From d8dc13a80d97c7fa333faf0788ae1fb7a3c64ef2 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:08:40 +0000
Subject: [PATCH 1/2] chore(deps): update helm release external-secrets to
 v2.14.0

---
 .../controllers/external-secrets/helm-release.yaml              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml
index 09cc2bc983..96994a4d1d 100644
--- a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml
+++ b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml
@@ -16,7 +16,7 @@ spec:
   chart:
     spec:
       chart: external-secrets
-      version: 2.13.0
+      version: 2.14.0
       sourceRef:
         kind: HelmRepository
         name: external-secrets

From b3a87cf38f085663bf23d1e589c4f82059b307a8 Mon Sep 17 00:00:00 2001
From: Nikolai Emil Damm <nikolaiemildamm@icloud.com>
Date: Sat, 31 Oct 2026 13:23:52 +0100
Subject: [PATCH 2/2] test(external-secrets): move the Tenant schema fixture to
 chart 2.14.0

The ExternalSecret CRD schema is identical between 2.13.0 and 2.14.0, so only
the fixture pin and its digest change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/tests/test-tenant-kro-pull-secret.sh | 2 +-
 scripts/tests/test-webapp-compiler.sh        | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/tests/test-tenant-kro-pull-secret.sh b/scripts/tests/test-tenant-kro-pull-secret.sh
index 7f7eb32437..1bbf600daf 100755
--- a/scripts/tests/test-tenant-kro-pull-secret.sh
+++ b/scripts/tests/test-tenant-kro-pull-secret.sh
@@ -14,7 +14,7 @@ jq '.metadata.namespace="business-site" | .metadata.labels += {
   "kro.run/instance-group":"kro.run","kro.run/instance-version":"v1alpha1",
   "kro.run/instance-kind":"Tenant","kro.run/node-id":"ghcrAuth",
   "applyset.kubernetes.io/part-of":"fictional-tenant-applyset"}' "$work/template.json" >"$work/raw.json"
-# These are the structural defaults in the pinned ExternalSecrets 2.13.0 v1 CRD.
+# These are the structural defaults in the pinned ExternalSecrets 2.14.0 v1 CRD.
 jq '.spec.target.deletionPolicy="Retain" | .spec.target.template.mergePolicy="Replace"' "$work/raw.json" >"$work/defaulted.json"
 jq -nc --slurpfile raw "$work/raw.json" --slurpfile defaults "$work/defaulted.json" '
   def request($label;$object;$old;$actor;$operation;$expected):
diff --git a/scripts/tests/test-webapp-compiler.sh b/scripts/tests/test-webapp-compiler.sh
index 9e395f7319..3cae243619 100755
--- a/scripts/tests/test-webapp-compiler.sh
+++ b/scripts/tests/test-webapp-compiler.sh
@@ -29,15 +29,15 @@ fetch_schema() {
   actual_digest="$(shasum -a 256 "$output" | cut -d ' ' -f 1)"
   [[ "$actual_digest" == "$expected_digest" ]] || { echo 'FAIL: dependency schema checksum changed' >&2; exit 1; }
 }
-[[ "$(yq -er '.spec.chart.spec.version' "${root}/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml")" == 2.13.0 ]] || {
+[[ "$(yq -er '.spec.chart.spec.version' "${root}/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml")" == 2.14.0 ]] || {
   echo 'FAIL: review Tenant schema fixtures for the new External Secrets chart' >&2; exit 1;
 }
 fetch_schema 'https://raw.githubusercontent.com/fluxcd/source-controller/v1.9.6/config/crd/bases/source.toolkit.fluxcd.io_ocirepositories.yaml' \
   80c7c6e5c8de0764cc83acd4de5c74bea8e51186085304d22cecc5f2eb35500e "${work}/oci.yaml"
 fetch_schema 'https://raw.githubusercontent.com/fluxcd/kustomize-controller/v1.9.6/config/crd/bases/kustomize.toolkit.fluxcd.io_kustomizations.yaml' \
   da23ca0e6b4c80d3d26a91583137491e147ef4ef1e2208aece0d0af4ef851974 "${work}/kustomization.yaml"
-fetch_schema 'https://raw.githubusercontent.com/external-secrets/external-secrets/v2.13.0/deploy/crds/bundle.yaml' \
-  d4da9492a6906a3834bb1f5b7367575a29b5c43411017babc7a30728f465d1ba "${work}/external-secrets.yaml"
+fetch_schema 'https://raw.githubusercontent.com/external-secrets/external-secrets/v2.14.0/deploy/crds/bundle.yaml' \
+  0dd116eb3b2ae247e2d256662d5afa4d1f3cd37d34ad6580261b15acf55b3b0d "${work}/external-secrets.yaml"
 yq -o=json -I=0 '.' "${work}/external-secrets.yaml" | jq -se '
   [.[] | select(.kind == "CustomResourceDefinition" and .metadata.name == "externalsecrets.external-secrets.io")]
   | if length == 1 then .[0] else error("expected exactly one actual ExternalSecret schema") end