# Refused

The server answered and refused the call; a resource is Ready=False (Error, or Pending while retried), or the operator's pod is not ready.

## Meaning

The message carries the gRPC code, the server's objection field by field, its stable reason
and a cause. `IDENTITY_NOT_ALLOWED` or `PermissionDenied`: the operator's certificate SAN is
not in `server.grpc.tls.allowed_clients`, or a proxy terminated TLS. `OPERATION_NOT_GRANTED`
or `OUTSIDE_GRANT`: the entry lacks the operation (`clients`, `brandings`,
`identity_providers`, `organizations`) or the organization or namespace. `Unimplemented`:
the server is older than the call. Any other code is the server's objection to the spec.
An Organization or Branding whose `spec.branding` cannot be encoded is refused by the
operator itself.

## Impact

The application team's change is not applied; a client already registered stays at the
generation the server keeps in force, which the message names. A refusal on the probe or on
every resource is the platform team's: nothing the operator manages is written. End users
see the last registered state, or no client at all for a new manifest.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` (or `branding`, `identityprovider`,
   `organization <name>`) for the message, its fields and the reason in parentheses.
2. `sum by (kind, cause) (increase(nauthera_operator_reconciles_total{reason="Refused"}[1h]))`:
   one cause across every kind is the grant; one resource is its manifest.
3. `nauthera_operator_server_calls_total{code="PermissionDenied"}` for a grant problem.
4. The server's audit log (`client.applied`, `branding.applied`, `identity_provider.applied`)
   carries `cause` and `violations` for the write it refused.

## Mitigation

- A field objection: fix the manifest; it is sent again on the next edit or after five
  minutes. A server state named in the message (FAPI mode, a reserved name) needs the spec
  to fit it; an issuer no organization serves (a typo, a deleted tenant) needs the issuer
  of one that exists.
- An identity or grant cause: list `dns:<certManager.grpcTLS.client.dnsName>` in
  `certManager.grpcTLS.allowedClients` with the operation, organization slug and namespace.
- `Unimplemented`: upgrade the server. `Aborted`, `Internal`, `Unknown` and
  `ResourceExhausted` are retried with backoff and need nothing unless they persist.

## Escalation

Field objections go to the application team that owns the manifest. Grant problems go to
the platform team that owns the server's configuration. If the server refuses a spec its
documentation allows, or answers `Internal` repeatedly, open an issue with the condition
message, both versions and the server's log line for the call (`grpc_call`). No secrets.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.