Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

SecretKeyMissing

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The Secret an IdentityProvider, LDAPDirectory or OIDCClient names holds nothing under the key it names; the resource is Ready=False, Error, and nothing is sent.

Meaning

The Secret exists and has no value, or an empty one, under spec.clientSecretRef.key (client-secret by default). The provider is not registered or updated until a value appears; the operator reconciles the resource when the Secret changes. An LDAPDirectory reports the same for the key spec.bind.passwordSecretRef.key names, or spec.caBundleRef.key on a bundle of kind Secret, and an OIDCClient for spec.secret.secretRef.key (client-secret by default).

Impact

The organization's end users cannot sign in or sign up through this provider if it was never registered; an existing registration keeps its previous secret.

Diagnosis

  1. kubectl -n <ns> describe identityprovider <name> names the Secret and key, as the admin dashboard's Problems page does.
  2. kubectl -n <ns> get secret <secret> -o jsonpath='{.data}' | jq 'keys' lists the keys without printing values.

Mitigation

  • Write the value under the expected key, or set spec.clientSecretRef.key (an OIDCClient's spec.secret.secretRef.key) to the key that holds it. A Secret written with --from-file is keyed by the file's name.

Escalation

The team that owns the provider's credential fixes the Secret. Escalate only if the key holds a value and the condition stays.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.