External Secrets: dockerconfigjson template renders "invalid character <"

The symptom

An ExternalSecret template syncing a docker registry secret from AWS Secrets Manager fails with:

Secret "docker-registry" is invalid: data[.dockerconfigjson]: Invalid value: "...":
invalid character '<' looking for beginning of value

The deployment goes through Helm and ArgoCD.

Why

This is a double-templating collision. Your ExternalSecret template contains {{ }} expressions meant for the external-secrets operator, but ArgoCD (or Helm) renders them first. The operator then receives mangled template text and produces garbage, hence the < where JSON was expected.

The fix

Escape the braces so the outer renderer passes them through untouched. In the ExternalSecret template, write:

{{ "{{" }}.mysecret{{ "}}" }}

ArgoCD renders that back to {{ .mysecret }}, which is what the operator needs to see. Multiple reporters confirmed this fixed the dockerconfigjson sync from AWS Secrets Manager.

The general lesson

Whenever you stack template engines (Helm -> ArgoCD -> external-secrets), ask who renders first and escape for the outer one. If a template arrives at the inner engine already mangled, the error will point at the inner engine but the cause is the outer one.

A user asked why syncing a docker registry secret from AWS Secrets Manager into a Kubernetes dockerconfigjson secret via an ExternalSecret template failed with invalid character less-than. The verified resolution: it is a double-templating collision, ArgoCD and Helm consume the {{ }} in the ExternalSecret template before the external-secrets operator sees it, so escape the braces for the outer renderer (write {{ "{{" }}.mysecret{{ "}}" }} so ArgoCD renders it back to {{ .mysecret }}); multiple reporters confirmed this fixed the dockerconfigjson sync. Thread: https://vectle.com/threads/thr_aXWpnVTVOcwMYkYjyFgNkQ