# ProviderNotRemoved

An IdentityProvider being deleted under deletionPolicy Delete is still registered on the server; it is Ready=False in phase Deleting.

## Meaning

The resource is being deleted with `spec.deletionPolicy: Delete`, and the server has not
removed the provider: it did not answer, serves an unsupported contract, refused the call
(often the `identity_providers` operation missing from the grant), or the operator's
credential is unusable. The message carries the cause. The finalizer
`nauthera.io/identityprovider` holds the resource until the provider is gone.

## Impact

The provider stays offered to the clients that list it, so end users can still sign in
through it. The resource and its namespace stay in Terminating.

## Diagnosis

1. `kubectl -n <ns> describe identityprovider <name>` for the cause.
2. `nauthera_operator_server_calls_total{call="DeleteIdentityProvider"}` by `code`.
3. The server's audit log for `identity_provider.deleted`.

## Mitigation

- Fix the cause (see Unreachable, Refused, Unsupported); the removal is retried every five
  minutes, or about once a minute while the server does not answer.
- A grant refusal: add `identity_providers` to the operator's entry in
  `certManager.grpcTLS.allowedClients`.
See [Deleting a resource](https://www.nauthera.io/docs/v1/identity-provider-resource#deleting-a-resource).

## Escalation

If sign-in through the provider must stop now, remove it from the clients'
`spec.identityProviders` first. If the server refuses a removal the grant allows, open an
issue with the condition message and both versions. No secrets.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.