# TrustAnchorUnavailable

The operator has no usable CA to verify the server with; its pod is not ready, and a resource it reconciles is Ready=False, Pending.

## Meaning

The file `--server-ca-file` names is missing, unreadable, or holds no PEM certificate. The
message names the file. With the chart it is `ca.crt` in the operator's credential Secret
under `/etc/nauthera/control-plane`, or the key `operator.server.caKey` of
`operator.server.caSecret` under `/etc/nauthera/control-plane-ca`. An issuer that is not a
CA (an ACME issuer) writes no `ca.crt`, which is the usual cause.

## Impact

Nothing reaches the server: no OIDCClient is registered or updated, no secret is delivered,
no deletion under `Delete` completes. Registered clients keep working for their
applications and end users. Every application team using the operator is blocked.

## Diagnosis

1. `kubectl -n <release-ns> logs deploy/<release>-operator | grep 'control plane not reachable'`
   names the file.
2. `kubectl -n <release-ns> get secret <secret> -o jsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -noout -subject`
   shows whether the key holds a certificate.
3. `kubectl -n <release-ns> describe pod -l app.kubernetes.io/component=operator` for a volume
   that failed to mount.

## Mitigation

- With the chart's own keypair (`certManager.grpcTLS.client.enabled`), its `ca.crt` is the
  control plane's CA: check the Certificate is Ready and the Secret was not replaced.
- With your own credential Secret and no `ca.crt` in it, put the authority that issued the
  server's gRPC certificate in a Secret and set `operator.server.caSecret` and
  `operator.server.caKey`.

## Escalation

Escalate to the platform team that owns the operator's release. If the file holds a valid
PEM certificate and the reason persists, open an issue with the condition message, the
operator's version and the CA certificate's subject and fingerprint. No private keys.

---

[Operator failure reasons](https://www.nauthera.io/docs/v1/runbooks/operator) · Generated from [`operator/internal/runbook/conditions.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/conditions.yaml) in nauthera-server.