Flux doesnt recognize changed ExternalSecret

[lordgreg]

Hi All,

hope you are doing fine. we have some weird behaviour we somehow cant explain ourselves. We constantly push new changes to the Repo which Flux is watching over. The new HelmReleases gets produced, sometimes the release fail because specific deployment isn't configured properly (or livenessprobe fails), but the flux does its job. There are times, where we push different changes to our ExternalSecrets (https://external-secrets.io/latest/). Provided is the last commit change, which Flux also recognizes or, we see that the HelmRelease is being created:

From:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: my-credentials
  namespace: {{ .Release.Namespace }}
spec:
  refreshInterval: 1m
  secretStoreRef:
    kind: SecretStore
    name: secret-store
  target:
    name: my-credentials
    template:
      type: Opaque
      data:
        FOO_BAR: "{{ `{{ .foo_bar }}` }}"
  data:
    - secretKey: foo_bar
      remoteRef:
        key: foo-bar-password

To:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: my-credentials
  namespace: {{ .Release.Namespace }}
spec:
  refreshInterval: 1m
  secretStoreRef:
    kind: SecretStore
    name: secret-store
  target:
    name: my-credentials
    template:
      type: Opaque
      data:
        FOO_BAR: "{{ `{{ .foo_bar_real }}` }}"
  data:
    - secretKey: foo_bar_real
      remoteRef:
        key: foo-bar-password

As you see, the key from keyvault hasnt changed (it stays as foo-bar-password), the value in KV is unchanged too.

But the flux, in HelmRelease states:
2026-07-21T13:19:11.657924442Z: Patch ExternalSecret "secret-entry-one" in namespace my-namespace
2026-07-21T13:19:11.715597438Z: Patch ExternalSecret "secret-entry-two" in namespace my-namespace
2026-07-21T13:19:11.771099796Z: Looks like there are no changes for ExternalSecret "my-credentials" in namespace my-namespace

Which is very weird because, the only change that came into the commit is exactly the one I presented above. So to work around this, I have to push the ExternalSecret with the new name (renamed from my-credentials to my-credentials-2). The flux found a new secret and deployed it where he left the my-secret intact. Then, I've commited the change again and renamed my-secret-2 back to my-secret.

We are currently looking for a fix or a good workaround for this since quite a lot of teams in our orga need to change/deploy constantly and sometimes, these changes are not "found" by flux as you see in the example above.

What is the correct approach to fix this issue?

Kind regards

[stefanprodan]

Please post here:

• the output of flux check
• the HelmRelease YAML file from your git repo
• the output of kubectl -n <your-ns> get ExternalSecret my-credentials -o yaml --show-managed-fields

[lordgreg]

Hi @stefanprodan, thank you for you feedback:

regarding flux, we use flux2-2.14.0 version, controllers are installed in different namespace as where our issues with secret reside:

C:\Users\tzyder>flux check -n flux-ops
► checking prerequisites
✗ flux 2.7.5 <2.9.3 (new CLI version is available, please upgrade)
✔ Kubernetes 1.34.6 >=1.32.0-0
► checking version in cluster
✔ distribution: flux-2.4.0
✔ bootstrapped: false
► checking controllers
✔ helm-controller: deployment ready
► removed_repo_image_with_hash
✔ image-automation-controller: deployment ready
► removed_repo_image_with_hash
✔ image-reflector-controller: deployment ready
► removed_repo_image_with_hash
✔ kustomize-controller: deployment ready
► removed_repo_image_with_hash
✔ notification-controller: deployment ready
► removed_repo_image_with_hash
✔ source-controller: deployment ready
  ► reg-ssp.epu.corpintra.net/azure-aks/fluxcd/source-controller:v1.4.1@sha256:3c5f0f022f990ffc0daf00e5b199548fc0fa6e7119e972318f0267081a332963
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta3
✔ buckets.source.toolkit.fluxcd.io/v1
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1
✔ helmreleases.helm.toolkit.fluxcd.io/v2
✔ helmrepositories.source.toolkit.fluxcd.io/v1
✔ imagepolicies.image.toolkit.fluxcd.io/v1beta2
✔ imagerepositories.image.toolkit.fluxcd.io/v1beta2
✔ imageupdateautomations.image.toolkit.fluxcd.io/v1beta2
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta3
✔ receivers.notification.toolkit.fluxcd.io/v1
✔ all checks passed
 
C:\Users\tzyder>flux check -n my-namespace
► checking prerequisites
✗ flux 2.7.5 <2.9.3 (new CLI version is available, please upgrade)
✔ Kubernetes 1.34.6 >=1.32.0-0
► checking version in cluster
✔ distribution: flux-2.4.0
✔ bootstrapped: false
► checking controllers
✗ no controllers found in the 'my-namespace' namespace with the label selector 'app.kubernetes.io/part-of=flux'
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta3
✔ buckets.source.toolkit.fluxcd.io/v1
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1
✔ helmreleases.helm.toolkit.fluxcd.io/v2
✔ helmrepositories.source.toolkit.fluxcd.io/v1
✔ imagepolicies.image.toolkit.fluxcd.io/v1beta2
✔ imagerepositories.image.toolkit.fluxcd.io/v1beta2
✔ imageupdateautomations.image.toolkit.fluxcd.io/v1beta2
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta3
✔ receivers.notification.toolkit.fluxcd.io/v1
✗ check failed

helmrelease (ansible workbook)

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: flux-helmrelease-{{ tenant_namespace }}-{{ helmchart }}
  namespace: {{ tenant_namespace }}
  labels:
    toolkit.fluxcd.io/tenant: {{ tenant_namespace }}
spec:
  serviceAccountName: flux-sa-{{ tenant_namespace }}
  interval: 1m
  chart: 
    spec:
      chart: ./charts/{{ helmchart }}
      reconcileStrategy: Revision
      sourceRef:
        kind: GitRepository
        name: flux-repo-{{ tenant_namespace }}
        namespace: {{ tenant_namespace }}
      valuesFiles:
        - ./charts/{{ helmchart }}/values.yaml
        - ./charts/{{ helmchart }}/values-{{ env.name }}.yaml
      interval: 1m
  driftDetection:
    mode: {{ drift_detection_mode | default('enabled') }}
  targetNamespace: {{ tenant_namespace }}
  timeout: 5m0s

kubectl -n get ExternalSecret my-credentials -o yaml --show-managed-fields:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  annotations:
    meta.helm.sh/release-name: my-namespace-my-release-my-name
    meta.helm.sh/release-namespace: my-namespace
  creationTimestamp: "2026-07-21T12:50:09Z"
  generation: 3
  labels:
    app.kubernetes.io/managed-by: Helm
    helm.toolkit.fluxcd.io/name: my-release-my-name
    helm.toolkit.fluxcd.io/namespace: my-namespace
  managedFields:
  - apiVersion: external-secrets.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/managed-by: {}
          f:helm.toolkit.fluxcd.io/name: {}
          f:helm.toolkit.fluxcd.io/namespace: {}
      f:spec:
        .: {}
        f:data: {}
        f:refreshInterval: {}
        f:secretStoreRef:
          .: {}
          f:kind: {}
          f:name: {}
        f:target:
          .: {}
          f:creationPolicy: {}
          f:deletionPolicy: {}
          f:name: {}
          f:template:
            .: {}
            f:data:
              .: {}
              f:FOO_BAR: {}
            f:engineVersion: {}
            f:mergePolicy: {}
            f:type: {}
    manager: helm-controller
    operation: Update
    time: "2026-07-21T17:08:16Z"
  - apiVersion: external-secrets.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:binding: {}
        f:conditions: {}
        f:refreshTime: {}
        f:syncedResourceVersion: {}
    manager: external-secrets
    operation: Update
    subresource: status
    time: "2026-07-27T07:18:32Z"
  name: my-credentials
  namespace: my-namespace
  resourceVersion: "379450702"
  uid: 023d8918-d1f2-49b0-9f4d-c618cf267efd
spec:
  data:
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: foo-bar-password
      metadataPolicy: None
    secretKey: foo_bar_real
  refreshInterval: 1m
  secretStoreRef:
    kind: SecretStore
    name: secret-store
  target:
    creationPolicy: Owner
    deletionPolicy: Retain
    name: my-credentials
    template:
      data:
        FOO_BAR: '{{ .foo_bar_real }}'
      engineVersion: v2
      mergePolicy: Replace
      type: Opaque
status:
  binding:
    name: my-credentials
  conditions:
  - lastTransitionTime: "2026-07-21T17:08:17Z"
    message: secret synced
    reason: SecretSynced
    status: "True"
    type: Ready
  refreshTime: "2026-07-27T07:18:32Z"
  syncedResourceVersion: 3-xxxxxx

[stefanprodan]

There is no flux2-2.14.0 version, we can not offer support for what it looks like a Flux fork.

[lordgreg]

Sorry @stefanprodan, I was a bit too fast,

the flux2- 2.14.0 is the HELM Chart (https://artifacthub.io/packages/helm/fluxcd-community/flux2/2.14.0), which uses the flux version 2.4.0.

And by the looks of it, this is a very old flux version too. Please leave the discussion open, we will upgrade to the latest version and I will let you know what happens when updating the externalsecret.

[stefanprodan]

Yeah 2.4 has reached end-of-life.