pub const SEED_SOURCE_AUTH_CONFLICT_GATE: StructuralGate;Expand description
A migrate-mode spec.seed whose LOCAL backend and resolved SOURCE
repository disagree on workload identity (issue #380).
The blob arm of this rule is refused at admission
(validate_replication_auth), but a seed.from.repository reference hides
the source’s backend from a spec-only validator, so the controller
re-applies the same rule once it has resolved the source and parks here
instead. Without the park the CR is admitted, a Job is launched, and the
failure surfaces as a bare cloud auth error from whichever side the pod’s
single ServiceAccount is not.
WARN for the same reason every other Seeded row is: the registry pins one
severity per condition+scope, and the in-flight SEEDING_GATE must not
turn a diagnostic red. Nothing is lost — the message names both
ServiceAccounts and the two ways out, and the repository is not Ready,
which a diagnostic fails on independently.