Operator failure reasons

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

One runbook per reason the Kubernetes operator leaves on a resource's Ready condition when it cannot reconcile it, as kubectl describe shows it.

Reason	What it means
`CredentialUnavailable`	The operator cannot use its own client certificate or key; its pod is not ready, and a resource it reconciles is Ready=False, Pending.
`TrustAnchorUnavailable`	The operator has no usable CA to verify the server with; its pod is not ready, and a resource it reconciles is Ready=False, Pending.
`Unreachable`	No answer came back from the server's control plane; the operator's pod is not ready, and a resource it reconciles is Ready=False, Pending.
`Refused`	The server answered and refused the call; a resource is Ready=False (Error, or Pending while retried), or the operator's pod is not ready.
`Unsupported`	The server serves a control-plane contract outside the operator's range; the operator's pod is not ready, and a resource it reconciles is Ready=False, Pending.
`SecretUndeliverable`	The server holds an OIDCClient's secret, and the operator could not write it into the Secret; the OIDCClient is Ready=False, Error or Pending.
`StatusNotWritten`	An outcome could not be written to the resource's status; a Warning event on the resource, with no condition of its own.
`ClientNotRemoved`	An OIDCClient being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.
`Drifted`	An OIDCClient or Branding was changed, or removed, on the server by something other than the operator; it is Ready=False, Error, and the change is not written over.
`NamespaceNotCovered`	A namespaced resource is in a namespace the operator's connection does not carry; it is Ready=False, Error, and nothing is sent to the server.
`NamespaceNotAdmitted`	A namespaced resource is in a namespace no organization admits, or spec.organization names one that does not admit it; it is Ready=False, Error, and nothing is sent to the server.
`OrganizationAmbiguous`	A namespaced resource names no organization in a namespace that several organizations admit; it is Ready=False, Error, and nothing is sent to the server.
`OrganizationNotReady`	A namespaced resource belongs to an Organization that has no issuer yet; it is Ready=False, Pending, and is sent once the organization is.
`OrganizationChanged`	A namespaced resource is held by the server in one organization and its namespace now configures another; it is Ready=False, Error, and nothing is sent.
`AwaitingBroker`	A BrokerMembership on the member's side names a broker that has not invited the member; it is Ready=False, Pending, and is sent again every minute.
`MembershipNotEnded`	A BrokerMembership is being deleted and the server has not ended the membership; it stays in phase Deleting until it does.
`FixedAtCreation`	An Organization differs from its resource in FIPS mode, which is fixed at creation; it is Ready=False, Error, and nothing is written.
`OrganizationNotRemoved`	An Organization being deleted under deletionPolicy Delete is still on the server; it is Ready=False in phase Deleting.
`BrandingNotRemoved`	A Branding being deleted is still on the server; it is Ready=False in phase Deleting.
`SecretNotFound`	The Secret an IdentityProvider, LDAPDirectory or OIDCClient names does not exist; the resource is Ready=False, Error, and nothing is sent.
`SecretKeyMissing`	The Secret an IdentityProvider, LDAPDirectory or OIDCClient names holds nothing under the key it names; the resource is Ready=False, Error, and nothing is sent.
`SecretPadded`	An IdentityProvider's or OIDCClient's client secret, or an LDAPDirectory's bind password, begins or ends with whitespace; the resource is Ready=False, Error, and nothing is sent.
`ProviderNotRemoved`	An IdentityProvider being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.
`ConfigMapNotFound`	The ConfigMap an LDAPDirectory's spec.caBundleRef names does not exist; the LDAPDirectory is Ready=False, Error, and nothing is sent.
`ConfigMapKeyMissing`	The ConfigMap an LDAPDirectory names holds nothing under the key spec.caBundleRef names; the LDAPDirectory is Ready=False, Error, and nothing is sent.
`DirectoryNotRemoved`	An LDAPDirectory being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.