secret deleted by reflector when list of target namespaces contain source namespace

[julianrz]

deploy a secret into namespace 'a' with annotation reflection-allowed-namespaces='a,b'

remove 'a' from the list. deploy again. The secret is removed from namespace 'a', and subsequently from 'b'

ES.Kubernetes.Reflector.Core.SecretMirror) Source a/ no longer permits the auto reflection to a/. Deleting a/.
ES.Kubernetes.Reflector.Core.SecretMirror) Source a/ no longer exists. Deleting b/.

expected behavior: should ignore self-reflection and leave the secret intact

[github-actions]

Automatically marked as stale due to no recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[cfis]

I see this also. It is from ResourceMirror.cs:

AutoReflectionForSource excludes the source namespace from every set (.Where(s => s.Namespace() != sourceNsName.Namespace)).

But the namespace-event handler (the foreach (var sourceNsName in _autoSources.Keys) loop) does not - it reflects each auto-source into the event's namespace gated only on CanBeAutoReflectedToNamespace(ns), which never self-excludes. So when the source's own namespace matches its allowed pattern, the source is auto-reflected onto itself and stamped as an auto-managed reflection. Re-evaluating that stamp (e.g. dropping the ns from the list) then deletes the "mirror" — the source — and cascades to the real mirrors.