Repository navigation
feat(agents): eso-cve-patch - #87
Conversation
Bump ESO Helm chart targetRevision from 0.10.7 to 2.4.0 to remediate CVE-2026-34165 and CVE-2026-33762, both fixed in ESO v2.4.0. The upgrade also brings improved VaultDynamicSecret GET method support. installCRDs is enabled, so ArgoCD will apply any CRD updates alongside the operator upgrade. Previous version: 0.10.7 New version: 2.4.0 Proposal: platform-gitops/agents-state/mctl-gitops/proposals/eso-cve-patch/
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ac6d81214
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| repoURL: https://charts.external-secrets.io | ||
| chart: external-secrets | ||
| targetRevision: 0.10.7 | ||
| targetRevision: 2.4.0 |
There was a problem hiding this comment.
Bumping the chart to 2.4.0 without any accompanying API migration will break GitOps applies for this repo’s existing External Secrets manifests, which are still on external-secrets.io/v1beta1 (for example under platform-gitops/bootstrap/templates/... and platform-gitops/argo-workflows/...). In chart 2.4.x, crds.unsafeServeV1Beta1 defaults to false, so the CRDs stop serving v1beta1; Argo/Kubernetes then rejects these manifests with no matches for kind ... in version external-secrets.io/v1beta1. This commit changes only targetRevision, so it should either enable v1beta1 serving during transition or migrate manifests to v1 in the same rollout.
Useful? React with 👍 / 👎.
ESO 2.4.x defaults crds.unsafeServeV1Beta1 to false, which removes v1beta1 from the CRD's served list. The repo still has many external-secrets.io/v1beta1 ExternalSecret manifests under bootstrap/templates/, argo-workflows/, services/... — without this override, ArgoCD applies will fail with 'no matches for kind ... in version external-secrets.io/v1beta1' right after the chart syncs. Setting unsafeServeV1Beta1: true keeps v1beta1 serving during the transition. A follow-up PR migrates all manifests to v1 and then this flag can be dropped. Addresses codex P1 finding on PR #87.
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Implements accepted proposal
mctl-gitops/eso-cve-patch.Spec: https://github.com/mctlhq/mctl-gitops/tree/main/platform-gitops/agents-state/mctl-gitops/proposals/eso-cve-patch/
Generated by mctl-agents Tier 2 implementer. Review carefully — this PR was opened automatically and the spec may have gaps.