# ClientNotRemoved

An OIDCClient being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.

## Meaning

The resource is being deleted with `spec.deletionPolicy: Delete`, and the server has not
removed the client: the server did not answer, serves an unsupported contract, refused the
deletion, or the operator's credential is unusable. The message carries the cause as for
Refused or Unreachable. The finalizer `nauthera.io/oidcclient` holds the resource until the
client is gone.

## Impact

The client stays live, so its credential still works for anyone holding it; for a
decommissioned application that is the risk to close. The resource and its namespace stay
in Terminating, which can block the application team's namespace cleanup.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` for the cause.
2. `nauthera_operator_server_calls_total{call="DeleteOIDCClient"}` by `code`.
3. `kubectl -n <release-ns> logs deploy/<release>-operator` around the deletion.

## Mitigation

- Fix the cause the message names (see Unreachable, Refused, Unsupported); the removal is
  retried every five minutes, or about once a minute while the server does not answer.
- Removing the finalizer by hand leaves the client registered; the hourly orphan sweep
  removes a Delete-policy client whose manifest is gone, once the server answers.
  See [Deleting a manifest](https://www.nauthera.io/docs/v1/operator#deleting-a-manifest).

## Escalation

If the client must stop working now, the platform team disables it on the server and
fixes the cause after. If the server refuses a deletion its grant allows, open an issue
with the condition message and the `client.deleted` audit record, if any. No secrets.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.