Rbac

• CrossNamespaceRefRejected

  The snippet references a library or Flux source in a different namespace and cross-namespace refs are disabled

• LibraryNotFound

  A JsonnetLibrary CR referenced in spec.libraries does not exist or is unreachable by the tenant ServiceAccount

• RBACDenied

  The apiserver returned Forbidden on a call the reconciler made with the tenant ServiceAccount's impersonated identity

• ServiceAccountMissing

  The snippet specifies no ServiceAccount and the operator has no --default-service-account configured

• Tenancy and RBAC

  Per-snippet ServiceAccount impersonation, the minimal operator ClusterRole, the tenant Role callers must grant, and the watch-scope flags.

• Watch-layer silent failure

  The operator's own ClusterRole is missing a verb on a watched kind, so controller-runtime's informer retries silently and no snippet status reflects the problem