Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

OrganizationAmbiguous

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

A namespaced resource names no organization in a namespace that several organizations admit; it is Ready=False, Error, and nothing is sent to the server.

Meaning

More than one organization lists the resource's namespace in its spec.namespaces (or the main organization's namespaces include it as well), as for a shared namespace holding clients of several organizations. Such a resource must say which one it belongs to in spec.organization. The condition's message lists the organizations that admit it.

Impact

The resource is not written to the server until it names its organization. A resource the server already holds is unchanged. Nothing else is affected.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> lists the organizations that admit the namespace.
  2. kubectl get organizations -o custom-columns=NAME:.metadata.name,SLUG:.spec.slug,NAMESPACES:.spec.namespaces.

Mitigation

  • Set spec.organization to the slug of the intended organization (default for the main one). The field is immutable, so delete and recreate a resource that exists.
  • If the namespace should not be shared, drop it from the Organization that should not admit it.

Escalation

A namespace that became shared unexpectedly means an Organization was edited to list it; check who changed it with the cluster's audit log and involve the platform team.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.