Secrets-Operator: Secrets-deletion does not work when deleting one of managedKubeSecretReferences

[mmueller-rs]

Describe the bug

We're using Infisical Secrets-Operator to load the Secrets into Kubernetes using the CRD InfisicalSecret.
When using the creationPolicy: Owner for the managedKubeSecretReferences the managed Secrets should be deleted, when the InfisicalSecret is deleted/updated.
This works fine as long as the whole InfisicalSecret is deleted. But when managing multiple Secrets with a single InfisicalSecret, removing one item from the Array does not remove the respective Secret.

To Reproduce

Steps to reproduce the behavior:

1. In Infisical, create two Secrets SECRET1 and SECRET2.

2. Create an InfisicalSecret according to the following YAML-Manifest (replacing the <PLACEHOLDER>'s with your authentication credentials):

   apiVersion: secrets.infisical.com/v1alpha1
   kind: InfisicalSecret
   metadata:
     name: test-secret
     namespace: infisical-secrets
   spec:
     authentication:
       <PLACEHOLDER>
     hostAPI: <PLACEHOLDER>
     managedKubeSecretReferences:
     - creationPolicy: Owner
       secretName: secret1
       secretNamespace: infisical-secrets
       secretType: Opaque
       template:
         data:
           secret1.yml: '{{ .SECRET1.Value }}'
     - creationPolicy: Owner
       secretName: secret2
       secretNamespace: infisical-secrets
       secretType: Opaque
       template:
         data:
           secret2.yml: '{{ .SECRET2.Value }}'
     resyncInterval: 60
   

3. Ensure that two secrets secret1 and secret2 have been created

4. Remove the item for secretName: secret1 from spec.managedKubeSecretReferences

5. Confirm that both Secrets secret1 and secret2 are still existing, although secret1 should have been deleted.

Expected behavior

If one item in spec.managedKubeSecretReferences is deleted, the respective Secret should be deleted.

Platform you are having the issue on:

• Kubernetes v1.29.12
• Infisical Secrets-Operator Version 0.10.9

[HeathKnowles]

The current InfisicalSecretReconciler only creates and updates managed Secrets and ConfigMaps but doesn’t handle deletion when a managedKubeSecretReference is removed. This causes the behavior in #4599.
Fixing it requires tracking previously managed secrets and deleting any that are no longer referenced, ensuring creationPolicy: Owner works correctly.

cc: @maidul98 @mmueller-rs

[victorvhs017]

Hi @mmueller-rs,

We have updated our Helm chart with the fix in version v0.10.10.