DRAFT - Fix renovate and bump kubernetes provider to v3

[vbontempi]

Pending on terraform-ibm-modules/terraform-ibm-namespace#172
update namespace reference before merging

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
external-secrets		minor	1.0.0 -> 1.1.0
ghcr.io/external-secrets/external-secrets		minor	v1.0.0-ubi -> v1.1.0-ubi
github.com/gruntwork-io/terratest	require	minor	v0.53.0 -> v0.54.0
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper	require	patch	v1.60.29 -> v1.60.35
go (source)	toolchain	patch	1.25.4 -> 1.25.5
go (source)	golang	minor	1.24.0 -> 1.25.5
ibm (source)	required_provider	minor	1.85.0 -> 1.86.0
terraform-ibm-modules/base-ocp-vpc/ibm (source)	module	minor	3.73.2 -> 3.75.5
terraform-ibm-modules/secrets-manager-private-cert/ibm (source)	module	minor	1.8.1 -> 1.9.2
terraform-ibm-modules/secrets-manager-public-cert-engine/ibm (source)	module	minor	1.4.2 -> 1.6.1
terraform-ibm-modules/secrets-manager-public-cert/ibm (source)	module	minor	1.4.0 -> 1.5.0
terraform-ibm-modules/secrets-manager-secret-group/ibm (source)	module	patch	1.3.18 -> 1.3.19
terraform-ibm-modules/vpe-gateway/ibm (source)	module	patch	4.8.4 -> 4.8.5

---

Release required?

• No release
• Patch release (x.x.X)
• Minor release (x.X.x)
• Major release (X.x.x)

Release notes content

Release Notes

external-secrets/external-secrets (external-secrets)

v1.1.0

Compare Source

Image: ghcr.io/external-secrets/external-secrets:v1.1.0
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi
Image: ghcr.io/external-secrets/external-secrets:v1.1.0-ubi-boringssl

What's Changed

!NOTE!: During last community meeting we discussed that we are retiring our scarf account. With that, we will be changing back to ghcr.io/external-secrets/external-secrets instead of oci.external-secrets.io/external-secrets/external-secrets.

For now, the old domain will live for a couple months to give people to change back. With this release , the values in the helm chart that define where the image is switched back to ghcr.

The helm-chart itself is served from under github-pages so that does not move.

General

• chore(chart): release helm chart 1.0.0 by @​Skarlso in #​5552
• feat(security): add support for ECDSA ssh keys by @​bigjazzsound in #​5559
• fix: minor typo in comment of KeeperSecurity example by @​mdjong1 in #​5573
• docs(gcp): update documentation for using WorkloadIdentityFederation in non-GKE cluster by @​jennweir in #​5556
• chore(release): add darwin_arm64 releases by @​lbordowitz in #​5583
• feat: support override IAM endpoint in IBM provider for APIkey auth by @​fidel-ruiz in #​5550
• feat(security): build tags for all the providers to disable them on d… by @​ShimonDarshan in #​5578
• fix: do not include the last element of the path in the iteration by @​Skarlso in #​5588
• fix(k8s): support deleting whole secret by @​tiagolobocastro in #​5538
• fix(provider): configure TLS for secret server provider by @​Lumexralph in #​5558
• chore(aws): remove any usage of aws-sdk-v1 by @​Skarlso in #​5590
• fix(gcp): check for secret version exists in PushSecret by @​bpalko in #​5593
• feat(vault): add GCP Workload Identity authentication support by @​SamuelMolling in #​5356
• chore: fix sonar cloud issues by @​Skarlso in #​5405
• chore(aws-sdk-v2): update dependencies to accept new aws regions by @​damienpuig in #​5577
• feat(chart): use ghcr.io instead of our own domain by @​evrardjp in #​5617

Dependencies

• chore(deps): bump golang from 1.25.3 to 1.25.4 by @​dependabot[bot] in #​5560
• chore(deps): bump golang from 1.25.3-bookworm to 1.25.4-bookworm in /e2e by @​dependabot[bot] in #​5568
• chore(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 by @​dependabot[bot] in #​5561
• chore(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 by @​dependabot[bot] in #​5564
• chore(deps): bump helm/chart-testing-action from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​5565
• chore(deps): bump aws-actions/configure-aws-credentials from 0d00a56 to 2475ef7 by @​dependabot[bot] in #​5562
• chore(deps): bump helm/kind-action from 1.12.0 to 1.13.0 by @​dependabot[bot] in #​5563
• chore(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by @​dependabot[bot] in #​5567
• chore(deps): bump regex from 2025.10.23 to 2025.11.3 in /hack/api-docs by @​dependabot[bot] in #​5570
• chore(deps): bump markdown from 3.9 to 3.10 in /hack/api-docs by @​dependabot[bot] in #​5569
• chore(deps): bump hashicorp/setup-terraform from 982f6f0 to 4c5fdab by @​dependabot[bot] in #​5566
• chore(deps): bump golang from d3f0cf7 to d3f0cf7 by @​dependabot[bot] in #​5595
• chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @​dependabot[bot] in #​5596
• chore(deps): bump click from 8.3.0 to 8.3.1 in /hack/api-docs by @​dependabot[bot] in #​5602
• chore(deps): bump ubi9/ubi from dec374e to dcd8128 by @​dependabot[bot] in #​5594
• chore(deps): bump aws-actions/configure-aws-credentials from 2475ef7 to f2964c7 by @​dependabot[bot] in #​5597
• chore(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by @​dependabot[bot] in #​5598
• chore(deps): bump pymdown-extensions from 10.16.1 to 10.17.1 in /hack/api-docs by @​dependabot[bot] in #​5599
• chore(deps): bump certifi from 2025.10.5 to 2025.11.12 in /hack/api-docs by @​dependabot[bot] in #​5600
• chore(deps): bump mkdocs-material from 9.6.23 to 9.7.0 in /hack/api-docs by @​dependabot[bot] in #​5601
• chore(deps): bump mkdocs-macros-plugin from 1.4.1 to 1.5.0 in /hack/api-docs by @​dependabot[bot] in #​5603

New Contributors

• @​bigjazzsound made their first contribution in #​5559
• @​mdjong1 made their first contribution in #​5573
• @​jennweir made their first contribution in #​5556
• @​lbordowitz made their first contribution in #​5583
• @​fidel-ruiz made their first contribution in #​5550
• @​ShimonDarshan made their first contribution in #​5578
• @​bpalko made their first contribution in #​5593
• @​SamuelMolling made their first contribution in #​5356
• @​damienpuig made their first contribution in #​5577

Full Changelog: external-secrets/external-secrets@v1.0.0...v1.1.0

gruntwork-io/terratest (github.com/gruntwork-io/terratest)

v0.54.0

Compare Source

What's Changed

• Fix TerragruntArgs and TerraformArgs being ignored by @​james00012 in #​1617
• Simplify terragrunt function names by @​james00012 in #​1621
• Refactor: Extract formatting utilities to internal/lib by @​james00012 in #​1620
• Bump golang.org/x/crypto from 0.41.0 to 0.45.0 by @​dependabot[bot] in #​1625
• Add missing terragrunt commands: ValidateAll, RunAll, FormatAll, OutputListAll by @​james00012 in #​1622
• Upgrade terragrunt module tests to v0.93.10 by @​james00012 in #​1627

Full Changelog: gruntwork-io/terratest@v0.53.0...v0.54.0

terraform-ibm-modules/ibmcloud-terratest-wrapper (github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper)

v1.60.35

Compare Source

Bug Fixes

• cat type_metadata validaiton (#​1081) (9c89404)

v1.60.34

Compare Source

Bug Fixes

• deps: update dependencies (#​1078) (58feae3)

v1.60.33

Compare Source

Bug Fixes

• update region selector error message and add ssh troubleshooting docs (#​1082) (d4aa7b8)

v1.60.32

Compare Source

Bug Fixes

• guard against panic when configuration does not have a schematics workspace id (#​1080) (b2c9858)

v1.60.31

Compare Source

Bug Fixes

• set failure result correctly on deploy failure (#​1077) (0758d4a)

v1.60.30

Compare Source

Bug Fixes

• error on invalid offering flavour (#​1076) (f59aaf9)

IBM-Cloud/terraform-provider-ibm (ibm)

v1.86.0

Compare Source

Bug Fixes

Cloud Logs

• fix entity_label in logs_alert_Definition resource (6554)

AppConfig

• Fixing Issues in App Configuration Service (6545)

Global Catalog

• fixed import of ibm_cm_object (6553)
• renamed error variable for GlobalSearchV2 (6547)

IAM

• fix(ibm_iam_account_settings) when only updating user domain restrictions (6549)
• update trusted profile id policies to support both iam_id and profile_id (6543)

Power Systems

• Fix instance data sources to use id (6506)
• Refactor terraform errors to use new toolchain in network and route data sources (6552)

Schematics

• Fixed agent create crash (6570)

CIS

• handled nil pointer exceptions during runtime (6550)

Enhancements

VPC Infrastructure

• feat(vpn-gateway) - Add support for VPN Gateway as spoke of Transit Gateway (6546)
• updated the import for vpc resources (6548)

Resource Management

• added support for resource_groups datasource (6499)
• Added support for working with resource reclamations (6396)

DR Automation

• DR Automation Terraform Apis (6481)

Backup/Recovery

• Add instance and region update in connection token resource (6566)

Cloud Databases

• block unsupported Gen 2 plans with helpful validation message (6571)

Event Notification

• support for smtp user credentials clone (6535)

General

• bump actions/checkout from 5.0.0 to 5.0.1 (6556)
• bump golang.org/x/crypto from 0.41.0 to 0.45.0 (6562)
• bump bluemix-go (6574)

IAM

• add role templates & assignments (6539)

Transit Gateway

• tgw95 - vpn gateway changes (6339)

Documentation

General

• add provider-wide best practices section to CONTRIBUTING.md (6573)

Project

• regenerate projects provider with new go sdk level and API doc (6557)

terraform-ibm-modules/terraform-ibm-base-ocp-vpc (terraform-ibm-modules/base-ocp-vpc/ibm)

v3.74.0

Compare Source

Features

• added support to install required binary jq and kubectl if they do not exist. This can be disabled using the install_required_binaries boolean. NOTE: public access is required to pull the binaries from the internet. The binaries will be placed in /tmp. (#​867) (7a7aad3)

v3.73.6

Compare Source

Bug Fixes

• binary widget minor fixes (#​877) (d9499e3)

v3.73.5

Compare Source

Bug Fixes

• deps: update terraform terraform-ibm-modules/secrets-manager-secret-group/ibm to v1.3.19 (#​881) (514d0ac)

v3.73.4

Compare Source

Bug Fixes

• deps: update dependencies (#​876) (4c782ad)

v3.73.3

Compare Source

Bug Fixes

• updated the validation logic used to validate OS (#​870) (794961f)

terraform-ibm-modules/terraform-ibm-secrets-manager-private-cert (terraform-ibm-modules/secrets-manager-private-cert/ibm)

v1.9.2

Compare Source

Bug Fixes

• deps: update terraform terraform-ibm-modules/secrets-manager-secret-group/ibm to v1.3.19 (#​391) (4d356a1)

v1.9.1

Compare Source

Bug Fixes

• deps: update dependencies (#​386) (1f75d1b)

v1.9.0

Compare Source

Features

• renamed the service_endpoints input to endpoint_type (#​385) (6aa2443)

terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine (terraform-ibm-modules/secrets-manager-public-cert-engine/ibm)

v1.6.1

Compare Source

Bug Fixes

• deps: update dependencies (#​296) (d81c8fe)

v1.6.0

Compare Source

Features

• renamed the service_endpoints input to endpoint_type (#​298) (cd33d56)

v1.5.0

Compare Source

Features

• Add input variable validation (#​287) (8ddf33f)

terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert (terraform-ibm-modules/secrets-manager-public-cert/ibm)

v1.5.0

Compare Source

Features

• renamed the input service_endpoints -> endpoint_type (#​279) (4c3639d)

terraform-ibm-modules/terraform-ibm-secrets-manager-secret-group (terraform-ibm-modules/secrets-manager-secret-group/ibm)

v1.3.19

Compare Source

Bug Fixes

• deps: update dependencies (#​357) (ff28ab2)

terraform-ibm-modules/terraform-ibm-vpe-gateway (terraform-ibm-modules/vpe-gateway/ibm)

v4.8.5

Compare Source

Bug Fixes

• Relax regex validation of service CRN (cloud_service_by_crn). The current validation forces an account check on gateway targets, but this excludes targets of type endpoint.
  Supporting:
  • crn:v1:bluemix:public:cloud-object-storage:global:::endpoint:s3.direct.us-east.cloud-object-storage.appdomain.cloud
  • crn:v1:bluemix:public:sysdig-secure:us-south:a/:::

(#​727) (1b70ba3)

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

• If relevant, a test for the change is included or updated with this PR.
• If relevant, documentation for the change is included or updated with this PR.

For mergers

• Use a conventional commit message to set the release level. Follow the guidelines.
• Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
• Use the Squash and merge option.

[vbontempi]

/run pipeline

[vbontempi]

/run pipeline

[vbontempi]

/run pipeline