# OrganizationNotRemoved

An Organization being deleted under deletionPolicy Delete is still on the server; it is Ready=False in phase Deleting.

## Meaning

The resource is being deleted with `spec.deletionPolicy: Delete`, and the server has not
removed the organization: it did not answer, serves an unsupported contract, refused the
call (often the `organizations` operation or the slug missing from the operator's grant),
or the operator's credential is unusable. The message carries the cause. The finalizer
`nauthera.io/organization` holds the resource until the organization is gone.

## Impact

The tenant keeps serving: its users can still sign in and its tokens stay valid. The
resource stays in Terminating. Removing it deletes everything the organization holds, so
the delay is safer than a forced removal.

## Diagnosis

1. `kubectl describe organization <name>` for the cause.
2. `nauthera_operator_server_calls_total{call=~"GetOrganization|DeleteOrganization"}` by `code`.
3. The server's audit log for `organization.deleted`.

## Mitigation

- Fix the cause (see Unreachable, Refused, Unsupported); the removal is retried every five
  minutes, or about once a minute while the server does not answer.
- A grant refusal: add `organizations` and the slug to the operator's entry in
  `certManager.grpcTLS.allowedClients`.
Only the organization this resource created or adopted is removed.

## Escalation

Deleting a tenant is irreversible; confirm with the tenant's owner before forcing anything.
If the server refuses a removal the grant allows, open an issue with the condition message
and both versions.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.