Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

CredentialUnavailable

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The operator cannot use its own client certificate or key; its pod is not ready, and a resource it reconciles is Ready=False, Pending.

Meaning

The operator reads --client-cert-file and --client-key-file before every probe and call, and one of them is missing, unreadable, not PEM, does not match the other, or the certificate is outside its validity period. The message names the file. With the chart the files are tls.crt and tls.key under /etc/nauthera/control-plane, from the Secret operator.server.credentialSecret or the keypair certManager.grpcTLS.client issues. A Secret mounted by subPath never sees a renewal, so it fails as the certificate expired.

Impact

Nothing reaches the server: no OIDCClient is registered or updated, no client secret is delivered, and no deletion under Delete completes. Clients already registered keep working for their applications and end users. The platform team owns the fix; every application team using the operator is blocked until then.

Diagnosis

  1. kubectl -n <release-ns> logs deploy/<release>-operator | grep 'control plane not reachable' gives the reason and the file.
  2. kubectl -n <release-ns> get certificate and kubectl -n <release-ns> describe certificate <name> show whether cert-manager renewed the keypair.
  3. kubectl -n <release-ns> get deploy <release>-operator -o jsonpath='{.spec.template.spec.volumes}' names the Secret; kubectl -n <release-ns> get secret <secret> -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddate -ext subjectAltName shows its expiry, without printing the key.

Mitigation

  • An expired certificate: fix cert-manager or reissue it. The chart's client keypair lives 24h (certManager.grpcTLS.client.duration) and renews 8h before expiry, so a stalled cert-manager expires it within hours. The next probe picks up a renewal, no restart.
  • A missing Secret or key: create it with tls.crt and tls.key, or set operator.server.credentialSecret to one that has them, and mount it whole.

Escalation

Page the platform team that runs the operator if renewal does not recover within one probe interval. If the files are valid and the operator still reports them unusable, open an issue with the condition message, the operator's version (/nauthera-operator --version) and the certificate's openssl x509 -noout -text output. Never attach tls.key.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.