# Operator failure reasons

> One runbook per reason the Kubernetes operator leaves on a resource's Ready condition when it cannot reconcile it, as kubectl describe shows it.

One runbook per reason the Kubernetes operator leaves on a resource's `Ready` condition when it cannot reconcile it, as `kubectl describe` shows it.

| Reason | What it means |
|---|---|
| [`CredentialUnavailable`](https://www.nauthera.io/docs/v1/runbooks/operator/CredentialUnavailable) | The operator cannot use its own client certificate or key; its pod is not ready, and a resource it reconciles is Ready=False, Pending. |
| [`TrustAnchorUnavailable`](https://www.nauthera.io/docs/v1/runbooks/operator/TrustAnchorUnavailable) | The operator has no usable CA to verify the server with; its pod is not ready, and a resource it reconciles is Ready=False, Pending. |
| [`Unreachable`](https://www.nauthera.io/docs/v1/runbooks/operator/Unreachable) | No answer came back from the server's control plane; the operator's pod is not ready, and a resource it reconciles is Ready=False, Pending. |
| [`Refused`](https://www.nauthera.io/docs/v1/runbooks/operator/Refused) | The server answered and refused the call; a resource is Ready=False (Error, or Pending while retried), or the operator's pod is not ready. |
| [`Unsupported`](https://www.nauthera.io/docs/v1/runbooks/operator/Unsupported) | The server serves a control-plane contract outside the operator's range; the operator's pod is not ready, and a resource it reconciles is Ready=False, Pending. |
| [`SecretUndeliverable`](https://www.nauthera.io/docs/v1/runbooks/operator/SecretUndeliverable) | The server holds an OIDCClient's secret, and the operator could not write it into the Secret; the OIDCClient is Ready=False, Error or Pending. |
| [`StatusNotWritten`](https://www.nauthera.io/docs/v1/runbooks/operator/StatusNotWritten) | An outcome could not be written to the resource's status; a Warning event on the resource, with no condition of its own. |
| [`ClientNotRemoved`](https://www.nauthera.io/docs/v1/runbooks/operator/ClientNotRemoved) | An OIDCClient being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting. |
| [`Drifted`](https://www.nauthera.io/docs/v1/runbooks/operator/Drifted) | An OIDCClient or Branding was changed, or removed, on the server by something other than the operator; it is Ready=False, Error, and the change is not written over. |
| [`NamespaceNotCovered`](https://www.nauthera.io/docs/v1/runbooks/operator/NamespaceNotCovered) | A namespaced resource is in a namespace the operator's connection does not carry; it is Ready=False, Error, and nothing is sent to the server. |
| [`NamespaceNotAdmitted`](https://www.nauthera.io/docs/v1/runbooks/operator/NamespaceNotAdmitted) | A namespaced resource is in a namespace no organization admits, or spec.organization names one that does not admit it; it is Ready=False, Error, and nothing is sent to the server. |
| [`OrganizationAmbiguous`](https://www.nauthera.io/docs/v1/runbooks/operator/OrganizationAmbiguous) | A namespaced resource names no organization in a namespace that several organizations admit; it is Ready=False, Error, and nothing is sent to the server. |
| [`OrganizationNotReady`](https://www.nauthera.io/docs/v1/runbooks/operator/OrganizationNotReady) | A namespaced resource belongs to an Organization that has no issuer yet; it is Ready=False, Pending, and is sent once the organization is. |
| [`OrganizationChanged`](https://www.nauthera.io/docs/v1/runbooks/operator/OrganizationChanged) | A namespaced resource is held by the server in one organization and its namespace now configures another; it is Ready=False, Error, and nothing is sent. |
| [`AwaitingBroker`](https://www.nauthera.io/docs/v1/runbooks/operator/AwaitingBroker) | A BrokerMembership on the member's side names a broker that has not invited the member; it is Ready=False, Pending, and is sent again every minute. |
| [`MembershipNotEnded`](https://www.nauthera.io/docs/v1/runbooks/operator/MembershipNotEnded) | A BrokerMembership is being deleted and the server has not ended the membership; it stays in phase Deleting until it does. |
| [`FixedAtCreation`](https://www.nauthera.io/docs/v1/runbooks/operator/FixedAtCreation) | An Organization differs from its resource in FIPS mode, which is fixed at creation; it is Ready=False, Error, and nothing is written. |
| [`OrganizationNotRemoved`](https://www.nauthera.io/docs/v1/runbooks/operator/OrganizationNotRemoved) | An Organization being deleted under deletionPolicy Delete is still on the server; it is Ready=False in phase Deleting. |
| [`BrandingNotRemoved`](https://www.nauthera.io/docs/v1/runbooks/operator/BrandingNotRemoved) | A Branding being deleted is still on the server; it is Ready=False in phase Deleting. |
| [`SecretNotFound`](https://www.nauthera.io/docs/v1/runbooks/operator/SecretNotFound) | The Secret an IdentityProvider, LDAPDirectory or OIDCClient names does not exist; the resource is Ready=False, Error, and nothing is sent. |
| [`SecretKeyMissing`](https://www.nauthera.io/docs/v1/runbooks/operator/SecretKeyMissing) | The Secret an IdentityProvider, LDAPDirectory or OIDCClient names holds nothing under the key it names; the resource is Ready=False, Error, and nothing is sent. |
| [`SecretPadded`](https://www.nauthera.io/docs/v1/runbooks/operator/SecretPadded) | An IdentityProvider's or OIDCClient's client secret, or an LDAPDirectory's bind password, begins or ends with whitespace; the resource is Ready=False, Error, and nothing is sent. |
| [`ProviderNotRemoved`](https://www.nauthera.io/docs/v1/runbooks/operator/ProviderNotRemoved) | An IdentityProvider being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting. |
| [`ConfigMapNotFound`](https://www.nauthera.io/docs/v1/runbooks/operator/ConfigMapNotFound) | The ConfigMap an LDAPDirectory's spec.caBundleRef names does not exist; the LDAPDirectory is Ready=False, Error, and nothing is sent. |
| [`ConfigMapKeyMissing`](https://www.nauthera.io/docs/v1/runbooks/operator/ConfigMapKeyMissing) | The ConfigMap an LDAPDirectory names holds nothing under the key spec.caBundleRef names; the LDAPDirectory is Ready=False, Error, and nothing is sent. |
| [`DirectoryNotRemoved`](https://www.nauthera.io/docs/v1/runbooks/operator/DirectoryNotRemoved) | An LDAPDirectory being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting. |