# SecretNotFound

The Secret an IdentityProvider, LDAPDirectory or OIDCClient names does not exist; the resource is Ready=False, Error, and nothing is sent.

## Meaning

The operator reads the provider's client secret from the Secret `spec.clientSecretRef.name`
names, in the resource's own namespace, and there is none. The provider is not registered
or updated until the Secret appears; the operator watches Secrets and reconciles the
resource when it does.
An LDAPDirectory reports the same for the Secret `spec.bind.passwordSecretRef` names, or
`spec.caBundleRef` of kind Secret, and an OIDCClient for the Secret
`spec.secret.secretRef.name` names, which holds the client secret its team chose.

## Impact

The organization's end users cannot sign in or sign up through this external provider if it
was never registered; an existing registration keeps its previous secret and settings. For
an OIDCClient, a client never registered cannot be used by its application; a registered
one keeps the secret the server last took.

## Diagnosis

1. `kubectl -n <ns> describe identityprovider <name>` (or `ldapdirectory`, `oidcclient`)
   names the Secret. The admin dashboard's Problems page shows the same message, for the
   organization's administrators.
2. `kubectl -n <ns> get secret <secret>`; a Secret in another namespace does not count.
3. For an external secrets controller or a SealedSecret:
   `kubectl -n <ns> get events --sort-by=.lastTimestamp`, and
   `kubectl -n <ns> get sealedsecret <secret> -o jsonpath='{.status.conditions}'`.

## Mitigation

- Create the Secret in the resource's namespace, or fix `spec.clientSecretRef.name`:
  `kubectl -n <ns> create secret generic <secret> --from-literal=client-secret=<value>`.
- If a secrets controller writes it, fix that controller's sync; a SealedSecret must be
  sealed for the resource's namespace and the Secret's name.
- An OIDCClient: create the Secret, or fix `spec.secret.secretRef.name`.
See [What the operator does](https://www.nauthera.io/docs/v1/identity-provider-resource#what-the-operator-does).

## Escalation

The team that owns the provider's credential supplies the Secret. Escalate only if the
Secret exists and the condition stays.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.