Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

Unreachable

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

No answer came back from the server's control plane; the operator's pod is not ready, and a resource it reconciles is Ready=False, Pending.

Meaning

A probe or call to --server-endpoint got no answer. The message names the endpoint, the transport's text and, when it recognises it, the cause: nothing listening or a network policy refusing the operator, a host that does not resolve, a server certificate that does not chain to the trust anchor, is expired or is for another name, an operator certificate the listener does not trust (or a TLS-terminating proxy in between), a listener without TLS 1.3, or a timeout. A registered OIDCClient also reports "the server stopped answering".

Impact

Registered clients, their Secrets and their client IDs are kept, and sign-in keeps working if only the operator's path to the server is broken. New or changed manifests are not applied, new secrets are not delivered, and deletions under Delete wait. If the server itself is down, end users cannot sign in, and that is the server's incident.

Diagnosis

  1. kubectl -n <ns> describe oidcclient <name> for the endpoint and the cause.
  2. kubectl -n <release-ns> logs deploy/<release>-operator | grep 'control plane not reachable'.
  3. nauthera_operator_server_calls_total{code=~"Unavailable|DeadlineExceeded"} rising, and kubectl -n <release-ns> get pods,svc,networkpolicy for the server's gRPC Service and pods.
  4. Compare --server-endpoint with kubectl -n <release-ns> get deploy <release>-operator -o yaml | grep server-endpoint.

Mitigation

  • Nothing listening, or a policy: point operator.server.endpoint at the gRPC Service (empty means this release's), and admit port 9091 in operator.networkPolicy.serverTo.
  • A certificate cause: give the operator the CA of the server's gRPC certificate, dial a name the certificate carries, and issue the operator's certificate from the authority the server's server.grpc.tls.client_ca_file names (certManager.grpcTLS.enabled).
  • A TLS-terminating proxy: dial port 9091 directly or through TLS passthrough. Recovery needs no one: resources are sent again within about a minute of an answer.

Escalation

If the server is down, follow the server's own runbooks (NautheraServerDown). If the operator stays Unreachable while the server answers others, escalate to the platform team with the condition message, the operator log lines and nauthera_operator_server_calls_total. Open an issue only for a transport cause the message misnames; attach no keys.

Operator failure reasons · Generated from operator/internal/runbook/conditions.yaml in nauthera-server.