# NamespaceNotCovered

A namespaced resource is in a namespace the operator's connection does not carry; it is Ready=False, Error, and nothing is sent to the server.

## Meaning

The resource's namespace is not in the operator's `--namespaces`, set from
`operator.namespaces`. Nothing is sent and no finalizer is added. With no namespaces set,
every namespaced manifest reports this. The server holds the operator to its own list too,
the `namespaces` of its entry in `certManager.grpcTLS.allowedClients`; a namespace missing
there is Refused with `OUTSIDE_GRANT` instead.

## Impact

The application team's client, provider or branding does not exist on the server, so the
application cannot authenticate its end users. Nothing else is affected.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` names the namespace.
2. `kubectl -n <release-ns> get deploy <release>-operator -o yaml | grep -- --namespaces`.
3. `helm -n <release-ns> get values <release> -a | grep -A3 -E 'namespaces|allowedClients'`.

## Mitigation

- If the namespace is meant to be served, add it to `operator.namespaces` (or use `"*"`)
  and to the operator identity's `namespaces` in `certManager.grpcTLS.allowedClients` if
  that does not cover it, then `helm upgrade`. The resource is sent after the restart.
- If it is not, move the manifest to a covered namespace or delete it.

## Escalation

A request to cover a new namespace goes to the platform team that owns the release; it is a
decision about which teams may register clients, not a fault.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.