feat: make the serving of the old beta version configurable for a period of time (#5809)

deploy/charts/external-secrets/README.md

@@ -98,6 +98,7 @@ The command removes all the Kubernetes components associated with the chart and
 | crds.createClusterSecretStore | bool | `true` | If true, create CRDs for Cluster Secret Store. If set to false you must also set processClusterStore: false. |
 | crds.createPushSecret | bool | `true` | If true, create CRDs for Push Secret. If set to false you must also set processPushSecret: false. |
 | crds.createSecretStore | bool | `true` | If true, create CRDs for Secret Store. If set to false you must also set processSecretStore: false. |
+| crds.unsafeServeV1Beta1 | bool | `false` | If true, enable v1beta1 API version serving for ExternalSecret, ClusterExternalSecret, SecretStore, and ClusterSecretStore CRDs. v1beta1 is deprecated. Only enable this for backward compatibility if you have existing v1beta1 resources. Warning: This flag will be removed on 2026.05.01. |
 | createOperator | bool | `true` | Specifies whether an external secret operator deployment be created. |
 | deploymentAnnotations | object | `{}` | Annotations to add to Deployment |
 | dnsConfig | object | `{}` | Specifies `dnsOptions` to deployment |

deploy/charts/external-secrets/values.schema.json

@@ -296,6 +296,9 @@
                 },
                 "createSecretStore": {
                     "type": "boolean"
+                },
+                "unsafeServeV1Beta1": {
+                    "type": "boolean"
                 }
             }
         },

deploy/charts/external-secrets/values.yaml

@@ -71,6 +71,10 @@ crds:
   conversion:
     # -- Conversion is disabled by default as we stopped supporting v1alpha1.
     enabled: false
+  # -- If true, enable v1beta1 API version serving for ExternalSecret, ClusterExternalSecret, SecretStore, and ClusterSecretStore CRDs.
+  # v1beta1 is deprecated. Only enable this for backward compatibility if you have existing v1beta1 resources.
+  # Warning: This flag will be removed on 2026.05.01.
+  unsafeServeV1Beta1: false
 
 imagePullSecrets: []
 nameOverride: ""

hack/helm.generate.sh

@@ -24,6 +24,8 @@ for i in "${HELM_DIR}"/templates/crds/*.yml; do
     $SEDPRG -i '/- |-/d' "$i.bkp"
     # Indent the remaining additionalPrinterColumn property right
     $SEDPRG -i 's/       additionalPrinterColumns:/    - additionalPrinterColumns:/' "$i.bkp"
+    # Replace served: false with templated value for v1beta1
+    $SEDPRG -i '/name: v1beta1/,/served: false/{s/served: false/served: {{ .Values.crds.unsafeServeV1Beta1 }}/}' "$i.bkp"
   fi
 
   if [[ "${CRDS_FLAG_NAME}" == *"Cluster"* ]]; then