #6956

New Contributors

@ggiesen made their first contribution in #6850
@JaviMore made their first contribution in #6082
@Abderraoufzekkour made their first contribution in #6817
@okwilkins made their first contribution in #6920
@LGKentang made their first contribution in #6921
@mrchatam made their first contribution in #6953

Full Changelog: https://github.com/external-secrets/external-secrets/compare/v2.10.0...v2.11.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this MR, check this box

This MR was automatically generated by Renovate Bot.

Upgrade Notices

Before upgrading an existing installation, refresh the CRDs with kubectl apply --server-side --force-conflicts -f https://raw.githubusercontent.com/external-secrets/external-secrets/helm-chart-2.11.0/deploy/crds/bundle.yaml, then upgrade the package. The force flag transfers the bundled CRD schema fields from Helm for this refresh; do not use it for locally customized CRDs without reviewing the differences. This package retains separately managed CRDs; see the upstream CRD instructions.

Linked issues

Closes: #135 (closed)

Edited Sep 22, 2026 by Matt Vasquez

Admin message

Update Ironbank