Crossplane "SYNCED False / ReconcileError" in CI

SYNCED reflects whether Crossplane could reconcile a resource with its external API. SYNCED False plus a ReconcileError means the last reconcile failed; the Synced condition message and the resource events explain why.

What this error means

kubectl get managed (or a specific resource) shows SYNCED False, and describing it shows a ReconcileError with a provider or API message.

crossplane

NAME                              SYNCED   READY   EXTERNAL-NAME   AGE
bucket.s3.aws.upbound.io/my-app   False            my-app          3m
# Synced   False   ReconcileError   observe failed: cannot ... AccessDenied

Common causes

The provider call to the external API failed

Credentials, permissions, or invalid input made the observe/create call fail, so the controller marks the resource SYNCED False.

A transient API or rate-limit error

A throttling or temporary API error can flip SYNCED False for a cycle before the next reconcile succeeds.

How to fix it

Read the Synced condition and events

Describe the resource and read the Synced condition message.
Follow the events to the provider error (auth, permission, or input).
Fix that root cause; SYNCED returns to True on the next reconcile.

Terminal

kubectl describe bucket my-app
kubectl get event --field-selector involvedObject.name=my-app

Distinguish transient from persistent failures

If the message is throttling or a network blip, let the controller retry; if it is auth or input, fix the resource or credentials.

How to prevent it

Gate CI on SYNCED True rather than assuming apply means done.
Fix credentials and IAM before rollout so reconciles succeed.
Treat throttling separately from real configuration errors.