VaultStaticSecret stays in error forever when JWT role name changed

[Cajga]

Describe the bug
We are using JWT authentication to an external Vault instance. Everything is working well. However, we wanted to change the JWT role name and the audiences of one of the roles that were used by one VaultAuth (and VaultStaticSecret resource) already.
However the VaultStaticSecret resource stays in Error state and does not start to use the modified VaultAuth configuration (even if the VaultAuth picked up the new rolename and audiences):

$ kubectl describe vaultauths.secrets.hashicorp.com -n vso ephemeral-storage-metrics|grep -A 30 Status:
Status:
  Conditions:
    Last Transition Time:  2025-04-30T12:26:02Z
    Message:               VaultAuthGlobal successfully merged, key=vso/vault, uid=400e8ee2-3dcf-4a34-8b9c-5b15c30bdae5, generation=1
    Observed Generation:   2
    Reason:                VaultAuthGlobalRef
    Status:                True
    Type:                  Available
  Spec Hash:               18268199ed7229b6eeaba3bb80c911cded4764094d2060f54f2b4f4cdb2598b4
  Valid:                   true
Events:
  Type    Reason    Age                  From       Message
  ----    ------    ----                 ----       -------
  Normal  Accepted  40m (x2 over 4d20h)  VaultAuth  Successfully handled VaultAuth resource request

$ kubectl describe vaultstaticsecrets.secrets.hashicorp.com -n ephemeral-storage-metrics private-registry-auth|grep -A 10 Events
Events:
  Type     Reason                  Age                 From               Message
  ----     ------                  ----                ----               -------
  Warning  VaultClientConfigError  41m (x25 over 43m)  VaultStaticSecret  Failed to get Vault auth login: Error making API request.

URL: PUT https://vault.example.com/v1/auth/jwt-dev01/login
Code: 400. Errors:

* role "vso-ephemeral-storage-metrics" could not be found

Based on the logs, it seems like the VaultStaticSecret only tried for about a minute to sync then it never tries it again. What would be the right way to force a re-sync in such cases WITHOUT loosing the secret that was originally synced?

To Reproduce
Steps to reproduce the behavior:

1. Deploy VSO with JWT auth to external Vault
2. Setup VaultAuth with a given role name and audiences
3. Create a VaultStaticSecret using the created VaultAuth and wait until it syncs the secret
4. Modify the role-name and expected audience name in Vault cluster
5. Wait until the VaultStaticSecret fails to sync
6. Modify the VaultAuth resource on K8s to follow the changes of the Vault cluster configuration
7. While the VaultAuth resource reports a positive change in the Status field the VaultStaticSecret stays in the same Error state and never tries to sync again.

Application deployment is done with the following Values file:

    defaultVaultConnection:
      enabled: true
      address: https://vault.example.com
    controller:
      manager:
        globalTransformationOptions:
          excludeRaw: true
      rbac:
        clusterRoleAggregation:
          viewerRoles:
            - VaultStaticSecret
          userFacingRoles:
            view: true

VaultAuthGlobal resoruce:

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuthGlobal
metadata:
  name: vault
  namespace: vso
spec:
  defaultAuthMethod: jwt
  defaultMount: jwt-dev01
  jwt:
    mount: jwt-dev01
    tokenExpirationSeconds: 600
  vaultConnectionRef: vso/default

VaultAuth resource:

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: ephemeral-storage-metrics
  namespace: vso
spec:
  allowedNamespaces:
  - ephemeral-storage-metrics
  jwt:
    audiences:
    - vso-dev01-ephemeral-storage-metrics
    role: vso-dev01-ephemeral-storage-metrics
    serviceAccount: vso
    tokenExpirationSeconds: 600
  vaultAuthGlobalRef:
    name: vault

VaultStaticSecret resource:

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: private-registry-auth
  namespace: ephemeral-storage-metrics
spec:
  destination:
    create: true
    name: private-registry-auth
    overwrite: true
    transformation:
      excludes:
      - .*
      templates:
        .dockerconfigjson:
          text: |
            {"auths":{
            {{- $first := true -}}
            {{- range $k, $v := .Secrets -}}
            {{- if not $first }},{{- end -}}
            {{- printf "\"%s\":{\"auth\":\"%s\"}" $k $v -}}
            {{- $first = false -}}
            {{- end -}}
            }}
    type: kubernetes.io/dockerconfigjson
  hmacSecretData: true
  mount: kv-v2
  path: infra/containerregistry/auth_json_conf
  refreshAfter: 10m
  type: kv-v2
  vaultAuthRef: vso/ephemeral-storage-metrics

Expected behavior
We expect that VaultStaticSecret will re-try after some time automatically using the new VaultAuth config.

Environment

• Kubernetes version:
  • EKS Anywhere on prem: v1.30.7-eks-68cabf3
• vault-secrets-operator version: 0.10.0

Additional context
Relevant log entries for the issue (you can see that the controller stopped syncing after basically 2 minutes):

$ date
Mon May  5 10:54:17 AM CEST 2025
$ kubectl logs -n vso vso-vault-secrets-operator-controller-manager-869c677755-nkphh |grep -i ephe > /tmp/logs
$ sed -i 's/OURDOMAIN/example.com/g' /tmp/logs
$ cat /tmp/logs
{"level":"error","ts":"2025-05-05T08:02:15Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"e5580eac-21f5-48bc-8c5e-7be7fe702cb3","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:19Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"a63f74f5-9fab-440d-be29-ee2a3b797526","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:24Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"3c96d219-9976-4bab-88e6-f1ca13aa7b89","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:28Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"b4f187d2-8437-48e4-8dd9-8ab084eef887","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:32Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"cb880ca8-b78b-4654-ade1-4e2ae75cec61","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:36Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"8e04b3d4-f6f2-4968-b453-60d2e01ac163","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:41Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"2afa62b9-9ff9-4bdc-b89f-0cc491236504","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:45Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"6b6e52fe-3ae6-44b3-95a7-a2e283e76c23","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:49Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"77b8cb89-4d9e-4c8c-b55b-ee4a92da9efc","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:53Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"e1d0c3fc-4675-4dc9-a04c-af61c719cff7","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:02:58Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"cf8644a2-e7a3-4e44-b189-1b72829db065","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:02Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"37ab6621-7236-4236-adc3-7ba0e66577f5","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:06Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"56691ec9-95bc-4970-a990-4482e298700f","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:11Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"5f54687d-82af-4fe3-804c-0eb176cd97ac","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:15Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"a68be2cb-a8b4-4498-a266-343f0c033347","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:19Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"83918b40-bcd4-4068-a7cb-aee35dfa3f72","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:24Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"884116e6-9891-4423-8b44-be28a69d6938","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:28Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"675bcbea-a922-4e4a-b03e-7c95bd4a2eea","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:32Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"c9628414-b856-4b08-bafc-10109d480d5f","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:37Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"16820ba4-c31f-4e06-a9dc-127fee20bb7c","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:41Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"4ecf6663-f289-4564-813f-45873f75597e","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:45Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"53bd5680-67e8-48b2-8eaa-a4888f2628d2","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:49Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"a5b49426-e260-4df4-9ffc-88ff89814fbf","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:54Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"467cc5b3-1a77-476b-9ced-c43d11cf5395","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:03:58Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"732f24c6-ed30-47e3-ac8e-d367f1c07a94","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:04:02Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"24cd49e2-f76a-4664-8c32-463b31590d85","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:04:06Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"faa566d9-930e-4bfa-80d2-caefa54802c6","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}
{"level":"error","ts":"2025-05-05T08:04:11Z","logger":"cachingClientFactory","msg":"Failed to get NewClientWithLogin","controller":"vaultstaticsecret","controllerGroup":"secrets.hashicorp.com","controllerKind":"VaultStaticSecret","VaultStaticSecret":{"name":"private-registry-auth","namespace":"ephemeral-storage-metrics"},"namespace":"ephemeral-storage-metrics","name":"private-registry-auth","reconcileID":"6563b55e-1448-48f4-b652-0cecfdac8fe9","cacheKey":"jwt-6b39491f030034b99e4352","error":"Error making API request.\n\nURL: PUT https://vault.example.com/v1/auth/jwt-dev01/login\nCode: 400. Errors:\n\n* role \"vso-ephemeral-storage-metrics\" could not be found"}

[Cajga]

Still could not find a documented way on how to force a sync without removing the resource... anyone?