Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

Drifted

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

An OIDCClient or Branding was changed, or removed, on the server by something other than the operator; it is Ready=False, Error, and the change is not written over.

Meaning

For an OIDCClient, the server's change hint moved and the client's revision no longer matches the one the resource last wrote, or the client is gone (a change through the admin API or dashboard, another tool, or a server restored from an older backup). For a Branding, a write naming the revision it last wrote was refused because the server holds another, or none. The message names the revision the server holds and when it changed, or that it is gone.

Impact

The live client or branding differs from what the application team declared: redirect URIs, scopes or the sign-in page may not be theirs. A removed client means its end users cannot sign in. Writing the declared state back could undo an emergency change someone made there, so the operator waits for a person.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> (or branding) for both revisions.
  2. The server's audit log for the client: query /v1/admin/orgs/<slug>/audit-events with client_id=<client_id> for who changed it (manager, actor) and when; see Querying.
  3. kubectl get oidcclients -A | grep Drifted for how many moved at once, which points at a restore rather than a person.

Mitigation

  • Keep the change: put it in the manifest, which is then written on its next generation.
  • Undo it: kubectl -n <ns> annotate oidcclient <name> nauthera.io/restore=true. The operator writes the declared state, records a Restored event and removes the annotation. A client recreated this way delivers a new secret into its Secret; restart its workloads. See Changes made outside the operator.

Escalation

An unexplained change to a client is a security question: send the audit records to the team that owns the identity platform before restoring. Many resources drifting at once after a database restore go to whoever ran the restore.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.