EPMDEDP-17184: feat: make External Secrets apiVersion configurable

deploy-templates/README.md

@@ -102,6 +102,7 @@ and `config/grafana/dashboards/`). See the repository root `README.md` for the f
 | dashboards.folders.operational | string | `"Operational"` |  |
 | dashboards.label | string | `"grafana_dashboard"` |  |
 | dashboards.labelValue | string | `"1"` |  |
+| eso.apiVersion | string | `"external-secrets.io/v1"` | API version for the SecretStore/ExternalSecret resources. Match the CRD version served by the ESO controller in the target cluster (`external-secrets.io/v1` for ESO >= 0.10, or `external-secrets.io/v1beta1` for older installs). |
 | eso.aws | object | `{"region":"eu-central-1","roleArn":"arn:aws:iam::012345678910:role/AWSIRSA_Shared_ExternalSecretOperatorAccess"}` | AWS configuration (if provider is `aws`). |
 | eso.aws.region | string | `"eu-central-1"` | AWS region. |
 | eso.aws.roleArn | string | `"arn:aws:iam::012345678910:role/AWSIRSA_Shared_ExternalSecretOperatorAccess"` | AWS role ARN for the ExternalSecretOperator to assume. |

deploy-templates/templates/external-secrets/grafana-sso.yaml

@@ -8,7 +8,7 @@ Grafana consumes `username`/`password` (admin.existingSecret) and `clientSecret`
     --from-literal=clientSecret=<oauth-client-secret>
 */ -}}
 {{- if .Values.eso.enabled }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: ExternalSecret
 metadata:
   name: grafana-sso

deploy-templates/templates/external-secrets/secretstore-aws.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.eso.enabled (eq .Values.eso.provider "aws") }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: SecretStore
 metadata:
   name: {{ .Release.Name }}

deploy-templates/templates/external-secrets/secretstore-generic.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.eso.enabled (eq .Values.eso.provider "generic") }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: SecretStore
 metadata:
   name: {{ .Release.Name }}

deploy-templates/templates/external-secrets/secretstore-vault.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.eso.enabled (eq .Values.eso.provider "vault") }}
-apiVersion: external-secrets.io/v1
+apiVersion: {{ .Values.eso.apiVersion }}
 kind: SecretStore
 metadata:
   name: {{ .Release.Name }}

deploy-templates/values.yaml

@@ -398,6 +398,10 @@ grafana:
 eso:
   # -- Render the SecretStore/ExternalSecret resources.
   enabled: false
+  # -- API version for the SecretStore/ExternalSecret resources. Match the CRD
+  # version served by the ESO controller in the target cluster (`external-secrets.io/v1`
+  # for ESO >= 0.10, or `external-secrets.io/v1beta1` for older installs).
+  apiVersion: "external-secrets.io/v1"
   # -- Defines provider type. One of `aws`, `generic`, or `vault`.
   provider: "generic"
   # -- Defines the path to the secret in the provider. If provider is `vault`, the path must be prefixed with `secret/`.