Found during the 2026-08 FerrVault operator audit.
Problem
probe only performs an unauthenticated GET /health (internal/ferrvault/client.go:100-129, Probe explicitly "does not exercise the token"), yet ConnectionStatus.Conditions is documented as "True when the token authenticates and the secrets:read scope is present" (api/ferrvault/v1alpha1/connectionspec_types.go:143-145). Reconcile at ferrvaultconnection_controller.go:141-163.
Impact
A connection with an invalid/expired/wrong-scope token reports Ready=True, Reachable. The auth failure only surfaces later on the dependent FerrVaultSecret, making the primary troubleshooting surface misleadingly green.
Fix
Either make the probe do a cheap authenticated call (e.g. an operator me/scoped no-op) so Ready reflects auth, or correct the doc + condition semantics to state clearly that Reachable/Ready only checks reachability, not credentials.
Found during the 2026-08 FerrVault operator audit.
Problem
probeonly performs an unauthenticatedGET /health(internal/ferrvault/client.go:100-129,Probeexplicitly "does not exercise the token"), yetConnectionStatus.Conditionsis documented as "Truewhen the token authenticates and thesecrets:readscope is present" (api/ferrvault/v1alpha1/connectionspec_types.go:143-145). Reconcile atferrvaultconnection_controller.go:141-163.Impact
A connection with an invalid/expired/wrong-scope token reports
Ready=True, Reachable. The auth failure only surfaces later on the dependentFerrVaultSecret, making the primary troubleshooting surface misleadingly green.Fix
Either make the probe do a cheap authenticated call (e.g. an operator
me/scoped no-op) soReadyreflects auth, or correct the doc + condition semantics to state clearly thatReachable/Readyonly checks reachability, not credentials.