---
title: Enabling create-only mode for the Zero Trust Workload Identity Manager
---

# Enabling create-only mode for the Zero Trust Workload Identity Manager {#zero-trust-manager-reconciliation_{context}}

To pause Operator reconciliation, enable `create-only` mode by setting an environment variable in the subscription object. By setting this value, you can perform manual configurations or debug the operator without the controller overwriting your changes.

The following scenarios are examples of when the `create-only` mode might be of use:

**Manual Customization Required**: You need to customize operator-managed resources (ConfigMaps, Deployments, DaemonSets, etc.) with specific configurations that differ from the operator’s defaults

**Day 2 Operations**: After initial deployment, you want to prevent the operator from overwriting their manual changes during subsequent reconciliation cycles

**Configuration Drift Prevention**: You want to maintain control over certain resource configurations while still benefiting from the operator’s lifecycle management

## Pausing Operator reconciliation {#zero-trust-manager-pause-reconciliation_zero-trust-manager-reconciliation}

Pause reconciliation of the operands by enabling `create-only` mode. This setting prevents the Operator from automatically reverting your manual changes to the desired state. You can enable this mode by updating the Operator’s subscription object.

> [!IMPORTANT]
> When `create-only` mode is disabled, the Operator overwrites the resources if any conflicts exist.

**Prerequisites**

- You have installed Zero Trust Workload Identity Manager on your machine.
- You have installed the SPIRE Servers, Agents, SPIFFE Container Storage Interface (CSI), and an OpenID Connect (OIDC) Discovery Provider and are in running status.

**Procedure**

- To pause reconciling the operands resources managed by the Operator, add the environment variable `CREATE_ONLY_MODE`: `true` in the subscription object by running the following command:

  ```terminal
  $ oc -n $OPERATOR_NAMESPACE patch subscription openshift-zero-trust-workload-identity-manager --type='merge' -p '{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"true"}]}}}'
  ```

**Verification**

- Check the status of the `SpireServer` resource to confirm that the `create-only` mode is active. The `status` must be `true` and the `reason` must be `CreateOnlyModeEnabled`.

  ```terminal
  $ oc get SpireServer cluster -o yaml
  ```

  The following is an example that confirms that the 'create-only' mode is active.

  ```yaml
  status:
    conditions:
    - lastTransitionTime: "2025-12-23T11:36:58Z"
      message: All components are ready
      reason: Ready
      status: "True"
      type: Ready
    - lastTransitionTime: "2025-12-23T11:36:58Z"
      message: All operand CRs are ready
      reason: Ready
      status: "True"
      type: OperandsAvailable
    - lastTransitionTime: "2025-12-23T11:36:58Z"
      message: create-only mode enabled
      reason: CreateOnlyModeEnabled
      status: "True"
      type: CreateOnlyMode
  ```

  > [!IMPORTANT]
  > The Operator updates the upgradeable condition to `false` in the `operatorCondition` resource. You might not be able to upgrade the Operator when in `create-only` mode.

## Resuming Operator reconciliation {#zero-trust-manager-restart-reconciliation_zero-trust-manager-reconciliation}

To resume Operator reconciliation after manual configuration or debugging, disable the `create-only` mode. This allows the controller to resume managing resources and applying the desired state. You can disable this mode by setting the environment variable in the subscription object.

**Prerequisites**

- You have enabled `create-only` mode on the Zero Trust Workload Identity Manager.
- You have completed your manual configuration or debugging tasks.

**Procedure**

- To restart reconciling the Operator-managed resources, add the environment variable `CREATE_ONLY_MODE`: `false` in the subscription object by running the following command:

  ```terminal
  $ oc -n $OPERATOR_NAMESPACE patch subscription openshift-zero-trust-workload-identity-manager --type='merge' -p '{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"false"}]}}}'
  ```

**Verification**

- Check the status of the `SpireServer` resource to confirm that `create-only` mode is disabled by running the following command:

  ```terminal
  $ oc get SpireServer cluster -o yaml
  ```

  ```yaml {title="Example output"}
  status:
   conditions:
   - lastTransitionTime: "2025-12-23T11:40:00Z"
     message: create-only mode disabled
     reason: CreateOnlyModeDisabled
     status: "False"
     type: CreateOnlyMode
  ```