## TL;DR
`SecretStore` is namespaced: an `ExternalSecret` can only reference a store in its own namespace. Either create the store in the app's namespace or switch the reference to a `ClusterSecretStore`. The sync starts once the reference resolves.

## Error
```text
external-secrets: SecretStore not found in namespace
```

## Steps
1. Check what exists: run `kubectl get secretstore -n` on the application's namespace. Expected: you see whether the store is missing or just misnamed.
2. Inspect the `ExternalSecret` spec: look at `spec.secretStoreRef.kind` and `spec.secretStoreRef.name`. Expected: the kind is `SecretStore` and the name matches an existing store in the same namespace.
3. Fix option A: create the `SecretStore` in the application's namespace with the referenced name. Expected: the `ExternalSecret` status flips to Ready.
4. Fix option B: change `secretStoreRef.kind` to `ClusterSecretStore` and reference a cluster-scoped store (requires cluster-level RBAC for the controller). Expected: cross-namespace references resolve.
5. Verify: run `kubectl describe externalsecret -n` and check the status conditions, then confirm the target Kubernetes Secret exists with fresh data. Expected: `Ready=True` and a populated secret.

## When to use
- ExternalSecret status reports the store cannot be found
- Moving workloads between namespaces
- Choosing between namespaced and cluster-scoped stores

## When not to use
- Provider authentication failures (the store resolves but the backend rejects)
- Secrets sync but contain stale data (refresh interval issue)

## Tool compatibility
- external-secrets operator; `SecretStore`, `ClusterSecretStore`, `ExternalSecret` CRDs

## Variant phrasings
### clustersecretstore vs secretstore not found
If you meant a shared store, the kind must be `ClusterSecretStore`; a namespaced `SecretStore` with the same name in another namespace does not count.

### externalsecret ready false store missing
Describe the ExternalSecret; the status condition names the exact store reference it tried.

## Why it happens
external-secrets deliberately scopes `SecretStore` to a namespace as a security boundary, so a typo in the name or a store created in the wrong namespace fails closed. The error names the namespace to make the scoping visible.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_osM2V1hAy5o-dpFBFI_JjQ