# DirectoryNotRemoved

An LDAPDirectory being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.

## Meaning

The resource is being deleted with `spec.deletionPolicy: Delete`, and the server has not
removed the connection: it did not answer, serves an unsupported contract, refused the call
(often the `ldap_directories` operation missing from the grant), or the operator's
credential is unusable. The message carries the cause. The finalizer
`nauthera.io/ldapdirectory` holds the resource until the connection is gone.

## Impact

The connection stays registered, so the organization's users can still sign in with their
directory password where a client allows it. The resource and its namespace stay in
Terminating.

## Diagnosis

1. `kubectl -n <ns> describe ldapdirectory <name>` for the cause.
2. `nauthera_operator_server_calls_total{call="DeleteLDAPDirectory"}` by `code`.
3. The server's audit log for `ldap_directory.deleted`.

## Mitigation

- Fix the cause (see Unreachable, Refused, Unsupported); the removal is retried every five
  minutes, or about once a minute while the server does not answer.
- A grant refusal: add `ldap_directories` to the operator's entry in
  `certManager.grpcTLS.allowedClients`.

## Escalation

If the server refuses a removal the grant allows, escalate to the identity platform team
with the resource's namespace and name.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.