# OrganizationAmbiguous

A namespaced resource names no organization in a namespace that several organizations admit; it is Ready=False, Error, and nothing is sent to the server.

## Meaning

More than one organization lists the resource's namespace in its `spec.namespaces` (or the
main organization's namespaces include it as well), as for a shared namespace holding
clients of several organizations. Such a resource must say which one it belongs to in
`spec.organization`. The condition's message lists the organizations that admit it.

## Impact

The resource is not written to the server until it names its organization. A resource the
server already holds is unchanged. Nothing else is affected.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` lists the organizations that admit the namespace.
2. `kubectl get organizations -o custom-columns=NAME:.metadata.name,SLUG:.spec.slug,NAMESPACES:.spec.namespaces`.

## Mitigation

- Set `spec.organization` to the slug of the intended organization (`default` for the main
  one). The field is immutable, so delete and recreate a resource that exists.
- If the namespace should not be shared, drop it from the Organization that should not admit it.

## Escalation

A namespace that became shared unexpectedly means an Organization was edited to list it;
check who changed it with the cluster's audit log and involve the platform team.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.