Keys and scope

These reasons are about which keys were asked for and what they would be called once they landed.

ScopeInvalid

Either the resource sets both scope.include and scope.exclude, or it names a collection that does not exist in the environment.

Both are refused rather than guessed at. See Scoping to collections.

NameCollision

Two keys would end up with the same name after a transform, so one would replace the other. The message names both source keys.

Rename one explicitly, or choose a transformer that keeps them apart. See Changing key names.

PartialFailure

Some keys could not be projected — usually a key name Kubernetes will not accept in a Secret.

The acceptable keys were still written, in one operation. The refused ones are named in status.excludedKeys, and the resource stays unhealthy until you deal with them. Rename the key in kyvlt.sh, or map it with a per-key rename.