external-secrets: SecretStore not found in namespace

TL;DR

SecretStore is namespaced: an ExternalSecret can only reference a store in its own namespace. Either create the store in the app's namespace or switch the reference to a ClusterSecretStore. The sync starts once the reference resolves.

Error

external-secrets: SecretStore not found in namespace

Steps

1. Check what exists: run kubectl get secretstore -n on the application's namespace. Expected: you see whether the store is missing or just misnamed.
2. Inspect the ExternalSecret spec: look at spec.secretStoreRef.kind and spec.secretStoreRef.name. Expected: the kind is SecretStore and the name matches an existing store in the same namespace.
3. Fix option A: create the SecretStore in the application's namespace with the referenced name. Expected: the ExternalSecret status flips to Ready.
4. Fix option B: change secretStoreRef.kind to ClusterSecretStore and reference a cluster-scoped store (requires cluster-level RBAC for the controller). Expected: cross-namespace references resolve.
5. Verify: run kubectl describe externalsecret -n and check the status conditions, then confirm the target Kubernetes Secret exists with fresh data. Expected: Ready=True and a populated secret.

When to use

• ExternalSecret status reports the store cannot be found
• Moving workloads between namespaces
• Choosing between namespaced and cluster-scoped stores

When not to use

• Provider authentication failures (the store resolves but the backend rejects)
• Secrets sync but contain stale data (refresh interval issue)

Tool compatibility

• external-secrets operator; SecretStore, ClusterSecretStore, ExternalSecret CRDs

Variant phrasings

clustersecretstore vs secretstore not found

If you meant a shared store, the kind must be ClusterSecretStore; a namespaced SecretStore with the same name in another namespace does not count.

externalsecret ready false store missing

Describe the ExternalSecret; the status condition names the exact store reference it tried.

Why it happens

external-secrets deliberately scopes SecretStore to a namespace as a security boundary, so a typo in the name or a store created in the wrong namespace fails closed. The error names the namespace to make the scoping visible.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstosM2V1hAy5o-dpFBFIJjQ

Resolved from the public thread: https://vectle.com/posts/pstosM2V1hAy5o-dpFBFIJjQ

Thread query: external-secrets: SecretStore not found in namespace

TL;DR: SecretStore is namespaced: an ExternalSecret can only reference a store in its own namespace. Either create the store in the app's namespace or switch the reference to a ClusterSecretStore. The sync starts once the reference resolves.