# ConfigMapNotFound

The ConfigMap an LDAPDirectory's spec.caBundleRef names does not exist; the LDAPDirectory is Ready=False, Error, and nothing is sent.

## Meaning

The operator reads the directory's CA bundle from the ConfigMap `spec.caBundleRef.name`
names, in the resource's own namespace, and there is none. The connection is not registered
or updated until the ConfigMap appears; the operator watches ConfigMaps and reconciles the
resource when it does.

## Impact

The organization's users cannot sign in with their directory password if the connection was
never registered; an existing registration keeps its previous CA bundle and settings.

## Diagnosis

1. `kubectl -n <ns> describe ldapdirectory <name>` names the ConfigMap.
2. `kubectl -n <ns> get configmap <configmap>`; a ConfigMap in another namespace does not count.
3. For trust-manager or another distributor: `kubectl -n <ns> get events --sort-by=.lastTimestamp`.

## Mitigation

- Create the ConfigMap in the resource's namespace, or fix `spec.caBundleRef`:
  `kubectl -n <ns> create configmap <configmap> --from-file=ca.crt=<bundle.pem>`.
- A bundle kept in a Secret: set `spec.caBundleRef.kind: Secret`.

## Escalation

The team that owns the directory supplies its CA certificate. Escalate only if the ConfigMap
exists in the resource's namespace and the condition stays.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.