DirectoryNotRemoved

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

An LDAPDirectory being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.

#Meaning

The resource is being deleted with spec.deletionPolicy: Delete, and the server has not removed the connection: it did not answer, serves an unsupported contract, refused the call (often the ldap_directories operation missing from the grant), or the operator's credential is unusable. The message carries the cause. The finalizer nauthera.io/ldapdirectory holds the resource until the connection is gone.

#Impact

The connection stays registered, so the organization's users can still sign in with their directory password where a client allows it. The resource and its namespace stay in Terminating.

#Diagnosis

1. kubectl -n <ns> describe ldapdirectory <name> for the cause.
2. nauthera_operator_server_calls_total{call="DeleteLDAPDirectory"} by code.
3. The server's audit log for ldap_directory.deleted.

#Mitigation

• Fix the cause (see Unreachable, Refused, Unsupported); the removal is retried every five minutes, or about once a minute while the server does not answer.
• A grant refusal: add ldap_directories to the operator's entry in certManager.grpcTLS.allowedClients.

#Escalation

If the server refuses a removal the grant allows, escalate to the identity platform team with the resource's namespace and name.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.