<!-- If the issue is concerning a bug, please use dedicated template --> ### Summary <!-- Summarize the issue encountered concisely. --> The `crossplane-provider-keycloak-init` unit health-checks `Secret/keycloak-internal-tls -n crossplane-system`, which its own [`eso-keycloak-internal-tls` ExternalSecret copies out of the `keycloak` namespace](https://gitlab.com/sylva-projects/sylva-core/-/blob/9b2a5e6f50b2cde856cb88c0bb54730baee5cbba/kustomize-units/crossplane-provider-keycloak-init/eso-keycloak-internal-tls.yaml). The [**source** `keycloak-internal-tls` secret is produced by the **`keycloak` unit's HelmRelease**](https://gitlab.com/sylva-projects/sylva-core/-/blob/9b2a5e6f50b2cde856cb88c0bb54730baee5cbba/charts/sylva-units/values.yaml#L2799) (a cert-manager `Certificate`). But [`crossplane-provider-keycloak-init` **does not depend on `keycloak`**](https://gitlab.com/sylva-projects/sylva-core/-/blob/9b2a5e6f50b2cde856cb88c0bb54730baee5cbba/charts/sylva-units/values.yaml#L2521-2523), so on a fresh install it starts its 5 min health check clock before that certificate exists and times out whenever Keycloak is slow to install. Because of this we could see: ```shell unit Kustomization/crossplane-provider-keycloak-init did not become ready after 5m0s Details on Kustomization/crossplane-provider-keycloak-init and related resources: IDENTIFIER STATUS REASON MESSAGE Kustomization/sylva-system/crossplane-provider-keycloak-init InProgress Kustomization generation is 1, but latest observed generation is -1 ╰┄╴ExternalSecret/crossplane-system/eso-keycloak-internal-tls InProgress could not get secret data from provider ├┄╴┬┄┄[Conditions] ┆ ╰┄╴Ready False SecretSyncedError could not get secret data from provider ╰┄╴┬┄┄[Events] ╰┄╴2026-08-05 20:40:49 (x9 over 4m13s) Warning UpdateFailed error processing spec.data[0] (key: keycloak-internal-tls), err: secrets "keycloak-internal-tls" not found ``` in fresh-install CI runs like: - https://gitlab.com/sylva-projects/sylva-core/-/jobs/15733431393 - https://gitlab.com/sylva-projects/sylva-core/-/jobs/15687584209 The `crossplane-provider-keycloak-init` dependency on `keycloak` used to exist and was removed intentionally in !8378, whose rationale was > _the keycloak crossplane provider does not need to depend on keycloak because until some resource handled by this crossplane provider is created, no connection to Keycloak or use of keycloak-produced resources, will happen._ but this did not the cover the ExternalSecret on a Keycloak-produced certificate. The question is though whether `Secret/keycloak-internal-tls` is actually needed in `crossplane-system` as I could not find any consumer for it and git history does not show it either: ```shell sylva-core on  main [$?⇣] ➜ git log -S "keycloak-internal-tls" commit 8024d83d459f844e6ce04d58238c16da8ea3bccb Author: Cristina Isaroiu <cristina.isaroiu@orange.com> Date: Mon May 18 09:42:33 2026 +0000 Move from keycloak operator to keycloak chart commit 5edacd5e22ffd688d5fc95a7d0a221cf2d8348ad Author: Mihai Zaharia <mihai.zaharia@orange.com> Date: Fri Jul 4 10:02:01 2025 +0000 Add Crossplane provisioner for Keycloak commit 64d610ef526565f6ec21bf8839768d5f0a5e05a0 Author: Alain Thioliere <alain.thioliere@orange.com> Date: Wed Jan 31 08:13:58 2024 +0000 Injection of certificates signed by an external authority sylva-core on  main [$?⇣] took 1s ➜ ``` #### related references <!-- Put here any RFE, issue, MR reference which could be related to this issue to have a better picture of the context --> ### Details <!-- Explain what is the purpose of this issue -->