feat(akeyless): add SecretStore ignoreCache to bypass Gateway cache

[baraka-akeyless]

Summary

• Adds optional ignoreCache field to the Akeyless SecretStore / ClusterSecretStore provider spec
• When true, ESO passes ignore-cache=true to Akeyless Gateway read APIs (get-secret-value, get-rotated-secret-value, get-certificate-value)
• Aligns ESO behavior with the Akeyless Kubernetes Secrets Injector ignore_cache option

Motivation

When ESO syncs secrets through an Akeyless Gateway with proactive cache enabled, refreshed values may be stale until the Gateway cache expires. This flag lets operators bypass the Gateway cache and fetch the latest value from Akeyless SaaS on each sync.

Example

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: akeyless-gw
spec:
  provider:
    akeyless:
      akeylessGWApiURL: "https://your.akeyless.gw:8080/v2"
      ignoreCache: true
      authSecretRef:
        secretRef:
          accessID:
            name: akeyless-secret-creds
            key: accessId
          accessType:
            name: akeyless-secret-creds
            key: accessType
          accessTypeParam:
            name: akeyless-secret-creds
            key: accessTypeParam

Test plan

• go test ./providers/v1/akeyless/... -run TestIgnoreCacheEnabled
• Manual: create SecretStore with ignoreCache: true against Gateway, rotate secret in SaaS, verify ExternalSecret picks up new value on next sync without waiting for Gateway cache TTL

Made with Cursor