Looking through the shim reconciler. vm.status is not being set to SecretCreated. It's stuck in readyforprovisioning, even though it looks like it should work just fine