MembershipNotEnded

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

A BrokerMembership is being deleted and the server has not ended the membership; it stays in phase Deleting until it does.

#Meaning

Deleting either side of a membership ends it. The operator withdraws the side on the server before it removes its finalizer, and the call failed: the server was unreachable, refused the operator's credential, or the operator's grant no longer covers the organization or the namespace (broker_memberships in certManager.grpcTLS.allowedClients). The condition's message carries the server's answer.

#Impact

The membership is still active, so the member's users can still sign in through the broker's clients, and the resource cannot be deleted until the withdrawal succeeds.

#Diagnosis

1. kubectl -n <ns> describe brokermembership <name> for the server's answer.
2. kubectl -n <release-ns> logs deploy/<release>-operator | grep <name>.
3. helm -n <release-ns> get values <release> -a | grep -A6 allowedClients for the grant.

#Mitigation

• Restore the connection or the grant; the deletion completes on the next attempt.
• To end the membership regardless, end it from the other side, or have an administrator of either organization end it in the dashboard once the operator no longer declares it.

#Escalation

A membership that cannot be ended is a security question for both organizations: involve the platform team that owns the operator's grant, and attach the resource's events and the request id from the operator's log.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.