From fa5a0c4d35e5f01a4dab3b1f2efd79ae7d59ffc5 Mon Sep 17 00:00:00 2001
From: Sergiy Kulanov <sergiy_kulanov@epam.com>
Date: Tue, 14 Jul 2026 12:14:07 +0300
Subject: [PATCH] EPMDEDP-17184: feat: make External Secrets apiVersion
 configurable

- Add eso.apiVersion value (default external-secrets.io/v1) consumed by every
  SecretStore/ExternalSecret template instead of a hardcoded version
- Lets each environment match the ESO CRD version its controller serves
  (v1 for ESO >= 0.10, v1beta1 for older installs)

Signed-off-by: Sergiy Kulanov <sergiy_kulanov@epam.com>
---
 deploy-templates/README.md                                    | 1 +
 deploy-templates/templates/external-secrets/grafana-sso.yaml  | 2 +-
 .../templates/external-secrets/secretstore-aws.yaml           | 2 +-
 .../templates/external-secrets/secretstore-generic.yaml       | 2 +-
 .../templates/external-secrets/secretstore-vault.yaml         | 2 +-
 deploy-templates/values.yaml                                  | 4 ++++
 6 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/deploy-templates/README.md b/deploy-templates/README.md
index 3ec2dd3..7b03f88 100644
--- a/deploy-templates/README.md
+++ b/deploy-templates/README.md
@@ -102,6 +102,7 @@ and `config/grafana/dashboards/`). See the repository root `README.md` for the f
 | dashboards.folders.operational | string | `"Operational"` |  |
 | dashboards.label | string | `"grafana_dashboard"` |  |
 | dashboards.labelValue | string | `"1"` |  |
+| eso.apiVersion | string | `"external-secrets.io/v1"` | API version for the SecretStore/ExternalSecret resources. Match the CRD version served by the ESO controller in the target cluster (`external-secrets.io/v1` for ESO >= 0.10, or `external-secrets.io/v1beta1` for older installs). |
 | eso.aws | object | `{"region":"eu-central-1","roleArn":"arn:aws:iam::012345678910:role/AWSIRSA_Shared_ExternalSecretOperatorAccess"}` | AWS configuration (if provider is `aws`). |
 | eso.aws.region | string | `"eu-central-1"` | AWS region. |
 | eso.aws.roleArn | string | `"arn:aws:iam::012345678910:role/AWSIRSA_Shared_ExternalSecretOperatorAccess"` | AWS role ARN for the ExternalSecretOperator to assume. |
diff --git a/deploy-templates/templates/external-secrets/grafana-sso.yaml b/deploy-templates/templates/external-secrets/grafana-sso.yaml
index 3b8d0a6..8975128 100644
--- a/deploy-templates/templates/external-secrets/grafana-sso.yaml
+++ b/deploy-templates/templates/external-secrets/grafana-sso.yaml
@@ -8,7 +8,7 @@ Grafana consumes `username`/`password` (admin.existingSecret) and `clientSecret`
     --from-literal=clientSecret=<oauth-client-secret>
 */ -}}
 {{- if .Values.eso.enabled }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: ExternalSecret
 metadata:
   name: grafana-sso
diff --git a/deploy-templates/templates/external-secrets/secretstore-aws.yaml b/deploy-templates/templates/external-secrets/secretstore-aws.yaml
index 3fa9c0a..2f3a153 100644
--- a/deploy-templates/templates/external-secrets/secretstore-aws.yaml
+++ b/deploy-templates/templates/external-secrets/secretstore-aws.yaml
@@ -1,5 +1,5 @@
 {{- if and .Values.eso.enabled (eq .Values.eso.provider "aws") }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: SecretStore
 metadata:
   name: {{ .Release.Name }}
diff --git a/deploy-templates/templates/external-secrets/secretstore-generic.yaml b/deploy-templates/templates/external-secrets/secretstore-generic.yaml
index 20cadec..c43c9cc 100644
--- a/deploy-templates/templates/external-secrets/secretstore-generic.yaml
+++ b/deploy-templates/templates/external-secrets/secretstore-generic.yaml
@@ -1,5 +1,5 @@
 {{- if and .Values.eso.enabled (eq .Values.eso.provider "generic") }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: SecretStore
 metadata:
   name: {{ .Release.Name }}
diff --git a/deploy-templates/templates/external-secrets/secretstore-vault.yaml b/deploy-templates/templates/external-secrets/secretstore-vault.yaml
index 525ed49..c06156c 100644
--- a/deploy-templates/templates/external-secrets/secretstore-vault.yaml
+++ b/deploy-templates/templates/external-secrets/secretstore-vault.yaml
@@ -1,5 +1,5 @@
 {{- if and .Values.eso.enabled (eq .Values.eso.provider "vault") }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: SecretStore
 metadata:
   name: {{ .Release.Name }}
diff --git a/deploy-templates/values.yaml b/deploy-templates/values.yaml
index 3385fba..7c26b9a 100644
--- a/deploy-templates/values.yaml
+++ b/deploy-templates/values.yaml
@@ -398,6 +398,10 @@ grafana:
 eso:
   # -- Render the SecretStore/ExternalSecret resources.
   enabled: false
+  # -- API version for the SecretStore/ExternalSecret resources. Match the CRD
+  # version served by the ESO controller in the target cluster (`external-secrets.io/v1`
+  # for ESO >= 0.10, or `external-secrets.io/v1beta1` for older installs).
+  apiVersion: "external-secrets.io/v1"
   # -- Defines provider type. One of `aws`, `generic`, or `vault`.
   provider: "generic"
   # -- Defines the path to the secret in the provider. If provider is `vault`, the path must be prefixed with `secret/`.