# MembershipNotEnded

A BrokerMembership is being deleted and the server has not ended the membership; it stays in phase Deleting until it does.

## Meaning

Deleting either side of a membership ends it. The operator withdraws the side on the server
before it removes its finalizer, and the call failed: the server was unreachable, refused the
operator's credential, or the operator's grant no longer covers the organization or the
namespace (`broker_memberships` in `certManager.grpcTLS.allowedClients`). The condition's
message carries the server's answer.

## Impact

The membership is still active, so the member's users can still sign in through the broker's
clients, and the resource cannot be deleted until the withdrawal succeeds.

## Diagnosis

1. `kubectl -n <ns> describe brokermembership <name>` for the server's answer.
2. `kubectl -n <release-ns> logs deploy/<release>-operator | grep <name>`.
3. `helm -n <release-ns> get values <release> -a | grep -A6 allowedClients` for the grant.

## Mitigation

- Restore the connection or the grant; the deletion completes on the next attempt.
- To end the membership regardless, end it from the other side, or have an administrator of
  either organization end it in the dashboard once the operator no longer declares it.

## Escalation

A membership that cannot be ended is a security question for both organizations: involve the
platform team that owns the operator's grant, and attach the resource's events and the
request id from the operator's log.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.