Repository: external-secrets/external-secrets
Pull request #4486: allow references expansion when searching secret by key infinsical
Author: login: tuxtof
Created: 2025-02-28T12:47:17Z | Merged: 2025-03-08T11:32:14Z

## Problem Statement

In the actual Infisical provider , there is a configuration difference between getting secrets by key and searching them.
In the first case (GetSecretByKeyV3), references are not expanded, whereas in the second case (GetSecretsV3), they are.

## Proposed Changes

This patch aligns the two methods and expands reference in both cases

## Checklist

- [X] I have read the [contribution guidelines](https://external-secrets.io/latest/contributing/process/#submitting-a-pull-request)
- [X] All commits are signed with `git commit --signoff`
- [X] My changes have reasonable test coverage
- [X] All tests pass with `make test`
- [] I ensured my PR is ready for review with `make reviewable`



Diff:
diff --git a/apis/externalsecrets/v1beta1/secretsstore_infisical_types.go b/apis/externalsecrets/v1beta1/secretsstore_infisical_types.go
index 8e4428f3460..7f156f7dc85 100644
--- a/apis/externalsecrets/v1beta1/secretsstore_infisical_types.go
+++ b/apis/externalsecrets/v1beta1/secretsstore_infisical_types.go
@@ -31,16 +31,24 @@ type InfisicalAuth struct {
 }
 
 type MachineIdentityScopeInWorkspace struct {
+	// SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
 	// +kubebuilder:default="/"
 	// +optional
 	SecretsPath string `json:"secretsPath,omitempty"`
+	// Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
 	// +kubebuilder:default=false
 	// +optional
 	Recursive bool `json:"recursive,omitempty"`
+	// EnvironmentSlug is the required slug identifier for the environment.
 	// +kubebuilder:validation:Required
 	EnvironmentSlug string `json:"environmentSlug"`
+	// ProjectSlug is the required slug identifier for the project.
 	// +kubebuilder:validation:Required
 	ProjectSlug string `json:"projectSlug"`
+	// ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+	// +kubebuilder:default=true
+	// +optional
+	ExpandSecretReferences bool `json:"expandSecretReferences,omitempty"`
 }
 
 // InfisicalProvider configures a store to sync secrets using the Infisical provider.
@@ -48,8 +56,10 @@ type InfisicalProvider struct {
 	// Auth configures how the Operator authenticates with the Infisical API
 	// +kubebuilder:validation:Required
 	Auth InfisicalAuth `json:"auth"`
+	// SecretsScope defines the scope of the secrets within the workspace
 	// +kubebuilder:validation:Required
 	SecretsScope MachineIdentityScopeInWorkspace `json:"secretsScope"`
+	// HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
 	// +kubebuilder:default="https://app.infisical.com/api"
 	// +optional
 	HostAPI string `json:"hostAPI,omitempty"`
diff --git a/config/crds/bases/external-secrets.io_clustersecretstores.yaml b/config/crds/bases/external-secrets.io_clustersecretstores.yaml
index f9a5232b125..36174072b8e 100644
--- a/config/crds/bases/external-secrets.io_clustersecretstores.yaml
+++ b/config/crds/bases/external-secrets.io_clustersecretstores.yaml
@@ -4037,18 +4037,36 @@ spec:
                         type: object
                       hostAPI:
                         default: https://app.infisical.com/api
+                        description: HostAPI specifies the base URL of the Infisical
+                          API. If not provided, it defaults to "https://app.infisical.com/api".
                         type: string
                       secretsScope:
+                        description: SecretsScope defines the scope of the secrets
+                          within the workspace
                         properties:
                           environmentSlug:
+                            description: EnvironmentSlug is the required slug identifier
+                              for the environment.
                             type: string
+                          expandSecretReferences:
+                            default: true
+                            description: ExpandSecretReferences indicates whether
+                              secret references should be expanded. Defaults to true
+                              if not provided.
+                            type: boolean
                           projectSlug:
+                            description: ProjectSlug is the required slug identifier
+                              for the project.
                             type: string
                           recursive:
                             default: false
+                            description: Recursive indicates whether the secrets should
+                              be fetched recursively. Defaults to false if not provided.
                             type: boolean
                           secretsPath:
                             default: /
+                            description: SecretsPath specifies the path to the secrets
+                              within the workspace. Defaults to "/" if not provided.
                             type: string
                         required:
                         - environmentSlug
diff --git a/config/crds/bases/external-secrets.io_secretstores.yaml b/config/crds/bases/external-secrets.io_secretstores.yaml
index 95bfd20bfc5..0f5e7d7cde4 100644
--- a/config/crds/bases/external-secrets.io_secretstores.yaml
+++ b/config/crds/bases/external-secrets.io_secretstores.yaml
@@ -4037,18 +4037,36 @@ spec:
                         type: object
                       hostAPI:
                         default: https://app.infisical.com/api
+                        description: HostAPI specifies the base URL of the Infisical
+                          API. If not provided, it defaults to "https://app.infisical.com/api".
                         type: string
                       secretsScope:
+                        description: SecretsScope defines the scope of the secrets
+                          within the workspace
                         properties:
                           environmentSlug:
+                            description: EnvironmentSlug is the required slug identifier
+                              for the environment.
                             type: string
+                          expandSecretReferences:
+                            default: true
+                            description: ExpandSecretReferences indicates whether
+                              secret references should be expanded. Defaults to true
+                              if not provided.
+                            type: boolean
                           projectSlug:
+                            description: ProjectSlug is the required slug identifier
+                              for the project.
                             type: string
                           recursive:
                             default: false
+                            description: Recursive indicates whether the secrets should
+                              be fetched recursively. Defaults to false if not provided.
                             type: boolean
                           secretsPath:
                             default: /
+                            description: SecretsPath specifies the path to the secrets
+                              within the workspace. Defaults to "/" if not provided.
                             type: string
                         required:
                         - environmentSlug
diff --git a/deploy/charts/external-secrets/tests/__snapshot__/crds_test.yaml.snap b/deploy/charts/external-secrets/tests/__snapshot__/crds_test.yaml.snap
index 283f5b2b1f4..a979054dd19 100644
--- a/deploy/charts/external-secrets/tests/__snapshot__/crds_test.yaml.snap
+++ b/deploy/charts/external-secrets/tests/__snapshot__/crds_test.yaml.snap
@@ -3797,18 +3797,28 @@ should match snapshot of default values:
                               type: object
                             hostAPI:
                               default: https://app.infisical.com/api
+                              description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
                               type: string
                             secretsScope:
+                              description: SecretsScope defines the scope of the secrets within the workspace
                               properties:
                                 environmentSlug:
+                                  description: EnvironmentSlug is the required slug identifier for the environment.
                                   type: string
+                                expandSecretReferences:
+                                  default: true
+                                  description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+                                  type: boolean
                                 projectSlug:
+                                  description: ProjectSlug is the required slug identifier for the project.
                                   type: string
                                 recursive:
                                   default: false
+                                  description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
                                   type: boolean
                                 secretsPath:
                                   default: /
+                                  description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
                                   type: string
                               required:
                                 - environmentSlug
diff --git a/deploy/crds/bundle.yaml b/deploy/crds/bundle.yaml
index 96540714423..b26ff4ad979 100644
--- a/deploy/crds/bundle.yaml
+++ b/deploy/crds/bundle.yaml
@@ -4521,18 +4521,28 @@ spec:
                           type: object
                         hostAPI:
                           default: https://app.infisical.com/api
+                          description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
                           type: string
                         secretsScope:
+                          description: SecretsScope defines the scope of the secrets within the workspace
                           properties:
                             environmentSlug:
+                              description: EnvironmentSlug is the required slug identifier for the environment.
                               type: string
+                            expandSecretReferences:
+                              default: true
+                              description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+                              type: boolean
                             projectSlug:
+                              description: ProjectSlug is the required slug identifier for the project.
                               type: string
                             recursive:
                               default: false
+                              description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
                               type: boolean
                             secretsPath:
                               default: /
+                              description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
                               type: string
                           required:
                             - environmentSlug
@@ -11722,18 +11732,28 @@ spec:
                           type: object
                         hostAPI:
                           default: https://app.infisical.com/api
+                          description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
                           type: string
                         secretsScope:
+                          description: SecretsScope defines the scope of the secrets within the workspace
                           properties:
                             environmentSlug:
+                              description: EnvironmentSlug is the required slug identifier for the environment.
                               type: string
+                            expandSecretReferences:
+                              default: true
+                              description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+                              type: boolean
                             projectSlug:
+                              description: ProjectSlug is the required slug identifier for the project.
                               type: string
                             recursive:
                               default: false
+                              description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
                               type: boolean
                             secretsPath:
                               default: /
+                              description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
                               type: string
                           required:
                             - environmentSlug
diff --git a/docs/api/spec.md b/docs/api/spec.md
index 63ab4633d9c..b4a13da1fd9 100644
--- a/docs/api/spec.md
+++ b/docs/api/spec.md
@@ -5149,6 +5149,7 @@ MachineIdentityScopeInWorkspace
 </em>
 </td>
 <td>
+<p>SecretsScope defines the scope of the secrets within the workspace</p>
 </td>
 </tr>
 <tr>
@@ -5160,6 +5161,7 @@ string
 </td>
 <td>
 <em>(Optional)</em>
+<p>HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to &ldquo;<a href="https://app.infisical.com/api&quot;">https://app.infisical.com/api&rdquo;</a>.</p>
 </td>
 </tr>
 </tbody>
@@ -5419,6 +5421,7 @@ string
 </td>
 <td>
 <em>(Optional)</em>
+<p>SecretsPath specifies the path to the secrets within the workspace. Defaults to &ldquo;/&rdquo; if not provided.</p>
 </td>
 </tr>
 <tr>
@@ -5430,6 +5433,7 @@ bool
 </td>
 <td>
 <em>(Optional)</em>
+<p>Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.</p>
 </td>
 </tr>
 <tr>
@@ -5440,6 +5444,7 @@ string
 </em>
 </td>
 <td>
+<p>EnvironmentSlug is the required slug identifier for the environment.</p>
 </td>
 </tr>
 <tr>
@@ -5450,6 +5455,19 @@ string
 </em>
 </td>
 <td>
+<p>ProjectSlug is the required slug identifier for the project.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>expandSecretReferences</code></br>
+<em>
+bool
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.</p>
 </td>
 </tr>
 </tbody>
diff --git a/docs/snippets/infisical-generic-secret-store.yaml b/docs/snippets/infisical-generic-secret-store.yaml
index b728b87d6b4..6092703c167 100644
--- a/docs/snippets/infisical-generic-secret-store.yaml
+++ b/docs/snippets/infisical-generic-secret-store.yaml
@@ -23,5 +23,7 @@ spec:
         secretsPath: / # Root is "/"
         # optional
         recursive: true # Default is false
+        # optional
+        expandSecretReferences: false # Default is true
       # optional
       hostAPI: https://app.infisical.com
diff --git a/pkg/provider/infisical/api/api.go b/pkg/provider/infisical/api/api.go
index f1586f451df..0bcf30572c4 100644
--- a/pkg/provider/infisical/api/api.go
+++ b/pkg/provider/infisical/api/api.go
@@ -235,7 +235,7 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 		"environment":            data.EnvironmentSlug,
 		"secretPath":             data.SecretPath,
 		"include_imports":        "true",
-		"expandSecretReferences": "true",
+		"expandSecretReferences": strconv.FormatBool(data.ExpandSecretReferences),
 		"recursive":              strconv.FormatBool(data.Recursive),
 	}
 
@@ -267,10 +267,11 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 
 func (a *InfisicalClient) GetSecretByKeyV3(data GetSecretByKeyV3Request) (string, error) {
 	params := map[string]string{
-		"workspaceSlug":   data.ProjectSlug,
-		"environment":     data.EnvironmentSlug,
-		"secretPath":      data.SecretPath,
-		"include_imports": "true",
+		"workspaceSlug":          data.ProjectSlug,
+		"environment":            data.EnvironmentSlug,
+		"secretPath":             data.SecretPath,
+		"include_imports":        "true",
+		"expandSecretReferences": strconv.FormatBool(data.ExpandSecretReferences),
 	}
 
 	endpointURL := fmt.Sprintf("api/v3/secrets/raw/%s", data.SecretKey)
diff --git a/pkg/provider/infisical/api/api_models.go b/pkg/provider/infisical/api/api_models.go
index 55cbe26f894..7004a06ae08 100644
--- a/pkg/provider/infisical/api/api_models.go
+++ b/pkg/provider/infisical/api/api_models.go
@@ -39,10 +39,11 @@ type RevokeMachineIdentityAccessTokenResponse struct {
 }
 
 type GetSecretByKeyV3Request struct {
-	EnvironmentSlug string `json:"environment"`
-	ProjectSlug     string `json:"workspaceSlug"`
-	SecretPath      string `json:"secretPath"`
-	SecretKey       string `json:"secretKey"`
+	EnvironmentSlug        string `json:"environment"`
+	ProjectSlug            string `json:"workspaceSlug"`
+	SecretPath             string `json:"secretPath"`
+	SecretKey              string `json:"secretKey"`
+	ExpandSecretReferences bool   `json:"expandSecretReferences"`
 }
 
 type GetSecretByKeyV3Response struct {
@@ -50,10 +51,11 @@ type GetSecretByKeyV3Response struct {
 }
 
 type GetSecretsV3Request struct {
-	EnvironmentSlug string `json:"environment"`
-	ProjectSlug     string `json:"workspaceSlug"`
-	Recursive       bool   `json:"recursive"`
-	SecretPath      string `json:"secretPath"`
+	EnvironmentSlug        string `json:"environment"`
+	ProjectSlug            string `json:"workspaceSlug"`
+	Recursive              bool   `json:"recursive"`
+	SecretPath             string `json:"secretPath"`
+	ExpandSecretReferences bool   `json:"expandSecretReferences"`
 }
 
 type GetSecretsV3Response struct {
diff --git a/pkg/provider/infisical/client.go b/pkg/provider/infisical/client.go
index a11891da76e..70d7a246295 100644
--- a/pkg/provider/infisical/client.go
+++ b/pkg/provider/infisical/client.go
@@ -47,10 +47,11 @@ func getPropertyValue(jsonData, propertyName, keyName string) ([]byte, error) {
 // then the secret entry will be deleted depending on the deletionPolicy.
 func (p *Provider) GetSecret(ctx context.Context, ref esv1beta1.ExternalSecretDataRemoteRef) ([]byte, error) {
 	secret, err := p.apiClient.GetSecretByKeyV3(api.GetSecretByKeyV3Request{
-		EnvironmentSlug: p.apiScope.EnvironmentSlug,
-		ProjectSlug:     p.apiScope.ProjectSlug,
-		SecretKey:       ref.Key,
-		SecretPath:      p.apiScope.SecretPath,
+		EnvironmentSlug:        p.apiScope.EnvironmentSlug,
+		ProjectSlug:            p.apiScope.ProjectSlug,
+		SecretKey:              ref.Key,
+		SecretPath:             p.apiScope.SecretPath,
+		ExpandSecretReferences: p.apiScope.ExpandSecretReferences,
 	})
 
 	if err != nil {
@@ -101,10 +102,11 @@ func (p *Provider) GetAllSecrets(ctx context.Context, ref esv1beta1.ExternalSecr
 	}
 
 	secrets, err := p.apiClient.GetSecretsV3(api.GetSecretsV3Request{
-		EnvironmentSlug: p.apiScope.EnvironmentSlug,
-		ProjectSlug:     p.apiScope.ProjectSlug,
-		SecretPath:      p.apiScope.SecretPath,
-		Recursive:       p.apiScope.Recursive,
+		EnvironmentSlug:        p.apiScope.EnvironmentSlug,
+		ProjectSlug:            p.apiScope.ProjectSlug,
+		SecretPath:             p.apiScope.SecretPath,
+		Recursive:              p.apiScope.Recursive,
+		ExpandSecretReferences: p.apiScope.ExpandSecretReferences,
 	})
 	if err != nil {
 		return nil, err
@@ -143,10 +145,11 @@ func (p *Provider) GetAllSecrets(ctx context.Context, ref esv1beta1.ExternalSecr
 func (p *Provider) Validate() (esv1beta1.ValidationResult, error) {
 	// try to fetch the secrets to ensure provided credentials has access to read secrets
 	_, err := p.apiClient.GetSecretsV3(api.GetSecretsV3Request{
-		EnvironmentSlug: p.apiScope.EnvironmentSlug,
-		ProjectSlug:     p.apiScope.ProjectSlug,
-		Recursive:       p.apiScope.Recursive,
-		SecretPath:      p.apiScope.SecretPath,
+		EnvironmentSlug:        p.apiScope.EnvironmentSlug,
+		ProjectSlug:            p.apiScope.ProjectSlug,
+		Recursive:              p.apiScope.Recursive,
+		SecretPath:             p.apiScope.SecretPath,
+		ExpandSecretReferences: p.apiScope.ExpandSecretReferences,
 	})
 
 	if err != nil {
diff --git a/pkg/provider/infisical/provider.go b/pkg/provider/infisical/provider.go
index fbb9b798550..273f4be06a8 100644
--- a/pkg/provider/infisical/provider.go
+++ b/pkg/provider/infisical/provider.go
@@ -43,10 +43,11 @@ type Provider struct {
 }
 
 type InfisicalClientScope struct {
-	EnvironmentSlug string
-	ProjectSlug     string
-	Recursive       bool
-	SecretPath      string
+	EnvironmentSlug        string
+	ProjectSlug            string
+	Recursive              bool
+	SecretPath             string
+	ExpandSecretReferences bool
 }
 
 // https://github.com/external-secrets/external-secrets/issues/644
@@ -98,10 +99,11 @@ func (p *Provider) NewClient(ctx context.Context, store esv1beta1.GenericStore,
 		return &Provider{
 			apiClient: apiClient,
 			apiScope: &InfisicalClientScope{
-				EnvironmentSlug: infisicalSpec.SecretsScope.EnvironmentSlug,
-				ProjectSlug:     infisicalSpec.SecretsScope.ProjectSlug,
-				Recursive:       infisicalSpec.SecretsScope.Recursive,
-				SecretPath:      infisicalSpec.SecretsScope.SecretsPath,
+				EnvironmentSlug:        infisicalSpec.SecretsScope.EnvironmentSlug,
+				ProjectSlug:            infisicalSpec.SecretsScope.ProjectSlug,
+				Recursive:              infisicalSpec.SecretsScope.Recursive,
+				SecretPath:             infisicalSpec.SecretsScope.SecretsPath,
+				ExpandSecretReferences: infisicalSpec.SecretsScope.ExpandSecretReferences,
 			},
 		}, nil
 	}


Reviews:
user: login: Skarlso
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-06T06:15:00Z
user: login: tuxtof
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-06T10:07:35Z
user: login: Skarlso
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T06:23:28Z
user: login: tuxtof
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T12:06:31Z
user: login: Skarlso
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T16:35:36Z
user: login: Skarlso
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-08T11:32:05Z

Review comments:
diff_hunk: @@ -267,10 +267,11 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 
 func (a *InfisicalClient) GetSecretByKeyV3(data GetSecretByKeyV3Request) (string, error) {
 	params := map[string]string{
-		"workspaceSlug":   data.ProjectSlug,
-		"environment":     data.EnvironmentSlug,
-		"secretPath":      data.SecretPath,
-		"include_imports": "true",
+		"workspaceSlug":          data.ProjectSlug,
+		"environment":            data.EnvironmentSlug,
+		"secretPath":             data.SecretPath,
+		"include_imports":        "true",
+		"expandSecretReferences": "true",
path: pkg/provider/infisical/api/api.go
user: login: Skarlso
body: Shouldn't this be something that you would configure through the Store like the slugs and SecretPath?
created_at: 2025-03-06T06:14:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -267,10 +267,11 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 
 func (a *InfisicalClient) GetSecretByKeyV3(data GetSecretByKeyV3Request) (string, error) {
 	params := map[string]string{
-		"workspaceSlug":   data.ProjectSlug,
-		"environment":     data.EnvironmentSlug,
-		"secretPath":      data.SecretPath,
-		"include_imports": "true",
+		"workspaceSlug":          data.ProjectSlug,
+		"environment":            data.EnvironmentSlug,
+		"secretPath":             data.SecretPath,
+		"include_imports":        "true",
+		"expandSecretReferences": "true",
path: pkg/provider/infisical/api/api.go
user: login: tuxtof
body: Hello @Skarlso , long term definitively something to do
can we do it in two steps ?
- first align the two method by enabling expandSecretReferences
- next propose another PR to implement optionnal settings at store level
created_at: 2025-03-06T10:07:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -267,10 +267,11 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 
 func (a *InfisicalClient) GetSecretByKeyV3(data GetSecretByKeyV3Request) (string, error) {
 	params := map[string]string{
-		"workspaceSlug":   data.ProjectSlug,
-		"environment":     data.EnvironmentSlug,
-		"secretPath":      data.SecretPath,
-		"include_imports": "true",
+		"workspaceSlug":          data.ProjectSlug,
+		"environment":            data.EnvironmentSlug,
+		"secretPath":             data.SecretPath,
+		"include_imports":        "true",
+		"expandSecretReferences": "true",
path: pkg/provider/infisical/api/api.go
user: login: Skarlso
body: I mean... It's literally just adding an optional field that you can set to true. I would rather not change the base behaviour to be always true.
created_at: 2025-03-07T06:23:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -267,10 +267,11 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 
 func (a *InfisicalClient) GetSecretByKeyV3(data GetSecretByKeyV3Request) (string, error) {
 	params := map[string]string{
-		"workspaceSlug":   data.ProjectSlug,
-		"environment":     data.EnvironmentSlug,
-		"secretPath":      data.SecretPath,
-		"include_imports": "true",
+		"workspaceSlug":          data.ProjectSlug,
+		"environment":            data.EnvironmentSlug,
+		"secretPath":             data.SecretPath,
+		"include_imports":        "true",
+		"expandSecretReferences": "true",
path: pkg/provider/infisical/api/api.go
user: login: tuxtof
body: base behaviour is already always true when you use GetSecretsV3

i think in all casse we need to align the behaviour of GetSecretsV3 and GetSecretByKeyV3
created_at: 2025-03-07T12:06:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -267,10 +267,11 @@ func (a *InfisicalClient) GetSecretsV3(data GetSecretsV3Request) (map[string]str
 
 func (a *InfisicalClient) GetSecretByKeyV3(data GetSecretByKeyV3Request) (string, error) {
 	params := map[string]string{
-		"workspaceSlug":   data.ProjectSlug,
-		"environment":     data.EnvironmentSlug,
-		"secretPath":      data.SecretPath,
-		"include_imports": "true",
+		"workspaceSlug":          data.ProjectSlug,
+		"environment":            data.EnvironmentSlug,
+		"secretPath":             data.SecretPath,
+		"include_imports":        "true",
+		"expandSecretReferences": "true",
path: pkg/provider/infisical/api/api.go
user: login: Skarlso
body: Gotcha. But all I'm asking for is a simple bool in the store struct that is omitempty but defaults to `true` and then use that. :) It's super simple.
created_at: 2025-03-07T16:35:36Z
author_association: CONTRIBUTOR

PR comments:
user: login: tuxtof
created_at: 2025-02-28T12:48:37Z
body: @akhilmhdh your feedback is welcome 
author_association: CONTRIBUTOR
user: login: tuxtof
created_at: 2025-03-08T05:59:32Z
body: @Skarlso i let you check if this is the right way to implement it as i don't know the internal architecture of the project
author_association: CONTRIBUTOR
user: login: Skarlso
created_at: 2025-03-08T07:44:51Z
body: Yep that looks okay. Thanks very much. I'll check it when I'm back. 
author_association: CONTRIBUTOR
user: login: sonarqubecloud[bot]
created_at: 2025-03-08T11:32:59Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=external-secrets_external-secrets&pullRequest=4486) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=external-secrets_external-secrets&pullRequest=4486&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=external-secrets_external-secrets&pullRequest=4486&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=external-secrets_external-secrets&pullRequest=4486&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=external-secrets_external-secrets&pullRequest=4486&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=external-secrets_external-secrets&pullRequest=4486&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=external-secrets_external-secrets&pullRequest=4486)


author_association: NONE