redhat-appstudio · oswcab · Nov 19, 2025
diff --git a/components/authentication/base/admin-checker/external-secrets/rhtap-infra-secrets.yaml b/components/authentication/base/admin-checker/external-secrets/rhtap-infra-secrets.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: rhtap-infra-secrets

diff --git a/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml b/components/authentication/base/group-sync/external-secrets/konflux-ldap-sa.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: konflux-ldap-sa

diff --git a/components/backup/base/all-clusters/external-secret.yaml b/components/backup/base/all-clusters/external-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: backup-s3-credentials

diff --git a/components/build-service/base/external-secrets/pipelines-as-code-secret.yaml b/components/build-service/base/external-secrets/pipelines-as-code-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: pipelines-as-code-secret

diff --git a/components/build-service/production/base/kustomization.yaml b/components/build-service/production/base/kustomization.yaml
@@ -21,7 +21,7 @@ patches:
       name: pipelines-as-code-secret
       kind: ExternalSecret
       group: external-secrets.io
-      version: v1beta1
+      version: v1
   - path: manager_resources_patch.yaml
 
 components:

diff --git a/components/build-templates/production/e2e-quay-push-secret.yaml b/components/build-templates/production/e2e-quay-push-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: quay-push-secret

diff --git a/components/build-templates/production/e2e-registry-redhat-io-pull-secret.yaml b/components/build-templates/production/e2e-registry-redhat-io-pull-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: registry-redhat-io-pull-secret

diff --git a/components/build-templates/staging/e2e-quay-push-secret.yaml b/components/build-templates/staging/e2e-quay-push-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: quay-push-secret

diff --git a/components/ci-helper-app/staging/external-secrets/ci-helper-app-secrets.yaml b/components/ci-helper-app/staging/external-secrets/ci-helper-app-secrets.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: ci-helper-app-secrets

diff --git a/components/cluster-as-a-service/production/external-secrets.yaml b/components/cluster-as-a-service/production/external-secrets.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cluster-as-a-service-hypershift-credentials
@@ -30,7 +30,7 @@ spec:
         ssh-publickey: unused
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cluster-as-a-service-hypershift-oidc-credentials

diff --git a/components/cluster-as-a-service/staging/external-secrets.yaml b/components/cluster-as-a-service/staging/external-secrets.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cluster-as-a-service-hypershift-credentials
@@ -30,7 +30,7 @@ spec:
         ssh-publickey: unused
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: cluster-as-a-service-hypershift-oidc-credentials

diff --git a/...nents/cluster-secret-store-rh/production/base/appsre-stonesoup-vault-rh-secret-store.yaml b/...nents/cluster-secret-store-rh/production/base/appsre-stonesoup-vault-rh-secret-store.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: appsre-stonesoup-vault-rh-secret-store

diff --git a/...nents/cluster-secret-store-rh/production/base/rh-artifacts-bucket-writer-secret-store.yml b/...nents/cluster-secret-store-rh/production/base/rh-artifacts-bucket-writer-secret-store.yml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: rh-artifacts-bucket-writer-secret-store

diff --git a/components/cluster-secret-store-rh/production/stone-prd-rh01/insights-secret-store.yaml b/components/cluster-secret-store-rh/production/stone-prd-rh01/insights-secret-store.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: insights-appsre-vault

diff --git a/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml b/components/cluster-secret-store/base/appsre-stonesoup-vault-secret-store.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: appsre-stonesoup-vault

diff --git a/components/cluster-secret-store/base/appsre-vault-secret-store.yml b/components/cluster-secret-store/base/appsre-vault-secret-store.yml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: appsre-vault

diff --git a/components/cost-management/base/external-service-account-secret.yaml b/components/cost-management/base/external-service-account-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: konflux-service-account

diff --git a/components/crossplane-control-plane/production/provider-config.yaml b/components/crossplane-control-plane/production/provider-config.yaml
@@ -13,7 +13,7 @@ spec:
       name: eaas-cluster
       key: kubeconfig
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: eaas-cluster

diff --git a/components/crossplane-control-plane/production/testplatform-provider-config.yaml b/components/crossplane-control-plane/production/testplatform-provider-config.yaml
@@ -13,7 +13,7 @@ spec:
       name: testplatform-appci-cluster
       key: kubeconfig
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: testplatform-cluster

diff --git a/components/crossplane-control-plane/staging/provider-config.yaml b/components/crossplane-control-plane/staging/provider-config.yaml
@@ -14,7 +14,7 @@ spec:
       key: kubeconfig
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: eaas-cluster

diff --git a/components/crossplane-control-plane/staging/testplatform-provider-config.yaml b/components/crossplane-control-plane/staging/testplatform-provider-config.yaml
@@ -13,7 +13,7 @@ spec:
       name: testplatform-appci-cluster
       key: kubeconfig
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: testplatform-cluster

diff --git a/components/dora-metrics/base/external-secrets/exporters-secrets.yaml b/components/dora-metrics/base/external-secrets/exporters-secrets.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: exporters-secret

diff --git a/components/has/base/external-secrets/has-github-token.yaml b/components/has/base/external-secrets/has-github-token.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: has-github-token

diff --git a/components/image-controller/base/external-secrets/quaytoken.yaml b/components/image-controller/base/external-secrets/quaytoken.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: quaytoken

diff --git a/...ller/production/stone-prd-rh01/resources/konflux-ci-pull-request-builds-pruner-token.yaml b/...ller/production/stone-prd-rh01/resources/konflux-ci-pull-request-builds-pruner-token.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: konflux-ci-pull-request-builds-pruner-token

diff --git a/...nents/image-controller/production/stone-prd-rh01/resources/redhat-appstudio-pr-token.yaml b/...nents/image-controller/production/stone-prd-rh01/resources/redhat-appstudio-pr-token.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: redhat-appstudio-pr-token

diff --git a/components/integration/base/external-secrets/pipelines-as-code-secret.yaml b/components/integration/base/external-secrets/pipelines-as-code-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: pipelines-as-code-secret

diff --git a/components/konflux-ci/base/external-secrets/clair-in-ci-db-github-token.yaml b/components/konflux-ci/base/external-secrets/clair-in-ci-db-github-token.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: clair-in-ci-db-github-token

diff --git a/components/konflux-ci/base/external-secrets/github-secret.yaml b/components/konflux-ci/base/external-secrets/github-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: github

diff --git a/components/konflux-ci/base/external-secrets/infra-deployments-pr-creator.yaml b/components/konflux-ci/base/external-secrets/infra-deployments-pr-creator.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: infra-deployments-pr-creator

diff --git a/components/konflux-ci/base/external-secrets/konflux-ci-repo-creator.yaml b/components/konflux-ci/base/external-secrets/konflux-ci-repo-creator.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: konflux-ci-repo-creator

diff --git a/components/konflux-ci/base/external-secrets/quay-push-secret-konflux-ci.yaml b/components/konflux-ci/base/external-secrets/quay-push-secret-konflux-ci.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: quay-push-secret-konflux-ci

diff --git a/components/konflux-ci/base/external-secrets/registry-redhat-io-pull-secret.yaml b/components/konflux-ci/base/external-secrets/registry-redhat-io-pull-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: registry-redhat-io-pull-secret

diff --git a/components/konflux-ci/base/external-secrets/slack-webhook-notification-secret.yaml b/components/konflux-ci/base/external-secrets/slack-webhook-notification-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: slack-webhook-notification-secret

diff --git a/components/konflux-ci/base/external-secrets/snyk-shared-token.yaml b/components/konflux-ci/base/external-secrets/snyk-shared-token.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: snyk-shared-token

diff --git a/components/konflux-ci/base/external-secrets/test-artifacts-push-secret.yaml b/components/konflux-ci/base/external-secrets/test-artifacts-push-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: konflux-test-infra

diff --git a/components/konflux-ci/production/kflux-prd-rh03/plnsvc-ci-secret.yaml b/components/konflux-ci/production/kflux-prd-rh03/plnsvc-ci-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: plnsvc-ci-secret

diff --git a/components/konflux-ci/production/kflux-prd-rh03/plnsvc-codecov-secret.yaml b/components/konflux-ci/production/kflux-prd-rh03/plnsvc-codecov-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: plnsvc-codecov-secret

diff --git a/...duction/kflux-prd-rh03/redhat-appstudio-tekton-catalog-build-definitions-pull-secret.yaml b/...duction/kflux-prd-rh03/redhat-appstudio-tekton-catalog-build-definitions-pull-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: redhat-appstudio-tekton-catalog-build-definitions-pull-secret

diff --git a/components/konflux-kite/base/external-secrets/database-secret.yaml b/components/konflux-kite/base/external-secrets/database-secret.yaml
@@ -1,4 +1,4 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   annotations:

diff --git a/components/konflux-ui/staging/base/external-secret.yaml b/components/konflux-ui/staging/base/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: watson-config

diff --git a/components/kubearchive/production/README.md b/components/kubearchive/production/README.md
@@ -59,7 +59,7 @@ This is an example using the `kflux-prd-rh03` cluster:
 
 ```yaml
 --
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   annotations:

diff --git a/components/kubearchive/production/base/database-secret.yaml b/components/kubearchive/production/base/database-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: database-secret

diff --git a/components/kubearchive/production/kflux-ocp-p01/external-secret.yaml b/components/kubearchive/production/kflux-ocp-p01/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: kubearchive-logging

diff --git a/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml b/components/kubearchive/production/kflux-ocp-p01/kustomization.yaml
@@ -88,7 +88,7 @@ patches:
         name: kubearchive-database-credentials
         namespace: kubearchive
   - patch: |-
-      apiVersion: external-secrets.io/v1beta1
+      apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
         name: database-secret

diff --git a/components/kubearchive/production/kflux-osp-p01/external-secret.yaml b/components/kubearchive/production/kflux-osp-p01/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: kubearchive-logging

diff --git a/components/kubearchive/production/kflux-osp-p01/kustomization.yaml b/components/kubearchive/production/kflux-osp-p01/kustomization.yaml
@@ -88,7 +88,7 @@ patches:
         name: kubearchive-database-credentials
         namespace: kubearchive
   - patch: |-
-      apiVersion: external-secrets.io/v1beta1
+      apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
         name: database-secret

diff --git a/components/kubearchive/production/kflux-prd-rh02/external-secret.yaml b/components/kubearchive/production/kflux-prd-rh02/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: kubearchive-logging

diff --git a/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml b/components/kubearchive/production/kflux-prd-rh02/kustomization.yaml
@@ -88,7 +88,7 @@ patches:
         name: kubearchive-database-credentials
         namespace: kubearchive
   - patch: |-
-      apiVersion: external-secrets.io/v1beta1
+      apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
         name: database-secret

diff --git a/components/kubearchive/production/kflux-prd-rh03/external-secret.yaml b/components/kubearchive/production/kflux-prd-rh03/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: kubearchive-logging

diff --git a/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml b/components/kubearchive/production/kflux-prd-rh03/kustomization.yaml
@@ -88,7 +88,7 @@ patches:
         name: kubearchive-database-credentials
         namespace: kubearchive
   - patch: |-
-      apiVersion: external-secrets.io/v1beta1
+      apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
         name: database-secret

diff --git a/components/kubearchive/production/kflux-rhel-p01/external-secret.yaml b/components/kubearchive/production/kflux-rhel-p01/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: kubearchive-logging

diff --git a/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml b/components/kubearchive/production/kflux-rhel-p01/kustomization.yaml
@@ -88,7 +88,7 @@ patches:
         name: kubearchive-database-credentials
         namespace: kubearchive
   - patch: |-
-      apiVersion: external-secrets.io/v1beta1
+      apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
         name: database-secret

diff --git a/components/kubearchive/production/pentest-p01/kustomization.yaml b/components/kubearchive/production/pentest-p01/kustomization.yaml
@@ -52,7 +52,7 @@ patches:
         name: kubearchive-database-credentials
         namespace: kubearchive
   - patch: |-
-      apiVersion: external-secrets.io/v1beta1
+      apiVersion: external-secrets.io/v1
       kind: ExternalSecret
       metadata:
         name: database-secret

diff --git a/components/kubearchive/production/stone-prd-rh01/external-secret.yaml b/components/kubearchive/production/stone-prd-rh01/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: kubearchive-logging