I have a secret in a source namespace with these annotations:

reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ns1,ns2,ns3,ns4
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"

I'm going through the process of replacing manually created secrets in ns1-ns4 with the Reflector managed versions. My process has been:

1. Add a new namespace to reflection-allowed-namespaces (Reflector will do nothing as the destination already exists)
2. Delete existing destination secret
3. Wait for Reflector to replace the secret, but it never does
4. Restart the Reflector pod, which causes the secret to be reflected

Is this how Reflector works? I assumed that it would always be "watching" the destination secrets on a short interval - essentially some form of drift-detection, but it looks like some operations only happen once or on startup.

I'm using Helm chart v9.1.7 with the same image version.