Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

ClientNotRemoved

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

An OIDCClient being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.

Meaning

The resource is being deleted with spec.deletionPolicy: Delete, and the server has not removed the client: the server did not answer, serves an unsupported contract, refused the deletion, or the operator's credential is unusable. The message carries the cause as for Refused or Unreachable. The finalizer nauthera.io/oidcclient holds the resource until the client is gone.

Impact

The client stays live, so its credential still works for anyone holding it; for a decommissioned application that is the risk to close. The resource and its namespace stay in Terminating, which can block the application team's namespace cleanup.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> for the cause.
  2. nauthera_operator_server_calls_total{call="DeleteOIDCClient"} by code.
  3. kubectl -n <release-ns> logs deploy/<release>-operator around the deletion.

Mitigation

  • Fix the cause the message names (see Unreachable, Refused, Unsupported); the removal is retried every five minutes, or about once a minute while the server does not answer.
  • Removing the finalizer by hand leaves the client registered; the hourly orphan sweep removes a Delete-policy client whose manifest is gone, once the server answers. See Deleting a manifest.

Escalation

If the client must stop working now, the platform team disables it on the server and fixes the cause after. If the server refuses a deletion its grant allows, open an issue with the condition message and the client.deleted audit record, if any. No secrets.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.