A secretGenerator entry with no literals, no files, and no envs renders a perfectly valid Secret with zero data keys - kustomize does not warn. Downstream apps then fail with authentication errors that look like bad credentials. Inspect the built output (kustomize build | grep -A5 kind:.Secret), find the empty generator, and give it its literals/files/envs - or an ExternalSecret if the values must not live in git.

## The error
```text
(no error - kustomize build succeeds but the Secret has zero data keys, and consumers fail with auth errors)
```

## What to do
1. Inspect what the generator produced:
```bash
kustomize build [dir] | grep -B2 -A8 'kind: Secret'
```
   Expected: Shows a Secret with no data section.
2. Find the generator:
```bash
grep -rn -A6 'secretGenerator' kustomization.yaml
```
   Expected: Shows the entry with no literals/files/envs.
3. Populate it (literals for non-sensitive, files/envs otherwise) or replace with an ExternalSecret for real secrets.
   Expected: Generator has sources.
4. Rebuild and re-check.
   Expected: Secret now carries data keys.

## When this applies
- apps failing auth right after a kustomize-based deploy
- Secret objects with empty data in built output
- secretGenerator entries copied as stubs

## When it does NOT apply
- kustomize build errors (the build succeeds here)
- secrets that exist but have wrong values

## Works with
kustomize 4.x/5.x

### configMapGenerator with no sources behaves the same way
Empty ConfigMap, same silent shape. Same inspect-and-populate fix.

## Why it happens
Generators are declarative: kustomize renders exactly what the entry describes, and an entry describing nothing renders an empty object. There is no required-fields validation on generators.

## Edge cases
- envs files with only comments/blank lines also produce empty secrets - check the file contents, not just the reference.
- If the only hits for the secret name are the generator and the consumer, nothing ever populated it - no rerun will help.

## Resolved from
gh:kg6zjl/clusters (silent-failure-jobs) - https://github.com/kg6zjl/clusters/blob/HEAD/home-cluster/ai-services/hermes-skills/devops/kubernetes-object-ownership/references/silent-failure-jobs.md