Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NamespaceNotCovered

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

A namespaced resource is in a namespace the operator's connection does not carry; it is Ready=False, Error, and nothing is sent to the server.

Meaning

The resource's namespace is not in the operator's --namespaces, set from operator.namespaces. Nothing is sent and no finalizer is added. With no namespaces set, every namespaced manifest reports this. The server holds the operator to its own list too, the namespaces of its entry in certManager.grpcTLS.allowedClients; a namespace missing there is Refused with OUTSIDE_GRANT instead.

Impact

The application team's client, provider or branding does not exist on the server, so the application cannot authenticate its end users. Nothing else is affected.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> names the namespace.
  2. kubectl -n <release-ns> get deploy <release>-operator -o yaml | grep -- --namespaces.
  3. helm -n <release-ns> get values <release> -a | grep -A3 -E 'namespaces|allowedClients'.

Mitigation

  • If the namespace is meant to be served, add it to operator.namespaces (or use "*") and to the operator identity's namespaces in certManager.grpcTLS.allowedClients if that does not cover it, then helm upgrade. The resource is sent after the restart.
  • If it is not, move the manifest to a covered namespace or delete it.

Escalation

A request to cover a new namespace goes to the platform team that owns the release; it is a decision about which teams may register clients, not a fault.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.