Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

SecretNotFound

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The Secret an IdentityProvider, LDAPDirectory or OIDCClient names does not exist; the resource is Ready=False, Error, and nothing is sent.

Meaning

The operator reads the provider's client secret from the Secret spec.clientSecretRef.name names, in the resource's own namespace, and there is none. The provider is not registered or updated until the Secret appears; the operator watches Secrets and reconciles the resource when it does. An LDAPDirectory reports the same for the Secret spec.bind.passwordSecretRef names, or spec.caBundleRef of kind Secret, and an OIDCClient for the Secret spec.secret.secretRef.name names, which holds the client secret its team chose.

Impact

The organization's end users cannot sign in or sign up through this external provider if it was never registered; an existing registration keeps its previous secret and settings. For an OIDCClient, a client never registered cannot be used by its application; a registered one keeps the secret the server last took.

Diagnosis

  1. kubectl -n <ns> describe identityprovider <name> (or ldapdirectory, oidcclient) names the Secret. The admin dashboard's Problems page shows the same message, for the organization's administrators.
  2. kubectl -n <ns> get secret <secret>; a Secret in another namespace does not count.
  3. For an external secrets controller or a SealedSecret: kubectl -n <ns> get events --sort-by=.lastTimestamp, and kubectl -n <ns> get sealedsecret <secret> -o jsonpath='{.status.conditions}'.

Mitigation

  • Create the Secret in the resource's namespace, or fix spec.clientSecretRef.name: kubectl -n <ns> create secret generic <secret> --from-literal=client-secret=<value>.
  • If a secrets controller writes it, fix that controller's sync; a SealedSecret must be sealed for the resource's namespace and the Secret's name.
  • An OIDCClient: create the Secret, or fix spec.secret.secretRef.name. See What the operator does.

Escalation

The team that owns the provider's credential supplies the Secret. Escalate only if the Secret exists and the condition stays.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.