Status & Specification

The conditions the operator posted, and the validator's configuration as applied. Status is what the operator reports, Specification is what you asked for.

Status

Metric cards

Each card appears only when the underlying value has been reported.

Card	Values
Database	Provisioned or Pending — whether the participant and validator databases have been created.
Auth Provisioned	Yes or No — whether managed authentication has completed. Only meaningful when managedKeycloak is enabled.
Observed Generation	The generation of the Validator resource the operator last reconciled.

Observed Generation is the field to check after editing a validator. If it lags behind the resource's current generation, your change has not been reconciled yet — or the reconcile is failing, in which case the conditions table below will say why.

Conditions

Column	Contents
Type	The condition type. In practice, always Ready.
Status	True, False, or Unknown.
Reason	A short machine-readable cause.
Message	A human-readable explanation.
Last transition	When the status last changed.

The reasons you will see:

Reason	What to do
AllApplicationsReady	Nothing — the validator is healthy.
ApplicationNotReady	Go to Summary and find which component is Pending.
InvalidSpec	A configuration error. The message names the exact field. Fix the Validator resource and re-apply.
ReconcileError	Something outside the configuration failed — often the database or identity provider being unreachable. Check the operator logs.

Empty state: No conditions reported — The controller has not posted any conditions for this validator.

---

Specification

The validator's configuration, as it exists in the cluster, grouped by section: Network, Participant, Validator, UI, Overrides, then anything else alphabetically. Each group header shows how many fields it contains, and all groups are expanded by default.

• Booleans display as Yes / No.

• Long identifiers are truncated with a Copy button that copies the full value.

• Empty values show as -.

What is deliberately hidden

This tab is not a faithful dump of the resource. Several things are filtered out by design:

• Any field whose path contains secret, password, token, credential, privateKey, clientSecret, or apiKey, plus the onboarding secret name — these are never displayed.

• Fields that are set to their default of enabled: true. Only enabled: false is shown, so an absent enabled row means the component is enabled.

For the complete resource, use kubectl get validator <name> -o yaml.

This is also the fastest way to confirm that a field you set actually took effect. Unknown fields are silently pruned by the Kubernetes API server, so a misspelled field name disappears without an error — if a setting seems to be ignored, look for it here first.

Empty state: No spec fields — No specification fields available.