Reaching kyvlt.sh

These reasons are about the conversation between the operator and kyvlt.sh: the path, the token, and what that token is entitled to.

Unreachable

The operator could not reach kyvlt.sh at all — DNS, network, TLS, or kyvlt.sh being down.

Check apiBaseUrl in the resource, and whether anything in your cluster restricts outbound traffic. The operator retries with backoff, so this clears on its own once the path is back.

Unauthorised

kyvlt.sh refused the service token. It has been revoked, has expired, or was mistyped when the token Secret was created.

Mint a replacement and update that Secret. The next sync picks it up; there is nothing to restart. See Service tokens.

Forbidden

The token is valid and is not entitled to this environment. A token is scoped to one environment, and this resource names another.

Check the token’s scope against the environmentId in the resource. This one usually means a token was reused from somewhere else.

It also appears when the environment holds a value built from a key in another environment. References resolve with the reader’s permission, and a token scoped to one environment is not entitled to another — so the whole reveal is refused rather than the Secret landing with one key missing. The message names the environment it needed. Either widen the token, or keep composed values within the environment a connector reads.

NotFound

The environment does not exist, or this token is not permitted to know that it does. kyvlt.sh answers the same way for both, so that a caller cannot discover what exists by asking.

Check the environmentId, and check the token’s scope.

Incompatible

The operator does not understand the version of the kyvlt.sh API it was pointed at. It refuses to start rather than syncing incorrectly, and the log names both versions.

Upgrade the operator, or point it at the right API.