# NamespaceNotAdmitted

A namespaced resource is in a namespace no organization admits, or spec.organization names one that does not admit it; it is Ready=False, Error, and nothing is sent to the server.

## Meaning

An organization admits the namespaces in its Organization's `spec.namespaces`; the main
organization admits those in the operator's `--main-organization-namespaces`, set from
`operator.mainOrganizationNamespaces`. The resource's namespace is in none of them, or the
organization `spec.organization` names does not list it or does not exist. A resource the
server already holds stays there unchanged; it is not removed.

## Impact

The application team's client, provider or branding is not written to the server, so a new
one does not exist and a change to an existing one is not applied. Nothing else is affected.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` names the namespace and any organization named.
2. `kubectl get organizations -o custom-columns=NAME:.metadata.name,SLUG:.spec.slug,NAMESPACES:.spec.namespaces`.
3. For the main organization: `kubectl -n <release-ns> get deploy <release>-operator -o yaml | grep -- --main-organization-namespaces`.

## Mitigation

- If the namespace is meant to configure the organization, add it to that Organization's
  `spec.namespaces`, or to `operator.mainOrganizationNamespaces` for the main organization.
  The resources in it are sent at once.
- If it is not, correct `spec.organization` (delete and recreate the resource, the field is
  immutable) or move the manifest to an admitted namespace.

## Escalation

Admitting a namespace is a decision about which team may configure an organization; it goes
to whoever owns the Organization resource, usually the platform team. It is not a fault.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.