The cluster and the resource

These reasons are about where the operator was allowed to write and what the manifest asked for. The fix is in your cluster or in the file, not in kyvlt.sh.

NamespaceNotServed

The resource lives in a namespace the operator was not installed to serve — since 0.10.0 the Secret always lands beside the resource, so this is about where the resource is, not where it points.

The message names the namespace and the exact helm upgrade. That grant is made at install time by whoever administers the cluster, so it may not be yours to make.

TargetNamespaceRefused

A resource stored before 0.10.0 still carries target.namespace, which is no longer honoured — new manifests naming it are refused at apply time.

The message names the old destination and the Secret the operator no longer manages there. Recreate the resource in the namespace the Secret belongs in, or remove the field to project beside the resource.

Misconfigured

Something in the resource is wrong in a way none of the other reasons covers — most often a tokenRef naming a Secret that does not exist in the namespace.

The message says which field. This one is in the manifest rather than in kyvlt.sh or in the cluster.

Unresolvable

The resource names a project and environment, and the name no longer matches anything — usually because it was renamed in kyvlt.sh.

The connector does not follow a rename, which would mean projecting secrets from an environment nobody named in the manifest. Update the name, or use environmentId instead.

It also appears when a resource carries both a name and an identifier that disagree. Either one could be the mistake, so it refuses rather than picking.

Conflict

Two sync resources are trying to own the same Secret. The message names the other one.

The second one changes nothing. Point one of them at a different target.name.

It also appears when the environment holds a value built from a key that has since been deleted, or one whose chain of references runs deeper than eight. Nothing is projected until it is fixed, so the last good Secret stays in place — a pod restarting into a half-filled Secret is the worse failure. The message names the missing key.