Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

SecretUndeliverable

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The server holds an OIDCClient's secret, and the operator could not write it into the Secret; the OIDCClient is Ready=False, Error or Pending.

Meaning

The client is registered and its secret minted, and the write to the Secret named by spec.secret.secretName (or the resource's name) failed. Causes: a Secret at that name that this OIDCClient does not own, which the operator never writes over; the operator's role lacks permission on secrets; or the write failed for another reason, retried with backoff. The secret is kept in memory and the write retried; an operator that restarts first mints a new secret instead.

Impact

The application team's workload has no client secret, or an old one the server no longer accepts, so its token requests fail and its end users cannot sign in through it. A secret minted again after a restart means any copy taken out of band is stale.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> names the Secret and the cause.
  2. kubectl -n <ns> get secret <secret> -o jsonpath='{.metadata.ownerReferences}' shows who owns it.
  3. kubectl auth can-i update secrets -n <ns> --as=system:serviceaccount:<release-ns>:<release>-operator.
  4. kubectl -n <release-ns> logs deploy/<release>-operator | grep 'writing the client secret'.

Mitigation

  • A foreign Secret: delete or rename it, or point spec.secret.secretName elsewhere. A Secret the team holds the client secret in, such as one a SealedSecret produces, is named in spec.secret.secretRef instead of spec.secret.generate, and the operator reads it rather than writing one.
  • Missing permission: set operator.rbac.create: true, or grant get, list, watch, create and update on secrets to the operator's ServiceAccount.
  • Once written, the condition returns to Registered. Restart workloads that read the Secret at startup only. See How secrets work.

Escalation

The application team owns a foreign Secret; the platform team owns the operator's role. If the write keeps failing with no owner or permission cause, open an issue with the condition message and operator log lines. Never attach the Secret's data.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.