Upgrading to 0.16.1 - ClusterExternalSecret - secret already exists #4708
Description
Describe the bug
We are upgrading from 0.11.0 to 0.16.1. We deploy external-secrets with Helm via Flux.
We are facing an issue in that the ClusterExternalSecret is failing to apply due to "secret already exists in namespace" for our existing secrets.
To Reproduce
Steps to reproduce the behavior:
This is our manifest that is applied via Flux and Kustomize:
apiVersion: external-secrets.io/v1beta1
kind: ClusterExternalSecret
metadata:
name: common-external-secrets
spec:
externalSecretName: "common-secrets"
namespaceSelectors:
matchLabels:
secp.aviva.com/common-es: "true"
namespaces:
- "flux-system"
refreshTime: "1m"
externalSecretSpec:
secretStoreRef:
name: common-secrets
kind: ClusterSecretStore
refreshInterval: "1h"
target:
name: common-secrets
creationPolicy: 'Owner'
template:
engineVersion: v2
data:
proxy: '{{ .http_proxy }}'
HTTP_PROXY: '{{ .http_proxy }}'
HTTPS_PROXY: '{{ .http_proxy }}'
NO_PROXY: '${no_proxy}'
data:
- secretKey: http_proxy
remoteRef:
key: ${secrets_path_common}
property: http_proxy
Expected behavior
The manifest should apply without error
I have tried a couple of things
- changing creationPolicy to "Merge"
- Patching out the "OwnerReferences" from the existing secrets.
The only workaround I have currently is to delete the CusterExternalSecrets object, which will delete the secrets and then let Flux rereconcile.
Any ideas/suggestions would be greatly appreciated.