NamespaceNotAdmitted

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

A namespaced resource is in a namespace no organization admits, or spec.organization names one that does not admit it; it is Ready=False, Error, and nothing is sent to the server.

#Meaning

An organization admits the namespaces in its Organization's spec.namespaces; the main organization admits those in the operator's --main-organization-namespaces, set from operator.mainOrganizationNamespaces. The resource's namespace is in none of them, or the organization spec.organization names does not list it or does not exist. A resource the server already holds stays there unchanged; it is not removed.

#Impact

The application team's client, provider or branding is not written to the server, so a new one does not exist and a change to an existing one is not applied. Nothing else is affected.

#Diagnosis

1. kubectl -n <ns> describe oidcclient <name> names the namespace and any organization named.
2. kubectl get organizations -o custom-columns=NAME:.metadata.name,SLUG:.spec.slug,NAMESPACES:.spec.namespaces.
3. For the main organization: kubectl -n <release-ns> get deploy <release>-operator -o yaml | grep -- --main-organization-namespaces.

#Mitigation

• If the namespace is meant to configure the organization, add it to that Organization's spec.namespaces, or to operator.mainOrganizationNamespaces for the main organization. The resources in it are sent at once.
• If it is not, correct spec.organization (delete and recreate the resource, the field is immutable) or move the manifest to an admitted namespace.

#Escalation

Admitting a namespace is a decision about which team may configure an organization; it goes to whoever owns the Organization resource, usually the platform team. It is not a fault.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.