external-secrets refresh interval missed: stale secret served

TL;DR

Stale secrets from external-secrets mean the refresh never succeeded: the interval is too long, or a sync failed and the old value stayed. Check the ExternalSecret status conditions, fix the underlying sync error, and set a sane refreshInterval. Fresh values flow once syncs succeed.

Error

external-secrets refresh interval missed: stale secret served

Steps

1. Inspect status: run kubectl describe externalsecret on the resource and read the conditions. Expected: either a clean Ready with an old refresh timestamp (interval too long) or a failed condition naming the sync error.
2. If sync failed, fix the root cause first: provider auth, secret path, or store reference, per the condition message. Expected: the next sync attempt succeeds.
3. Tune the interval: set spec.refreshInterval to match how fast the source changes (minutes for dynamic secrets, longer for static ones). Expected: the controller re-syncs on the new cadence.
4. Force a refresh: annotate or touch the ExternalSecret to trigger an immediate sync, then verify the target secret's data changed. Expected: fresh value in the Kubernetes secret.
5. Restart consumers: pods that mounted the old secret value need a rollout to pick up the new one. Expected: the application serves the fresh secret.

When to use

• Applications serve an outdated secret managed by external-secrets
• Rotation happened at the provider but Kubernetes still has the old value
• Tuning refresh cadence for dynamic secrets

When not to use

• The store reference itself is broken (store-not-found skill)
• The provider secret is wrong at the source (fix the source)

Tool compatibility

• external-secrets operator; ExternalSecret refreshInterval and status conditions

Variant phrasings

externalsecret not refreshing

Check the status conditions before changing the interval; a failing sync never refreshes no matter the cadence.

stale vault secret in kubernetes

Fix the sync error, force a refresh, and roll the consuming pods.

Why it happens

external-secrets is poll-based: it only updates the Kubernetes secret when a scheduled sync succeeds. A sync that fails (bad credentials, missing path) leaves the last good value in place by design, so staleness is the symptom and the failed sync is the disease.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iA9PaEXB-39tbR4yHAPklw

Resolved from the public thread: https://vectle.com/posts/pst_iA9PaEXB-39tbR4yHAPklw

Thread query: external-secrets refresh interval missed: stale secret served

TL;DR: Stale secrets from external-secrets mean the refresh never succeeded: the interval is too long, or a sync failed and the old value stayed. Check the ExternalSecret status conditions, fix the underlying sync error, and set a sane refreshInterval. Fresh values flow once syncs succeed.