Conditions and reasons

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

When a resource doesn't do what you expect, its status says so: a condition (Ready, Accepted, Published…) set to False, a short reason and a message. This page gathers all reasons, by family of kinds. The details of each kind are on its reference page. The command that reads the state of each kind is listed in sng kind get.

sng app describe web        # App
sng secret describe db      # SSMSecret
sng dns record describe ID  # DNSRecord
sng kind get RegistryAccessKey ci         # any kind: the manifest, then its state as comments

Applications (App)

Reason	Meaning	What to do
Reconciled	Everything is compliant	Nothing
RollingOut	A deployment is in progress (new image, new configuration)	Wait; sng app logs if it takes long
JobRunning	A job service is running	Wait
JobFailed	A job failed	sng app logs, fix, reapply
RolloutFailed	The new containers do not become ready (image not found, crash, failing probe)	sng app logs; check image, healthcheck, ports
WaitingForDependency	A service is waiting for a service in dependsOn	Look at the state of the awaited service
DependencyFailed	A service in dependsOn failed	Fix the upstream service
SecretNotFound	A secret referenced by env or envFrom does not exist	Create the secret (Secrets)
ImagePullSecretNotFound	A secret in imagePullSecrets does not exist	Create the secret or remove the reference
RegistryAccessPending	The image comes from the platform registry and the tenant's read access is not ready yet (tenant just created)	Wait: the service starts on its own
CertificatePending	The service responds, but its HTTPS certificate is not issued yet; the App is not Ready while it is missing	Wait, usually a few minutes; for a brought domain, check that the zone is Active
DNSConflict	The service's domain name is already published in DNS by someone else: the App cannot be reached at that address	Free the name (delete the DNSRecord that carries it) or change ingress.domain; the service recovers on its own
QuotaExceeded	The tenant quota does not allow the requested resources	Reduce size/replicas or change tier
WaitingForDNSZone	The service waits for the DNS zone of its brought domain (domain not declared yet, verification or zone creation in progress, zone lost); the name is not served while it waits (phase Waiting)	Follow the message: it says what is missing (Domains on an App). The service is published on its own as soon as the zone is ready
DomainNotAllowed	Final refusal: the domain is a platform domain (stackngo.fr, stackngo.app)	Use your default zone or bring your domain; nothing to wait for, the refusal does not lift
HostConflict	The hostname is already used by another resource	Choose another domain or path
NameConflict	An object with the same name already exists and does not belong to this App	Rename the service or the App
Invalid	Combination of fields rejected at deployment	Read the message
ApplyFailed	The platform could not implement the service	Retry; report it if it persists
NamespaceNotTenant	Resource attached to no tenant (does not happen with sng apply)	Report it to support

Phases per service (status.services.<name>.phase): Ready, Progressing, Waiting, Failed, Scheduled (cronjob). Details: App page of the manifest reference.

Secrets (SSMSecret)

An SSMSecret has no coded reason but a phase and a message:

Phase	Meaning	What to do
Pending	Not declared yet, or declared empty (length: 0) awaiting a value	sng secret set NAME if you chose length: 0; otherwise wait (10 min at most)
Active	Declared, value present	Nothing
Error	Rejected by the secrets service (missing policy, invalid name), or materialize: true while another secret of the same name already exists (the value could not be made available to the other resources of the tenant)	Read status.message; rename the SSMSecret in the second case

Details: SSMSecret page of the manifest reference.

DNS (DNSZone, DNSRecord)

Reason	Kind	Meaning	What to do
NotRegistrable	DNSZone	The domain is not registrable (subdomain, public suffix)	Declare the registrable domain (exemple.fr, not www.exemple.fr)
PlatformDomain	DNSZone	Platform domain	Use your default zone
Taken	DNSZone	Domain already claimed by another tenant	Contact support if it is yours
AwaitingVerification	DNSZone	Waiting for the _stackngo-verify TXT	Create the record from status.verification at your registrar
AwaitingProvisioning	DNSZone	Verified, zone being created	Wait
AwaitingDelegation	DNSZone	Zone ready, name servers not declared yet	Declare status.nameServers at the registrar
DelegationCheckFailed	DNSZone	Delegation check not possible for now	Wait, it is retried
DelegationMissing	DNSZone	The delegation is no longer visible	Check the NS at the registrar
Delegated	DNSZone	Zone active	Nothing
DelegationLost	DNSZone	Delegation missing for more than 72 h: zone Lost	Restore the NS
ProviderError	DNSZone	DNS provider error	Retry; report it if it persists
Published	DNSRecord	Record published	Nothing
Reserved	DNSRecord	Name reserved for the operation of the platform	Choose another name
Conflict	DNSRecord	Name already published by another resource	First come keeps the name: rename
ZoneNotOwned	DNSRecord	spec.zone is not (yet) a proven zone of the tenant; the record is accepted, kept, and published on its own as soon as the zone is proven	Check spec.zone or create the DNSZone
ZoneNotReady	DNSRecord	The zone is not Active yet; published automatically afterwards	Finish the delegation
NotTenant	both	Resource outside a tenant	Report it to support
Invalid	both	Invalid target or name (private IP, CNAME at the apex…)	Read the message

Registry (RegistryRepository, RegistryAccessKey)

Reason	Meaning	What to do
Reconciled	Compliant	Nothing
InvalidSpec	Invalid retention expression, name not OCI-compliant	Read the message
DeletionBlocked	Deletion refused: the repository contains images and deletionPolicy: Block	Delete the images, or switch to Delete
Purging	Image deletion in progress (deletionPolicy: Delete)	Wait
RegistryUnavailable	The registry does not respond	Retried automatically
SecretOwnershipConflict	A secret with the same name as the access key's already exists	Change spec.secretName or delete the existing secret

Monitoring (Monitor, NotificationChannel, StatusPage)

Reason	Meaning	What to do
Accepted	Accepted and active	Nothing
IntervalBelowTier	interval shorter than the tier minimum	Lengthen the interval or move up a tier
QuotaExceeded	Too many monitors, pages or channels for the tier	Delete some or move up a tier
ChannelNotFound	A channel in notificationChannelRefs does not exist	Create the channel
SecretNotFound	A channel's secret is missing or lacks the given key; only that channel is set aside	Create the secret or fix name / key
MonitorNotFound	A status page references a nonexistent monitor	Fix groups[].monitors
NotSupported	Option not available yet (e.g. customDomains)	Remove the option
SyncFailed	Alerts could not be activated yet	Retried automatically
Invalid	Combination rejected	Read the message

Monitor states (status.state): Pending, Up, Down, Unknown, Paused, Maintenance.

Static sites (CDNSite)

Conditions: DomainAllowed (the domain is in a zone of the tenant), S3Reachable (the site storage responds with the given credentials), Ready. Phases: Pending, Ready, Conflict (domain already served by another site, the oldest wins), Invalid. Frequent reasons: NotAllowed (domain outside your zones), AccessDenied (storage credentials rejected).

Identity (IAMApplication, IAMRole, IAMGroup, IAMPolicy, IAMPolicyBinding, IAMOIDCTrust)

Reason	Meaning	What to do
Reconciled	Compliant	Nothing
WaitingForTenant	The tenant's identity organization does not exist yet	wait; otherwise contact support
WaitingForPolicy	A binding references a policy not applied yet	Wait, or create the policy
InvalidReference	Reference to a missing resource (role, childRoles sub-role, group, certificate)	Create the referenced resource
InvalidDocument	Invalid policy document (action, effect, resource)	Read the message
ScopeUnresolved	A subject of the binding does not resolve (unknown user, role, trust)	Check the names
DependencyInUse	Deletion pending (deletionPolicy: Block): the resource is still in use; the message says by what (suppression bloquée : le rôle est encore attribué à 2 utilisateurs)	Remove what uses it: the deletion completes on its own within a minute
SecretCreated, SecretUpdated	Client secret (<name>-oidc) created or updated	Nothing
SecretOwnershipConflict	A secret with the same name already exists	Change credentialsSecret.name
RotationFailed	Rotation of the client secret failed	Retried; report it if it persists
ProviderUnavailable, IAMUnavailable	Identity service unreachable	Retried automatically
DriftDetected	The resource was modified outside the manifest; it is brought back into compliance	Nothing, or modify the manifest
Registered	OIDC trust registered	Nothing
Discovered, DiscoveryFailed	Discovery of the OIDC issuer succeeded or failed	Check spec.issuer
Invalid, UnsupportedConfiguration	Combination of fields rejected, or field not supported yet (assignableRoles, assignableByApplications)	Read the message; remove the field

HTTP codes

Errors returned by the API (and therefore by the CLI) before the resource even exists are in API errors. Messages specific to the CLI are in CLI errors.