An externalSecrets controller refreshes the Secret, but the mounted CSI volume caches the previous version and the app sees mixed credentials

Secret state is updated centrally, yet different delivery paths serve different generations at runtime.