Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

ConfigMapNotFound

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The ConfigMap an LDAPDirectory's spec.caBundleRef names does not exist; the LDAPDirectory is Ready=False, Error, and nothing is sent.

Meaning

The operator reads the directory's CA bundle from the ConfigMap spec.caBundleRef.name names, in the resource's own namespace, and there is none. The connection is not registered or updated until the ConfigMap appears; the operator watches ConfigMaps and reconciles the resource when it does.

Impact

The organization's users cannot sign in with their directory password if the connection was never registered; an existing registration keeps its previous CA bundle and settings.

Diagnosis

  1. kubectl -n <ns> describe ldapdirectory <name> names the ConfigMap.
  2. kubectl -n <ns> get configmap <configmap>; a ConfigMap in another namespace does not count.
  3. For trust-manager or another distributor: kubectl -n <ns> get events --sort-by=.lastTimestamp.

Mitigation

  • Create the ConfigMap in the resource's namespace, or fix spec.caBundleRef: kubectl -n <ns> create configmap <configmap> --from-file=ca.crt=<bundle.pem>.
  • A bundle kept in a Secret: set spec.caBundleRef.kind: Secret.

Escalation

The team that owns the directory supplies its CA certificate. Escalate only if the ConfigMap exists in the resource's namespace and the condition stays.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.