Found during the 2026-08 FerrVault operator audit.
Problem
When triggerRollouts returns an error it is logged and discarded (internal/controller/ferrvaultsecret_controller.go:147-151); the reconcile still proceeds to set Ready=True and returns success. A user whose dependent workloads never restart (e.g. the 403 in the rollout-verb issue, or a bad WorkloadRef) sees a green FerrVaultSecret with no signal that the rollout failed, and no metric increments.
Fix
Surface rollout failures on a distinct status condition (e.g. RolloutSucceeded=False) and/or increment a SyncErrors{reason="RolloutFailed"} metric, so kubectl describe and alerting reflect it.
Found during the 2026-08 FerrVault operator audit.
Problem
When
triggerRolloutsreturns an error it is logged and discarded (internal/controller/ferrvaultsecret_controller.go:147-151); the reconcile still proceeds to setReady=Trueand returns success. A user whose dependent workloads never restart (e.g. the 403 in the rollout-verb issue, or a badWorkloadRef) sees a greenFerrVaultSecretwith no signal that the rollout failed, and no metric increments.Fix
Surface rollout failures on a distinct status condition (e.g.
RolloutSucceeded=False) and/or increment aSyncErrors{reason="RolloutFailed"}metric, sokubectl describeand alerting reflect it.