chore(deps): update helm release external-secrets to v2.8.0

[renovate]

This PR contains the following updates:

Package	Update	Change
external-secrets	minor	2.7.0 → 2.8.0

---

Release Notes

external-secrets/external-secrets (external-secrets)

v2.8.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v2.8.0
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v2.8.0-ubi-boringssl

What's Changed

General

• chore: release helm chart 2.7.0 by @​Skarlso in #​6529
• docs(barbican): correct find semantics and document property/extract by @​alekc in #​6531
• docs(gcp): use external-secrets.io/v1 in SecretStore examples by @​alekc in #​6563
• feat(generators): add GitLab deploy token generator by @​alekc in #​6493
• fix(barbican): validate store config and fix SecretExists error message by @​alekc in #​6534
• docs(beyondtrust): fix capability matrix and document decrypt/separator by @​alekc in #​6535
• feat: Make SecondsToLive optional for Grafana generator by @​jaruwat-panturat in #​6479
• docs: add missing generators to ClusterGenerator spec snippet by @​jaruwat-panturat in #​6590
• docs(doppler): fix download format list and heading levels by @​alekc in #​6559
• docs(fortanix): add to support matrix and tidy provider page by @​alekc in #​6562
• docs(yandex): fix Lockbox referent cell and add Certificate Manager rows by @​alekc in #​6585
• docs(volcengine): mark referent authentication as supported by @​alekc in #​6584
• docs(senhasegura): mark deletion + referent in matrix and fix title by @​alekc in #​6583
• docs(scaleway): mark referent auth in matrix and fix headings by @​alekc in #​6581
• docs(pulumi): correct find/referent matrix cells and fix headings by @​alekc in #​6578
• docs(previder): correct find/referent matrix cells and fix headings by @​alekc in #​6577
• docs(1password): mark SDK find support in matrix and promote titles by @​alekc in #​6568
• feat(charts): Add aggregateToAdmin toggle by @​illrill in #​6586
• docs(providers): consolidate 11 conflicting provider-doc PRs by @​alekc in #​6592
• feat(charts): add startupProbe support to webhook deployment by @​alpcanaydin in #​6612
• feat(akeyless): support azure_ad Workload Identity via serviceAccountRef by @​baraka-akeyless in #​6530
• docs(kubernetes): fix invalid tab indentation and heading levels by @​alekc in #​6565
• docs(dvls): mark DeletionPolicy supported and fix page title by @​alekc in #​6557
• docs(bitwarden): fix find behaviour, find-by-name rules, and admonitions by @​alekc in #​6551
• docs(github): add to support matrix, fix auth field, tidy page by @​alekc in #​6564
• docs: Improve explanations of pem_chain by @​evrardjp in #​6623
• feat: Make our stance regarding AI usage more explicit. by @​evrardj-roche in #​6621
• fix(barbican): treat find.name.regexp as a regexp, not an exact match by @​arpitjain099 in #​6614
• chore: update go version 1.26.5 - Fix CVE-2026-39822 by @​alekc in #​6631
• ref(testing): change the e2e workflow to separate building stage from e2e stage (and free up resources) by @​alekc in #​6634
• chore: updating ok-to-test to allow interim maintainers by @​gusfcarvalho in #​6638
• fix(onepassword): support PushSecret IfNotExists by @​civilizedBaboon in #​6646
• fix(testing): check out PR head in fork e2e instead of main by @​alekc in #​6647
• fix(secretserver): validate store and map fields correctly by @​dbinger in #​6616
• feat(charts): Add optional networkPolicy by @​jcpunk in #​5779
• feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache by @​baraka-akeyless in #​6507
• feat(provider): implement AWS Certificate Manager provider by @​dsp0x4 in #​6117
• feat: expose more values for custom metadata for vault v2 by @​Skarlso in #​6652
• clean: Remove duplicate code by @​evrardj-roche in #​6629
• feat: configurable leader election lease timings by @​izz-linux in #​6644
• fix(akeyless): support dataFrom.extract.property for nested JSON by @​baraka-akeyless in #​6633
• feat(conjur): Certificate Auth support by @​hdabrowski in #​6393
• docs(aws): restore dropped access section and document missing fields by @​alekc in #​6517
• feat(secretserver): support authentication via access token by @​sumanpal97 in #​6597
• docs(secretserver): document authentication, key formats, property behavior, and limitations by @​dbinger in #​6619
• feat(release): Support reading values from kubernetes CRD by @​alekc in #​6211
• clean: Standardize and friendly name for validations policies by @​evrardj-roche in #​6630
• feat: add CreateOrMerge creation policy for ExternalSecrets by @​alekc in #​6641
• feat(core): accept duration string for SecretStore refreshInterval by @​alekc in #​6594
• fix(beyondtrust): validate store without panicking on API key auth by @​emmayusufu in #​6553
• fix(oracle): cache default WorkloadIdentity provider to prevent tcp port exhaustion by @​Ashutosh-3601 in #​6421

Dependencies

• chore(deps): bump golang from 3ad5730 to 3ad5730 by @​dependabot[bot] in #​6538
• chore(deps): bump ubi9/ubi from 1b99266 to 37a1589 by @​dependabot[bot] in #​6537
• chore(deps): bump golang from 5f68ec6 to b305420 in /e2e by @​dependabot[bot] in #​6539
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​6540
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 by @​dependabot[bot] in #​6542
• chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @​dependabot[bot] in #​6543
• chore(deps): bump azure/setup-helm from 5.0.0 to 5.0.1 by @​dependabot[bot] in #​6544
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​6541
• chore(deps): bump actions/cache from 5.0.5 to 6.1.0 by @​dependabot[bot] in #​6545
• chore(deps): bump golang from 3ad5730 to 3ad5730 by @​dependabot[bot] in #​6600
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6606
• chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​6603
• chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @​dependabot[bot] in #​6607
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @​dependabot[bot] in #​6604
• chore(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @​dependabot[bot] in #​6608
• chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @​dependabot[bot] in #​6605
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in #​6602
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @​dependabot[bot] in #​6601
• chore(deps): bump ubi9/ubi from 37a1589 to 8bf0e8f by @​dependabot[bot] in #​6599
• chore(deps): bump golang from 1.26.4 to 1.26.5 by @​dependabot[bot] in #​6636
• chore(deps): bump distroless/static from 3592aa8 to d5f030c by @​dependabot[bot] in #​6635

New Contributors

• @​alpcanaydin made their first contribution in #​6612
• @​baraka-akeyless made their first contribution in #​6530
• @​arpitjain099 made their first contribution in #​6614
• @​civilizedBaboon made their first contribution in #​6646
• @​dbinger made their first contribution in #​6616
• @​dsp0x4 made their first contribution in #​6117
• @​izz-linux made their first contribution in #​6644
• @​hdabrowski made their first contribution in #​6393
• @​sumanpal97 made their first contribution in #​6597
• @​emmayusufu made their first contribution in #​6553
• @​Ashutosh-3601 made their first contribution in #​6421

Full Changelog: external-secrets/external-secrets@v2.7.0...v2.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 5 errors

Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/9.6.0/descriptors/bash_bash_exec/
-----------------------------------------------

✅ [SUCCESS] scripts/dr-rebuild-supersession-guard.sh
❌ [ERROR] scripts/ghcr-auth-lib.sh
    Error: File:[scripts/ghcr-auth-lib.sh] is not executable

✅ [SUCCESS] scripts/guard-cilium-homogeneous-device-rollout.sh
✅ [SUCCESS] scripts/megalinter-scan-counts.sh
✅ [SUCCESS] scripts/normalize-sarif-paths.sh
❌ [ERROR] scripts/refresh-flux-ghcr-auth-safety.sh
    Error: File:[scripts/refresh-flux-ghcr-auth-safety.sh] is not executable

✅ [SUCCESS] scripts/refresh-flux-ghcr-auth.sh
✅ [SUCCESS] scripts/run-ksail-prod-with-pull-auth.sh
✅ [SUCCESS] scripts/summarize-sarif-findings.sh
✅ [SUCCESS] scripts/tests/test-cilium-bandwidth-manager-component.sh
✅ [SUCCESS] scripts/tests/test-cilium-homogeneous-devices-activation.sh
✅ [SUCCESS] scripts/tests/test-cilium-homogeneous-devices-autoscaler-gate.sh
✅ [SUCCESS] scripts/tests/test-cilium-homogeneous-devices-flux-wait.sh
✅ [SUCCESS] scripts/tests/test-dr-rebuild-supersession-guard.sh
❌ [ERROR] scripts/tests/test-normalize-sarif-paths.sh
    Error: File:[scripts/tests/test-normalize-sarif-paths.sh] is not executable

✅ [SUCCESS] scripts/tests/test-openbao-oidc-role.sh
❌ [ERROR] scripts/tests/test-opencost-usage-scraper.sh
    Error: File:[scripts/tests/test-opencost-usage-scraper.sh] is not executable

❌ [ERROR] scripts/tests/test-refresh-flux-ghcr-auth-safety.sh
    Error: File:[scripts/tests/test-refresh-flux-ghcr-auth-safety.sh] is not executable

✅ [SUCCESS] scripts/tests/test-summarize-sarif-findings.sh
✅ [SUCCESS] scripts/validate-alert-coverage.sh
✅ [SUCCESS] scripts/wait-for-platform-flux-revision.sh

⚠️ REPOSITORY / checkov - 68 errors

16 |     - secretKey: red**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/apps/fleetdm/helm-release.yaml:328-329
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		328 |         existingSecretPasswordKey: red**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/apps/headlamp/external-secret.yaml:15-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		15 |     - secretKey: cli**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/apps/umami/helm-release.yaml:118-119
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		118 |         existingSecret: umam**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/apps/wedding-app/external-secret-ghcr-auth.yaml:34-35
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		34 |     - secretKey: dock**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/controllers/dex/external-secret.yaml:30-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		30 |     - secretKey: cli**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/controllers/velero/helm-release.yaml:108-109
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		108 |       existingSecret: veler**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/external-secrets/ghcr-auth.yaml:25-26
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		25 |     - secretKey: dock**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml:166-167
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		166 |             - secretKey: dock**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-config/external-secret.yaml:15-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		15 |     - secretKey: dex-**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-seed/push-secret-seed-actual-budget-enablebanking.yaml:26-27
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		26 |         secretKey: app**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-seed/push-secret-seed-oauth2-proxy-cookie-secret.yaml:17-18
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		17 |         secretKey: oauth2**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-seed/push-secret-seed-r2-credentials.yaml:44-45
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		44 |         secretKey: r2_a**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-seed/push-secret-seed-r2-credentials.yaml:49-50
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		49 |         secretKey: r2_se**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-seed/push-secret-seed-velero-repo-credentials.yaml:36-37
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		36 |         secretKey: repo**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/bases/infrastructure/vault-seed/secret-actual-budget-encryption-placeholder.yaml:25-26
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		25 |   password: PL**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/providers/hetzner/apps/unifi/external-secret-wireguard.yaml:26-27
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		26 |     - secretKey: pr**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/providers/hetzner/apps/unifi/external-secret-wireguard.yaml:30-31
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		30 |     - secretKey: pee**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/providers/hetzner/infrastructure/cluster-issuers/cloudflare-api-token-external-secret.yaml:15-16
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		15 |     - secretKey: ap**********

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: HIDDEN_BY_MEGALINTER	File: /k8s/providers/hetzner/infrastructure/external-dns/external-secret.yaml:24-25
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/secrets-policies/secrets-policy-index/git-secrets-6

		24 |     - secretKey: ap**********

github_actions scan results:

Passed checks: 100, Failed checks: 0, Skipped checks: 0

(Truncated to last 6666 characters out of 28147)

⚠️ SPELL / cspell - 2549 errors

"Valkey",
        "Velero",
        "Velero's",
        "Virt",
        "WLANs",
        "Yubi",
        "ZIZMOR",
        "admissionregistration",
        "alertmanager",
        "alertname",
        "alsonope",
        "analysed",
        "anchore",
        "antiaffinity",
        "apid",
        "apiserver",
        "apiserver's",
        "argjson",
        "artipacked",
        "ascoachingogvaner",
        "ascoachingogvaner's",
        "authorised",
        "automerged",
        "automount",
        "autoscalers",
        "awspca",
        "backupstoragelocations",
        "baselining",
        "bcdfghjklmnpqrstvwxz",
        "behaviour",
        "behavioural",
        "betterleaks",
        "bitnami",
        "blocklist",
        "browsable",
        "buildx",
        "burstable",
        "cadvisor",
        "callsite",
        "capitalised",
        "certificaterequest",
        "chokepoint",
        "ciphertext",
        "clickhouse",
        "cloudnative",
        "cloudprovider",
        "clusterissuer",
        "clusterpolicies",
        "clusterrolebindings",
        "clusterroles",
        "cmdline",
        "cnpg",
        "coderabbit",
        "configmap",
        "controlplane",
        "controlplaneio",
        "cooldown",
        "coroot",
        "covermode",
        "coverprofile",
        "crashloop",
        "crashloops",
        "creds",
        "crossplane",
        "crossview",
        "customise",
        "cutover",
        "cyclonedx",
        "daemonset",
        "datapath",
        "datreeio",
        "dbname",
        "dedupe",
        "defence",
        "deletecollection",
        "deploymentruntimeconfigs",
        "descheduler",
        "descheduling",
        "desynchronising",
        "devantler",
        "diffable",
        "dockerconfigjson",
        "docstrings",
        "dorny",
        "dpkg",
        "emptydir",
        "endgroup",
        "envsubst",
        "esac",
        "etcdctl",
        "evictable",
        "externalsecret",
        "externalsecrets",
        "fanout",
        "featureflagsource",
        "fleetdm",
        "fromdateiso",
        "gatewayapi",
        "generatable",
        "generatingpolicies",
        "genkey",
        "gethomepage",
        "gitops",
        "golangci",
        "gosec",
        "grjtvs",
        "growfs",
        "growpart",
        "healthchecks",
        "healthz",
        "helmrelease",
        "helmreleases",
        "helmv",
        "homelab",
        "hostnames",
        "httproute",
        "imagetools",
        "imagevalidatingpolicy",
        "imranismail",
        "inspectable",
        "iscsi",
        "ivpol",
        "keypair",
        "kprobes",
        "kptr",
        "krew",
        "ksail",
        "ksail's",
        "ksailcd",
        "kubeconfig",
        "kubeconform",
        "kubeconform's",
        "kubelet",
        "kubelet's",
        "kubelets",
        "kubelogin",
        "kubescape",
        "kubespan",
        "kubevirt",
        "kubevuln",
        "kustomization",
        "kustomizations",
        "kyverno",
        "letsencrypt",
        "libc",
        "libgnutls",
        "lintable",
        "livez",
        "loadtester",
        "locationless",
        "luks",
        "lycheeignore",
        "machineconfig",
        "materialise",
        "materialised",
        "materialises",
        "maxage",
        "maxbackup",
        "maxsize",
        "maxx",
        "microtime",
        "misconfig",
        "misconfigs",
        "mktemp",
        "mlock",
        "mutatingpolicies",
        "mutatingwebhookconfigurations",
        "myapp",
        "najsk",
        "neighbour",
        "netlink",
        "netpol",
        "netpols",
        "nftables",
        "nilnil",
        "nodepod",
        "nodeport",
        "nolint",
        "normalisation",
        "normalising",
        "nullglob",
        "openbao",
        "opencost",
        "openfeature",
        "oras",
        "overprovisioning",
        "parallelised",
        "pasteable",
        "permissioning",
        "pipefail",
        "policyignore",
        "policyreports",
        "portforward",
        "preemptible",
        "preservingly",
        "prioritised",
        "privesc",
        "providerconfigs",
        "publishapp",
        "publishprovider",
        "pushsecret",
        "pushsecrets",
        "rdqwpktr",
        "readyz",
        "reassertions",
        "recognise",
        "recognised",
        "reconverges",
        "refreshfluxghcrauth",
        "regenerable",
        "releaserc",
        "rematerialise",
        "rematerialised",
        "repoint",
        "repointed",
        "repoints",
        "repositoryrulesets",
        "resizer",
        "restrictor",
        "retabbed",
        "rmem",
        "rolebindings",
        "rollouts",
        "rshared",
        "sarif",
        "schedulability",
        "schedulable",
        "scopeable",
        "seccomp",
        "secretbox",
        "secretstore",
        "seedable",
        "serialised",
        "serverside",
        "serviceaccount",
        "serviceaccounts",
        "sgdisk",
        "shellcheck",
        "shfmt",
        "shopt",
        "siderolabs",
        "siderolink",
        "sigstore",
        "skmde",
        "slurpfile",
        "sngle",
        "spiffe",
        "srole",
        "startswith",
        "statefulset",
        "statemanager",
        "stdlib",
        "storageclass",
        "summarised",
        "syft",
        "syft's",
        "syscall",
        "sysctls",
        "talosconfig",
        "talosctl",
        "tanzu",
        "templatesyncignore",
        "thresholded",
        "tmpl",
        "tostring",
        "tracepoints",
        "trixie",
        "trueish",
        "trustd",
        "umami",
        "umami's",
        "uncertifiable",
        "unclickable",
        "uncordon",
        "uncordoned",
        "unifi",
        "unmarshalling",
        "unparseable",
        "unrecognised",
        "unreviewed",
        "unroutable",
        "unrun",
        "unshippable",
        "untrackable",
        "upbound",
        "updatekeys",
        "upjet",
        "upstreaming",
        "urlencode",
        "userns",
        "ushfn",
        "validatable",
        "validatealertcoverage",
        "validatingwebhookconfigurations",
        "vcunav",
        "velero",
        "volumesnapshot",
        "vulns",
        "vxlan",
        "wffc",
        "wgpolicyk",
        "wmem",
        "worktrees",
        "yannh",
        "yubikey",
        "yzwvjjmcyfnl",
        "zizmor"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository

(Truncated to last 6666 characters out of 445202)

⚠️ COPYPASTE / jscpd - 119 errors

- 420:28] (9 lines, 58 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_core_test.go [465:2 - 473:28]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_core_test.go [463:87 - 477:5] (15 lines, 72 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_core_test.go [488:83 - 502:5]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [52:25 - 57:11] (6 lines, 53 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [66:28 - 71:11]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [128:47 - 134:22] (7 lines, 50 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [340:21 - 346:22]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [261:3 - 268:37] (8 lines, 56 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [285:3 - 292:37]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [370:69 - 379:5] (10 lines, 57 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [384:83 - 393:5]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [422:68 - 430:5] (9 lines, 51 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [435:83 - 443:5]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [447:52 - 464:5] (18 lines, 123 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [468:57 - 485:5]
Clone found (go)
 - scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [492:77 - 508:11] (17 lines, 118 tokens)
   scripts/tests/refresh-flux-ghcr-auth/rollout_safety_test.go [519:110 - 535:11]
Clone found (bash)
 - scripts/tests/test-cilium-bandwidth-manager-component.sh [9:1 - 54:2] (46 lines, 202 tokens)
   scripts/tests/test-cilium-homogeneous-devices-activation.sh [9:1 - 54:2]
Clone found (bash)
 - scripts/tests/test-cilium-bandwidth-manager-component.sh [52:5 - 72:2] (21 lines, 67 tokens)
   scripts/tests/test-cilium-homogeneous-devices-activation.sh [80:23 - 100:2]
Clone found (bash)
 - scripts/tests/test-cilium-bandwidth-manager-component.sh [54:1 - 72:2] (19 lines, 65 tokens)
   scripts/tests/test-opencost-usage-scraper.sh [15:1 - 33:2]
Clone found (bash)
 - scripts/tests/test-refresh-flux-ghcr-auth-safety.sh [177:5 - 185:51] (9 lines, 76 tokens)
   scripts/tests/test-refresh-flux-ghcr-auth-safety.sh [186:5 - 194:51]
Clone found (python)
 - scripts/tests/test_validate_homepage_bookmarks.py [46:57 - 54:54] (9 lines, 58 tokens)
   scripts/tests/test_validate_homepage_bookmarks.py [100:53 - 109:54]
Clone found (go)
 - scripts/validate-dr-signing/main.go [92:21 - 124:5] (33 lines, 145 tokens)
   scripts/validate-merge-group-heal/main.go [69:40 - 101:5]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [244:50 - 249:24] (6 lines, 103 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [756:31 - 761:24]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [276:14 - 282:4] (7 lines, 115 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [603:43 - 609:4]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [388:5 - 393:2] (6 lines, 82 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [574:8 - 579:9]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [389:1 - 399:23] (11 lines, 220 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [666:60 - 677:3]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [393:15 - 404:2] (12 lines, 185 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [494:17 - 505:2]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [440:15 - 451:12] (12 lines, 264 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [649:1 - 662:3]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [503:2 - 509:19] (7 lines, 89 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [688:7 - 694:19]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [503:2 - 509:33] (7 lines, 103 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [943:58 - 949:33]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [503:2 - 509:4] (7 lines, 74 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [1056:5 - 1062:4]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [596:30 - 601:8] (6 lines, 50 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [623:44 - 628:8]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [881:33 - 889:11] (9 lines, 118 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [893:130 - 901:11]
Clone found (go)
 - scripts/validate-eks-ci-role-policy/main_test.go [1088:47 - 1093:2] (6 lines, 166 tokens)
   scripts/validate-eks-ci-role-policy/main_test.go [1142:46 - 1147:2]
Clone found (python)
 - scripts/validate-naming.py [126:52 - 132:25] (7 lines, 53 tokens)
   scripts/validate-naming.py [171:82 - 177:29]
┌────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ bash   │ 24             │ 8672        │ 34674        │ 15           │ 195 (2.25%)      │ 1188 (3.43%)      │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ go     │ 22             │ 12290       │ 92419        │ 38           │ 330 (2.69%)      │ 3350 (3.62%)      │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ python │ 4              │ 807         │ 5606         │ 2            │ 14 (1.73%)       │ 111 (1.98%)       │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt    │ 57             │ 3378        │ 109125       │ 64           │ 2417 (71.55%)    │ 80219 (73.51%)    │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total: │ 107            │ 25147       │ 241824       │ 119          │ 2956 (11.75%)    │ 84868 (35.09%)    │
└────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 119 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (11.8%) over threshold (0.0%)
time: 837.483ms

(Truncated to last 6666 characters out of 27763)

⚠️ MARKDOWN / markdownlint - 63 errors

hould have a language specified [Context: "```"]
AGENTS.md:101:401 error MD013/line-length Line length [Expected: 400; Actual: 1769]
AGENTS.md:105:401 error MD013/line-length Line length [Expected: 400; Actual: 1126]
AGENTS.md:106:401 error MD013/line-length Line length [Expected: 400; Actual: 1447]
AGENTS.md:121:401 error MD013/line-length Line length [Expected: 400; Actual: 649]
AGENTS.md:123:401 error MD013/line-length Line length [Expected: 400; Actual: 971]
AGENTS.md:150:401 error MD013/line-length Line length [Expected: 400; Actual: 970]
AGENTS.md:153:401 error MD013/line-length Line length [Expected: 400; Actual: 453]
AGENTS.md:172:401 error MD013/line-length Line length [Expected: 400; Actual: 846]
AGENTS.md:241:401 error MD013/line-length Line length [Expected: 400; Actual: 491]
AGENTS.md:242:401 error MD013/line-length Line length [Expected: 400; Actual: 468]
AGENTS.md:248:401 error MD013/line-length Line length [Expected: 400; Actual: 532]
AGENTS.md:250:401 error MD013/line-length Line length [Expected: 400; Actual: 523]
AGENTS.md:253:401 error MD013/line-length Line length [Expected: 400; Actual: 613]
AGENTS.md:254:401 error MD013/line-length Line length [Expected: 400; Actual: 714]
AGENTS.md:258:401 error MD013/line-length Line length [Expected: 400; Actual: 502]
AGENTS.md:262:401 error MD013/line-length Line length [Expected: 400; Actual: 441]
AGENTS.md:267:401 error MD013/line-length Line length [Expected: 400; Actual: 427]
AGENTS.md:370:401 error MD013/line-length Line length [Expected: 400; Actual: 1012]
AGENTS.md:372:401 error MD013/line-length Line length [Expected: 400; Actual: 1240]
AGENTS.md:377:401 error MD013/line-length Line length [Expected: 400; Actual: 430]
AGENTS.md:388:401 error MD013/line-length Line length [Expected: 400; Actual: 1230]
AGENTS.md:399:401 error MD013/line-length Line length [Expected: 400; Actual: 790]
AGENTS.md:404:401 error MD013/line-length Line length [Expected: 400; Actual: 515]
CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
docs/dr/alerting.md:213:28 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:22:389 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:23:264 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:35 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:161 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:239 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:114 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:245 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:251 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it leaks"]
docs/dr/crypto-custody.md:258 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it is *lost* (no..."]
docs/dr/restore-drill.md:42 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:23:102 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:23:487 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:34 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:41 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:50 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:487:92 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/spire-server-ha.md:93 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/dr/velero-cnpg.md:11 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/dr/velero-cnpg.md:56:78 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/velero-cnpg.md:56:166 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/velero-cnpg.md:57:78 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/velero-cnpg.md:57:227 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/velero-cnpg.md:58:78 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/velero-cnpg.md:58:166 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/github-management.md:38:401 error MD013/line-length Line length [Expected: 400; Actual: 419]
docs/github-management.md:40:401 error MD013/line-length Line length [Expected: 400; Actual: 522]
docs/node-autoscaling.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/oidc-kubectl.md:95 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/runtime-security.md:114 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/rwx-storage.md:9 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:62 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
README.md:116:401 error MD013/line-length Line length [Expected: 400; Actual: 540]
README.md:237:32 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
README.md:237:36 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]

(Truncated to last 6666 characters out of 6992)

⚠️ REPOSITORY / trivy - 1 error

er/infrastructure/vertical-pod-autoscalers/spire-agent.yaml:9-13
────────────────────────────────────────
   9 ┌ spec:
  10 │   targetRef:
  11 │     apiVersion: apps/v1
  12 │     kind: DaemonSet
  13 └     name: spire-agent
────────────────────────────────────────



k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/spire-server.yaml (kubernetes)
============================================================================================
Tests: 118 (SUCCESSES: 116, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

KSV-0037 (MEDIUM): VerticalPodAutoscaler 'spire-server' should not be set with 'kube-system' namespace
════════════════════════════════════════
ensure that user resources are not placed in kube-system namespace

See https://avd.aquasec.com/misconfig/ksv-0037
────────────────────────────────────────
 k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/spire-server.yaml:7-11
────────────────────────────────────────
   7 ┌ spec:
   8 │   targetRef:
   9 │     apiVersion: apps/v1
  10 │     kind: StatefulSet
  11 └     name: spire-server
────────────────────────────────────────


KSV-0039 (LOW): A LimitRange policy with a default requests and limits for each container should be configured
════════════════════════════════════════
Ensure that a LimitRange policy is configured to limit resource usage for namespaces or nodes

See https://avd.aquasec.com/misconfig/ksv-0039
────────────────────────────────────────
 k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/spire-server.yaml:7-11
────────────────────────────────────────
   7 ┌ spec:
   8 │   targetRef:
   9 │     apiVersion: apps/v1
  10 │     kind: StatefulSet
  11 └     name: spire-server
────────────────────────────────────────



k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/tetragon-operator.yaml (kubernetes)
=================================================================================================
Tests: 118 (SUCCESSES: 116, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

KSV-0037 (MEDIUM): VerticalPodAutoscaler 'tetragon-operator' should not be set with 'kube-system' namespace
════════════════════════════════════════
ensure that user resources are not placed in kube-system namespace

See https://avd.aquasec.com/misconfig/ksv-0037
────────────────────────────────────────
 k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/tetragon-operator.yaml:7-11
────────────────────────────────────────
   7 ┌ spec:
   8 │   targetRef:
   9 │     apiVersion: apps/v1
  10 │     kind: Deployment
  11 └     name: tetragon-operator
────────────────────────────────────────


KSV-0039 (LOW): A LimitRange policy with a default requests and limits for each container should be configured
════════════════════════════════════════
Ensure that a LimitRange policy is configured to limit resource usage for namespaces or nodes

See https://avd.aquasec.com/misconfig/ksv-0039
────────────────────────────────────────
 k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/tetragon-operator.yaml:7-11
────────────────────────────────────────
   7 ┌ spec:
   8 │   targetRef:
   9 │     apiVersion: apps/v1
  10 │     kind: Deployment
  11 └     name: tetragon-operator
────────────────────────────────────────



k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/tetragon.yaml (kubernetes)
========================================================================================
Tests: 118 (SUCCESSES: 116, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

KSV-0037 (MEDIUM): VerticalPodAutoscaler 'tetragon' should not be set with 'kube-system' namespace
════════════════════════════════════════
ensure that user resources are not placed in kube-system namespace

See https://avd.aquasec.com/misconfig/ksv-0037
────────────────────────────────────────
 k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/tetragon.yaml:9-13
────────────────────────────────────────
   9 ┌ spec:
  10 │   targetRef:
  11 │     apiVersion: apps/v1
  12 │     kind: DaemonSet
  13 └     name: tetragon
────────────────────────────────────────


KSV-0039 (LOW): A LimitRange policy with a default requests and limits for each container should be configured
════════════════════════════════════════
Ensure that a LimitRange policy is configured to limit resource usage for namespaces or nodes

See https://avd.aquasec.com/misconfig/ksv-0039
────────────────────────────────────────
 k8s/providers/hetzner/infrastructure/vertical-pod-autoscalers/tetragon.yaml:9-13
────────────────────────────────────────
   9 ┌ spec:
  10 │   targetRef:
  11 │     apiVersion: apps/v1
  12 │     kind: DaemonSet
  13 └     name: tetragon
────────────────────────────────────────



ksail.prod.yaml (kubernetes)
============================
Tests: 118 (SUCCESSES: 117, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

KSV-0039 (LOW): A LimitRange policy with a default requests and limits for each container should be configured
════════════════════════════════════════
Ensure that a LimitRange policy is configured to limit resource usage for namespaces or nodes

See https://avd.aquasec.com/misconfig/ksv-0039
────────────────────────────────────────
 ksail.prod.yaml:7-257
────────────────────────────────────────
   7 ┌   name: prod
   8 │ spec:
   9 │   cluster:
  10 │     distributionConfig: talos
  11 │     connection:
  12 │       context: admin@prod
  13 │       timeout: 30m
  14 │     distribution: Talos
  15 └     provider: Hetzner
  ..   
────────────────────────────────────────



ksail.yaml (kubernetes)
=======================
Tests: 118 (SUCCESSES: 117, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

KSV-0039 (LOW): A LimitRange policy with a default requests and limits for each container should be configured
════════════════════════════════════════
Ensure that a LimitRange policy is configured to limit resource usage for namespaces or nodes

See https://avd.aquasec.com/misconfig/ksv-0039
────────────────────────────────────────
 ksail.yaml:7-55
────────────────────────────────────────
   7 ┌   name: local
   8 │ spec:
   9 │   cluster:
  10 │     distributionConfig: talos-local
  11 │     connection:
  12 │       context: admin@local
  13 │       timeout: 40m
  14 │     distribution: Talos
  15 └     provider: Docker
  ..   
────────────────────────────────────────



📣 Notices:
  - Version 0.72.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 804907)

✅ Linters with no issues

actionlint, betterleaks, git_diff, golangci-lint, grype, jsonlint, lychee, osv-scanner, prettier, prettier, revive, secretlint, shellcheck, shfmt, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint, zizmor

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository