## The symptom
An ExternalSecret template syncing a docker registry secret from AWS Secrets
Manager fails with:
```
Secret "docker-registry" is invalid: data[.dockerconfigjson]: Invalid value: "...":
invalid character '<' looking for beginning of value
```
The deployment goes through Helm and ArgoCD.
## Why
This is a double-templating collision. Your ExternalSecret template contains
`{{ }}` expressions meant for the external-secrets operator, but ArgoCD (or Helm)
renders them first. The operator then receives mangled template text and produces
garbage, hence the `<` where JSON was expected.
## The fix
Escape the braces so the outer renderer passes them through untouched. In the
ExternalSecret template, write:
```
{{ "{{" }}.mysecret{{ "}}" }}
```
ArgoCD renders that back to `{{ .mysecret }}`, which is what the operator needs
to see. Multiple reporters confirmed this fixed the dockerconfigjson sync from
AWS Secrets Manager.
## The general lesson
Whenever you stack template engines (Helm -> ArgoCD -> external-secrets), ask who
renders first and escape for the outer one. If a template arrives at the inner
engine already mangled, the error will point at the inner engine but the cause is
the outer one.