fix: use patch instead of update for finalizers addition and removal (#5670)

* fix: user patch instead of update for finalizers addition and removal

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

* also update the cluster external secret controller

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

---------

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

pkg/controllers/clusterexternalsecret/clusterexternalsecret_controller.go

@@ -106,8 +106,9 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 		}
 
 		// Remove finalizer from ClusterExternalSecret if it exists
+		patch := client.MergeFrom(clusterExternalSecret.DeepCopy())
 		if updated := controllerutil.RemoveFinalizer(&clusterExternalSecret, ClusterExternalSecretFinalizer); updated {
-			if err := r.Update(ctx, &clusterExternalSecret); err != nil {
+			if err := r.Patch(ctx, &clusterExternalSecret, patch); err != nil {
 				return ctrl.Result{}, err
 			}
 		}
@@ -117,8 +118,9 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	// Add finalizer if it doesn't exist
 	// This ensures the ClusterExternalSecret cannot be deleted until we've cleaned up all
 	// ExternalSecrets it created and removed our finalizers from namespaces.
+	patch := client.MergeFrom(clusterExternalSecret.DeepCopy())
 	if updated := controllerutil.AddFinalizer(&clusterExternalSecret, ClusterExternalSecretFinalizer); updated {
-		if err := r.Update(ctx, &clusterExternalSecret); err != nil {
+		if err := r.Patch(ctx, &clusterExternalSecret, patch); err != nil {
 			return ctrl.Result{}, err
 		}
 		// Return immediately after update to let the change propagate

pkg/controllers/externalsecret/externalsecret_controller.go

@@ -213,8 +213,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 		}
 
 		// Remove finalizer if it exists
+		// Use Patch instead of Update to avoid claiming ownership of spec fields like refreshInterval
+		patch := client.MergeFrom(externalSecret.DeepCopy())
 		if updated := controllerutil.RemoveFinalizer(externalSecret, ExternalSecretFinalizer); updated {
-			if err := r.Update(ctx, externalSecret); err != nil {
+			if err := r.Patch(ctx, externalSecret, patch); err != nil {
 				return ctrl.Result{}, err
 			}
 		}
@@ -222,8 +224,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	}
 
 	// Add finalizer if it doesn't exist
+	// Use Patch instead of Update to avoid claiming ownership of spec fields like refreshInterval
+	patch := client.MergeFrom(externalSecret.DeepCopy())
 	if updated := controllerutil.AddFinalizer(externalSecret, ExternalSecretFinalizer); updated {
-		if err := r.Update(ctx, externalSecret); err != nil {
+		if err := r.Patch(ctx, externalSecret, patch); err != nil {
 			return ctrl.Result{}, err
 		}
 	}