When External Secrets Operator's Manual Refresh Runs Into `refreshInterval: 0`

External Secrets Operator v2.11.0: with the default refresh policy and refreshInterval: 0, the FAQ's annotation, label or spec change left the Secret stale; 1h and OnChange refreshed at once.

When It Runs — Run Report #RR11 · Testing what infrastructure actually does.

Provider · Component: External Secrets Operator · refreshing an ExternalSecret by hand — what the manual refresh in the project's FAQ (changing an annotation, a label or the spec) does when the ExternalSecret uses the default refresh policy, Periodic, with refreshInterval: 0 and the default creation policy, Owner

Versions tested: measured — External Secrets Operator v2.11.0 (the current minor release as of 2026-09-27; v2.12.0, v2.13.0 and v2.14.0, released on 2026-10-06, 2026-10-16 and 2026-10-23, were not measured, and v2.14.0 is the current minor release as of 2026-10-23; the project supports only the current minor version, and its support table lists 2.11's end of life as 2026-10-06), a single version. source-read — pkg/controllers/externalsecret/externalsecret_controller.go at the same tag. The behavior came in v0.11.0 (pull request #4086, milestone 0.11.0) — a boundary taken from the pull request, not measured.

Config profile: a single-node kind cluster (kind v0.33.0, node kindest/node:v1.36.4, digest-pinned; Kubernetes 1.36 is the version the project lists for 2.11) on a dedicated test VM; the official Helm chart 2.11.0 with the controller's log level at debug; one SecretStore using the fake provider; three ExternalSecrets that differ only in their refresh settings — refreshInterval: 0s (default policy), refreshInterval: 1h (default policy), and refreshPolicy: OnChange — all with the default creation policy; the store value is changed once, then the refreshInterval: 0s object gets an annotation change, a label change and a spec change that adds a new data key, and each of the other two gets an annotation change, with 120 seconds of polling every 5 seconds after each change.

Verified on: 2026-10-23 (desk sources re-checked; v2.14.0 was the current minor release) · lab measured 2026-09-28 on v2.11.0.

Affects: External Secrets Operator v2.11.0 ExternalSecrets that use the default refresh policy with refreshInterval: 0 (and the default creation policy) and have synced once: the FAQ's manual refresh — an annotation, label or spec change — did not fetch the Secret again, and the object's refresh status stayed the same. The same annotation change refreshed ExternalSecrets with refreshInterval: 1h or refreshPolicy: OnChange.

TL;DR: On External Secrets Operator v2.11.0, an ExternalSecret with the default refresh policy and refreshInterval: 0 kept its Secret at the old value after each manual refresh the FAQ lists — an annotation change, a label change, and a spec change that maps a new data key — with refreshTime unchanged; the same annotation change refreshed ExternalSecrets with refreshInterval: 1h or refreshPolicy: OnChange.

Full report: https://whenitruns.substack.com/p/when-external-secrets-operators-manual

Reproduction repo: https://github.com/whenitruns/when-external-secrets-operators-manual-refresh-runs-into-refreshinterval-0