# Drifted

An OIDCClient or Branding was changed, or removed, on the server by something other than the operator; it is Ready=False, Error, and the change is not written over.

## Meaning

For an OIDCClient, the server's change hint moved and the client's revision no longer
matches the one the resource last wrote, or the client is gone (a change through the admin
API or dashboard, another tool, or a server restored from an older backup). For a Branding,
a write naming the revision it last wrote was refused because the server holds another, or
none. The message names the revision the server holds and when it changed, or that it is gone.

## Impact

The live client or branding differs from what the application team declared: redirect
URIs, scopes or the sign-in page may not be theirs. A removed client means its end users
cannot sign in. Writing the declared state back could undo an emergency change someone made
there, so the operator waits for a person.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` (or `branding`) for both revisions.
2. The server's audit log for the client: query `/v1/admin/orgs/<slug>/audit-events` with
   `client_id=<client_id>` for who changed it (`manager`, actor) and when;
   see [Querying](https://www.nauthera.io/docs/v1/audit-log#querying).
3. `kubectl get oidcclients -A | grep Drifted` for how many moved at once, which points at
   a restore rather than a person.

## Mitigation

- Keep the change: put it in the manifest, which is then written on its next generation.
- Undo it: `kubectl -n <ns> annotate oidcclient <name> nauthera.io/restore=true`. The
  operator writes the declared state, records a Restored event and removes the annotation.
  A client recreated this way delivers a new secret into its Secret; restart its workloads.
See [Changes made outside the operator](https://www.nauthera.io/docs/v1/operator#changes-made-outside-the-operator).

## Escalation

An unexplained change to a client is a security question: send the audit records to the
team that owns the identity platform before restoring. Many resources drifting at once
after a database restore go to whoever ran the restore.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.