Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

Refused

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The server answered and refused the call; a resource is Ready=False (Error, or Pending while retried), or the operator's pod is not ready.

Meaning

The message carries the gRPC code, the server's objection field by field, its stable reason and a cause. IDENTITY_NOT_ALLOWED or PermissionDenied: the operator's certificate SAN is not in server.grpc.tls.allowed_clients, or a proxy terminated TLS. OPERATION_NOT_GRANTED or OUTSIDE_GRANT: the entry lacks the operation (clients, brandings, identity_providers, organizations) or the organization or namespace. Unimplemented: the server is older than the call. Any other code is the server's objection to the spec. An Organization or Branding whose spec.branding cannot be encoded is refused by the operator itself.

Impact

The application team's change is not applied; a client already registered stays at the generation the server keeps in force, which the message names. A refusal on the probe or on every resource is the platform team's: nothing the operator manages is written. End users see the last registered state, or no client at all for a new manifest.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> (or branding, identityprovider, organization <name>) for the message, its fields and the reason in parentheses.
  2. sum by (kind, cause) (increase(nauthera_operator_reconciles_total{reason="Refused"}[1h])): one cause across every kind is the grant; one resource is its manifest.
  3. nauthera_operator_server_calls_total{code="PermissionDenied"} for a grant problem.
  4. The server's audit log (client.applied, branding.applied, identity_provider.applied) carries cause and violations for the write it refused.

Mitigation

  • A field objection: fix the manifest; it is sent again on the next edit or after five minutes. A server state named in the message (FAPI mode, a reserved name) needs the spec to fit it; an issuer no organization serves (a typo, a deleted tenant) needs the issuer of one that exists.
  • An identity or grant cause: list dns:<certManager.grpcTLS.client.dnsName> in certManager.grpcTLS.allowedClients with the operation, organization slug and namespace.
  • Unimplemented: upgrade the server. Aborted, Internal, Unknown and ResourceExhausted are retried with backoff and need nothing unless they persist.

Escalation

Field objections go to the application team that owns the manifest. Grant problems go to the platform team that owns the server's configuration. If the server refuses a spec its documentation allows, or answers Internal repeatedly, open an issue with the condition message, both versions and the server's log line for the call (grpc_call). No secrets.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.