# SecretUndeliverable

The server holds an OIDCClient's secret, and the operator could not write it into the Secret; the OIDCClient is Ready=False, Error or Pending.

## Meaning

The client is registered and its secret minted, and the write to the Secret named by
`spec.secret.secretName` (or the resource's name) failed. Causes: a Secret at that name
that this OIDCClient does not own, which the operator never writes over; the operator's
role lacks permission on secrets; or the write failed for another reason, retried with
backoff. The secret is kept in memory and the write retried; an operator that restarts
first mints a new secret instead.

## Impact

The application team's workload has no client secret, or an old one the server no longer
accepts, so its token requests fail and its end users cannot sign in through it. A secret
minted again after a restart means any copy taken out of band is stale.

## Diagnosis

1. `kubectl -n <ns> describe oidcclient <name>` names the Secret and the cause.
2. `kubectl -n <ns> get secret <secret> -o jsonpath='{.metadata.ownerReferences}'` shows
   who owns it.
3. `kubectl auth can-i update secrets -n <ns> --as=system:serviceaccount:<release-ns>:<release>-operator`.
4. `kubectl -n <release-ns> logs deploy/<release>-operator | grep 'writing the client secret'`.

## Mitigation

- A foreign Secret: delete or rename it, or point `spec.secret.secretName` elsewhere. A
  Secret the team holds the client secret in, such as one a SealedSecret produces, is
  named in `spec.secret.secretRef` instead of `spec.secret.generate`, and the operator
  reads it rather than writing one.
- Missing permission: set `operator.rbac.create: true`, or grant get, list, watch, create
  and update on secrets to the operator's ServiceAccount.
- Once written, the condition returns to Registered. Restart workloads that read the
  Secret at startup only. See [How secrets work](https://www.nauthera.io/docs/v1/oidc-client#how-secrets-work).

## Escalation

The application team owns a foreign Secret; the platform team owns the operator's role.
If the write keeps failing with no owner or permission cause, open an issue with the
condition message and operator log lines. Never attach the Secret's data.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.