external-secrets just shipped version 2.8.0, and it is stacked. If you have ever stared at a Kubernetes cluster full of hardcoded API keys and wondered whether there was a better way, this is the project you have been looking for — and this release makes it substantially more useful.
What is external-secrets, and why should you care?
Imagine your Kubernetes cluster is a busy office. Every application running in it needs keys — API tokens, database passwords, TLS certificates, cloud credentials. Without external-secrets, those secrets end up sitting in base64-encoded Kubernetes Secrets, committed to Git repos, or copy-pasted between environments like a bad game of telephone. That is a security nightmare and an operational headache.
external-secrets fixes this. It is a Kubernetes operator that pulls secrets from the places they actually belong — HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, Azure Key Vault, 1Password, and dozens more — and syncs them into native Kubernetes Secrets your pods can use. The secrets stay where your security team put them. Your apps get the credentials they need. Everybody wins.
If you have ever copy-pasted a production database password into a Helm values file, this project exists specifically to make you stop.
Version 2.8.0 is a dense, integrations-forward release. Eleven new contributors shipped work here, and the headline features expand the project in three directions: new providers, smarter secret lifecycle, and operational hardening.
What is new in v2.8.0
AWS Certificate Manager provider
This is the big one. external-secrets now speaks to AWS Certificate Manager (ACM) directly, meaning you can fetch and reference TLS certificates managed in ACM from inside your cluster without a sidecar or a custom controller. If you run on AWS and terminate TLS at an ingress or a service mesh, this closes a real gap in the GitOps-for-secrets story.
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
name: acm-store
spec:
provider:
aws:
service: certificateManager
region: us-east-1
auth:
jwt:
serviceAccountRef:
name: external-secrets-irsaPull request: #6117
CreateOrMerge: a kinder creation policy
Before this release, an ExternalSecret could create a Kubernetes Secret or leave it alone — but merging into an existing Secret was a missing piece. The new CreateOrMerge creation policy lets an ExternalSecret add or update keys in a Secret that other components also write to, without wiping out keys it does not manage.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: merged-secret
spec:
target:
name: my-app-secret
creationPolicy: CreateOrMergeThis matters most in multi-tool environments. If you have a Secret that Argo CD, external-secrets, and a custom job all contribute keys to, CreateOrMerge means they can finally coexist without one of them clobbering the others.
Pull request: #6641
Duration strings for refreshInterval
Small ergonomic change, real quality-of-life win. refreshInterval on a SecretStore previously accepted an integer representing seconds. Now it accepts a proper Go duration string, so you can write 10m instead of 600 and actually understand your config six months later.
spec:
refreshInterval: 10m # was: 600No more mental math. Your future self thanks you.
Pull request: #6594
Configurable leader election leases
If you run external-secrets in a large cluster with many ExternalSecret resources, the default leader election lease timing can cause unnecessary API server churn. v2.8.0 makes the lease duration, renew deadline, and retry period configurable, so you can tune the controller for scale rather than fighting it.
Pull request: #6644
New integrations: GitLab, Conjur, Akeyless, SecretServer
Beyond the headline features, this release broadens the integration footprint significantly:
- GitLab deploy token generator — generate short-lived deploy tokens for pulling images from GitLab Container Registry. #6493
- Conjur Certificate Auth — authenticate to CyberArk Conjur using certificate-based identity rather than API keys. #6393
- Akeyless Azure AD Workload Identity — use workload identity federation to authenticate to Akeyless without static credentials. #6530
- Akeyless ignoreCache — bypass the Akeyless Gateway cache when you need the freshest possible value. #6507
- SecretServer access token auth — authenticate to Deline Secret Server via access token. #6597
Helm chart hardening
Three operational improvements landed in the chart itself: an optional NetworkPolicy (#5779) so you can lock down ingress and egress to the controller, startupProbe support for the webhook (#6612) to avoid premature restart loops on slow nodes, and an aggregateToAdmin toggle (#6586) that controls whether the generated ClusterRole aggregates into the admin role.
Security fix
This release bumps Go to 1.26.5, which patches CVE-2026-39822 in the Go standard library. The vulnerability is not in external-secrets itself, but the Go runtime underneath. If you build or run external-secrets from source, upgrading to v2.8.0 pulls in the patched runtime. The standard upgrade path applies — bump your Helm chart or manifest version and reconcile.
Pull request: #6631
The bottom line
v2.8.0 is the release where external-secrets quietly becomes the default answer for “how do I get a secret into a pod” across more clouds and more backends than ever before — and it does it while getting noticeably easier to operate at scale.
