Describe the bug

I would like to update a secrets (created from an externalsecret) data values. From what I gathered this should be possible by setting refreshInterval: 0 and creationPolicy: Orphan

To Reproduce

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: test
spec:
  refreshInterval: "0"
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: test
    creationPolicy: Orphan
    template:
      engineVersion: v2
      type: kubernetes.io/tls
      metadata:
        annotations:
          testAnnotation: annotation 
        labels:
          testLabel: label
  dataFrom:
    - extract:
        key: test
        decodingStrategy: Auto

Now try to edit a field in the generated secret, it will get overridden on save.

Expected behavior

I expect to edit the data values in the generated secret and have them persistent.

Additional context

I am trying to automate pushing my LE certificate to my eso provider (onepassword) and then when the cluster is re-provisioned have the certificate be "imported" from onepassword but this doesn't work because when cert-manager renews the cert it writes to the *-tls secret but ESO just reverts it.

Here's my implementation using Flux:

https://github.com/onedr0p/home-ops/tree/e3b1bda79ef408d497d649f166a92fc04ee0bb4c/kubernetes/main/apps/cert-manager/certificates

• export folder creates the certificate and pushsecret resources
• import folder creates the externalsecret that tries to pull down the cert into a secret that cert-manager will read.

Related

#2245 (comment)

#4029

https://github.com/external-secrets/external-secrets/discussions/3148