# SecretKeyMissing

The Secret an IdentityProvider, LDAPDirectory or OIDCClient names holds nothing under the key it names; the resource is Ready=False, Error, and nothing is sent.

## Meaning

The Secret exists and has no value, or an empty one, under `spec.clientSecretRef.key`
(`client-secret` by default). The provider is not registered or updated until a value
appears; the operator reconciles the resource when the Secret changes.
An LDAPDirectory reports the same for the key `spec.bind.passwordSecretRef.key` names, or
`spec.caBundleRef.key` on a bundle of kind Secret, and an OIDCClient for
`spec.secret.secretRef.key` (`client-secret` by default).

## Impact

The organization's end users cannot sign in or sign up through this provider if it was
never registered; an existing registration keeps its previous secret.

## Diagnosis

1. `kubectl -n <ns> describe identityprovider <name>` names the Secret and key, as the
   admin dashboard's Problems page does.
2. `kubectl -n <ns> get secret <secret> -o jsonpath='{.data}' | jq 'keys'` lists the keys
   without printing values.

## Mitigation

- Write the value under the expected key, or set `spec.clientSecretRef.key` (an
  OIDCClient's `spec.secret.secretRef.key`) to the key that holds it. A Secret written with
  `--from-file` is keyed by the file's name.

## Escalation

The team that owns the provider's credential fixes the Secret. Escalate only if the key
holds a value and the condition stays.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.