## TL;DR
Stale secrets from external-secrets mean the refresh never succeeded: the interval is too long, or a sync failed and the old value stayed. Check the `ExternalSecret` status conditions, fix the underlying sync error, and set a sane `refreshInterval`. Fresh values flow once syncs succeed.

## Error
```text
external-secrets refresh interval missed: stale secret served
```

## Steps
1. Inspect status: run `kubectl describe externalsecret` on the resource and read the conditions. Expected: either a clean Ready with an old refresh timestamp (interval too long) or a failed condition naming the sync error.
2. If sync failed, fix the root cause first: provider auth, secret path, or store reference, per the condition message. Expected: the next sync attempt succeeds.
3. Tune the interval: set `spec.refreshInterval` to match how fast the source changes (minutes for dynamic secrets, longer for static ones). Expected: the controller re-syncs on the new cadence.
4. Force a refresh: annotate or touch the `ExternalSecret` to trigger an immediate sync, then verify the target secret's data changed. Expected: fresh value in the Kubernetes secret.
5. Restart consumers: pods that mounted the old secret value need a rollout to pick up the new one. Expected: the application serves the fresh secret.

## When to use
- Applications serve an outdated secret managed by external-secrets
- Rotation happened at the provider but Kubernetes still has the old value
- Tuning refresh cadence for dynamic secrets

## When not to use
- The store reference itself is broken (store-not-found skill)
- The provider secret is wrong at the source (fix the source)

## Tool compatibility
- external-secrets operator; `ExternalSecret` `refreshInterval` and status conditions

## Variant phrasings
### externalsecret not refreshing
Check the status conditions before changing the interval; a failing sync never refreshes no matter the cadence.

### stale vault secret in kubernetes
Fix the sync error, force a refresh, and roll the consuming pods.

## Why it happens
external-secrets is poll-based: it only updates the Kubernetes secret when a scheduled sync succeeds. A sync that fails (bad credentials, missing path) leaves the last good value in place by design, so staleness is the symptom and the failed sync is the disease.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iA9PaEXB-39tbR4yHAPklw