1password provider tries to read wrong vault #4663
Description
Describe the bug
I'm trying to pull a secret from a particular vault with the 1password provider. I have a few different ClusterSecretStores, one per vault, and I'm referencing the tf vault specifically from my ExternalSecret spec. However, I constantly get "key not found" events that reference a different vault name:
Warning UpdateFailed 48m (x69 over 2d17h) external-secrets error processing spec.data[5] (key: FUTO_ZULIP_DOMAIN), err: key not found in 1Password Vaults: FUTO_ZULIP_DOMAIN in: map[tf_dev:1]
This key indeed doesn't exist in tf_dev, but I'm not referencing that vault at all. It does exist in tf.
The Kubernetes Secret seems to be populated correctly, though I'm not sure whether it's receiving proper updates for the field that errors.
Specifically which field is mentioned in the error doesn't seem to be consistent; I can see six events right now mentioning different fields, and one of those is combined from similar events. It seems like it might be changing when a reconciliation loop runs, or something like that.
Events
~ ❯ k get event | grep externalsecret
60m Warning UpdateFailed externalsecret/discord-bot error processing spec.data[5] (key: FUTO_ZULIP_DOMAIN), err: key not found in 1Password Vaults: FUTO_ZULIP_DOMAIN in: map[tf_dev:1]
50m Warning UpdateFailed externalsecret/discord-bot error processing spec.data[6] (key: IMMICH_DISCORD_BOT_GITHUB_WEBHOOK_SLUG), err: key not found in 1Password Vaults: IMMICH_DISCORD_BOT_GITHUB_WEBHOOK_SLUG in: map[tf_dev:1]
40m Warning UpdateFailed externalsecret/discord-bot error processing spec.data[7] (key: IMMICH_DISCORD_BOT_GITHUB_STATUS_SLUG), err: key not found in 1Password Vaults: IMMICH_DISCORD_BOT_GITHUB_STATUS_SLUG in: map[tf_dev:1]
25m Warning UpdateFailed externalsecret/discord-bot error processing spec.data[8] (key: IMMICH_DISCORD_BOT_STRIPE_PAYMENT_SLUG), err: key not found in 1Password Vaults: IMMICH_DISCORD_BOT_STRIPE_PAYMENT_SLUG in: map[tf_dev:1]
15m Warning UpdateFailed externalsecret/discord-bot (combined from similar events): error processing spec.data[9] (key: FOURTHWALL_USER), err: key not found in 1Password Vaults: FOURTHWALL_USER in: map[tf_dev:1]
10m Warning UpdateFailed externalsecret/discord-bot error processing spec.data[9] (key: FOURTHWALL_USER), err: key not found in 1Password Vaults: FOURTHWALL_USER in: map[tf_dev:1]
44s Warning UpdateFailed externalsecret/discord-bot error processing spec.data[10] (key: FOURTHWALL_PASSWORD), err: key not found in 1Password Vaults: FOURTHWALL_PASSWORD in: map[tf_dev:1]
To Reproduce
ClusterSecretStore: https://github.com/immich-app/devtools/blob/main/kubernetes/apps/infrastructure/secrets/external-secrets/stores/1p-tf.yaml
ExternalSecret: https://github.com/immich-app/devtools/blob/main/kubernetes/apps/tools/discord-bot/app/secret.yaml
ESO deployment: https://github.com/immich-app/devtools/blob/main/kubernetes/apps/infrastructure/secrets/external-secrets/app/helmrelease.yaml
Kubernetes version: 1.28.6
Expected behavior
The secret is pulled from the vault I reference
Screenshots
n/a
Additional context
I've tried to have a look at the code myself to see if I could work out the issue, but didn't find any leads.