ProviderNotRemoved

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

An IdentityProvider being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.

#Meaning

The resource is being deleted with spec.deletionPolicy: Delete, and the server has not removed the provider: it did not answer, serves an unsupported contract, refused the call (often the identity_providers operation missing from the grant), or the operator's credential is unusable. The message carries the cause. The finalizer nauthera.io/identityprovider holds the resource until the provider is gone.

#Impact

The provider stays offered to the clients that list it, so end users can still sign in through it. The resource and its namespace stay in Terminating.

#Diagnosis

1. kubectl -n <ns> describe identityprovider <name> for the cause.
2. nauthera_operator_server_calls_total{call="DeleteIdentityProvider"} by code.
3. The server's audit log for identity_provider.deleted.

#Mitigation

• Fix the cause (see Unreachable, Refused, Unsupported); the removal is retried every five minutes, or about once a minute while the server does not answer.
• A grant refusal: add identity_providers to the operator's entry in certManager.grpcTLS.allowedClients. See Deleting a resource.

#Escalation

If sign-in through the provider must stop now, remove it from the clients' spec.identityProviders first. If the server refuses a removal the grant allows, open an issue with the condition message and both versions. No secrets.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.