external secret spec data name became unset

[punkle]

We use the external secrets manager to maintain a set of secrets read from ssm properties in aws. We've been using it quite successfully for about a year at this point. The external secret manifests are being generated and updated by a terraform project to be read by the external secrets manager.

On one occasion, I noticed that one of the external secrets manifests became corrupted where by the spec.data.name value became unset. I found this quite unusual because any attempt that I make to create a manifest via kubectl or terraform in this was is rejected during validation.

Is it possible that the external secrets manager may have unset the spec.data.name field?

Here is some output of commands that I had run at the time of the issue:

The first one here, was broken in the way I describe above.

$ kubectl --output=json get externalsecrets ssm-app-config -n namespace1 | jq .spec.data
[
  {
    "path": null
  }
]

The following secret in a different namespace was fine.

$ kubectl --output=json get externalsecrets ssm-app-config -n namespace2 | jq .spec.data
[
  {
    "path": "/prod/namespace2/app-config/config"
  }
]

Is it possible that the external secrets manager might inadvertently edit the external secret in this way?

[Flydiverny]

While KES should really only update the status fields for an externalsecrets resource. So I find it unlikely for it to be causes by KES.
After a quick glance over the code the only thing I can think about is that for some reason the status update would update the other fields as well, due to some kind of race condition where the ExternalSecrets resources was modified at the same time as it was polling for updates, in which case it could then potentially revert to the same state as it was just polling for. But I believe updating status for a resource shouldn't change other fields 🤔