# CredentialUnavailable

The operator cannot use its own client certificate or key; its pod is not ready, and a resource it reconciles is Ready=False, Pending.

## Meaning

The operator reads `--client-cert-file` and `--client-key-file` before every probe and call,
and one of them is missing, unreadable, not PEM, does not match the other, or the
certificate is outside its validity period. The message names the file. With the chart the
files are `tls.crt` and `tls.key` under `/etc/nauthera/control-plane`, from the Secret
`operator.server.credentialSecret` or the keypair `certManager.grpcTLS.client` issues. A
Secret mounted by `subPath` never sees a renewal, so it fails as `the certificate expired`.

## Impact

Nothing reaches the server: no OIDCClient is registered or updated, no client secret is
delivered, and no deletion under `Delete` completes. Clients already registered keep
working for their applications and end users. The platform team owns the fix; every
application team using the operator is blocked until then.

## Diagnosis

1. `kubectl -n <release-ns> logs deploy/<release>-operator | grep 'control plane not reachable'`
   gives the reason and the file.
2. `kubectl -n <release-ns> get certificate` and `kubectl -n <release-ns> describe certificate <name>`
   show whether cert-manager renewed the keypair.
3. `kubectl -n <release-ns> get deploy <release>-operator -o jsonpath='{.spec.template.spec.volumes}'`
   names the Secret; `kubectl -n <release-ns> get secret <secret> -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddate -ext subjectAltName`
   shows its expiry, without printing the key.

## Mitigation

- An expired certificate: fix cert-manager or reissue it. The chart's client keypair lives
  24h (`certManager.grpcTLS.client.duration`) and renews 8h before expiry, so a stalled
  cert-manager expires it within hours. The next probe picks up a renewal, no restart.
- A missing Secret or key: create it with `tls.crt` and `tls.key`, or set
  `operator.server.credentialSecret` to one that has them, and mount it whole.

## Escalation

Page the platform team that runs the operator if renewal does not recover within one probe
interval. If the files are valid and the operator still reports them unusable, open an
issue with the condition message, the operator's version (`/nauthera-operator --version`)
and the certificate's `openssl x509 -noout -text` output. Never attach `tls.key`.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.