{"record":{"id":"14917bc10b62834d","repo":"kubernetes/kubernetes","slug":"unable-to-delete-podcertificaterequest-q-w","errorCode":null,"errorMessage":"unable to delete PodCertificateRequest %q: %w","messagePattern":"unable to delete PodCertificateRequest %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/controller/certificates/cleaner/pcrcleaner.go","lineNumber":104,"sourceCode":"}\n\nfunc (c PCRCleanerController) handle(ctx context.Context, pcr *certsv1.PodCertificateRequest) error {\n\tif c.clock.Now().Before(pcr.ObjectMeta.CreationTimestamp.Time.Add(c.threshold)) {\n\t\treturn nil\n\t}\n\n\topts := metav1.DeleteOptions{\n\t\tPreconditions: &metav1.Preconditions{\n\t\t\tUID: ptr.To(pcr.ObjectMeta.UID),\n\t\t},\n\t}\n\n\terr := c.client.CertificatesV1().PodCertificateRequests(pcr.ObjectMeta.Namespace).Delete(ctx, pcr.ObjectMeta.Name, opts)\n\tif k8serrors.IsNotFound(err) {\n\t\t// This is OK, we don't care if someone else already deleted it.\n\t\treturn nil\n\t} else if err != nil {\n\t\treturn fmt.Errorf(\"unable to delete PodCertificateRequest %q: %w\", pcr.ObjectMeta.Namespace+\"/\"+pcr.ObjectMeta.Name, err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":86,"sourceCodeEnd":109,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/94c136764292cc5fac976c0de6587daaea56410f/pkg/controller/certificates/cleaner/pcrcleaner.go#L86-L109","documentation":"Returned by the PodCertificateRequest cleaner controller's handle function when deleting a PCR that is older than the configured threshold fails. Unlike the CSR cleaner, this code properly handles NotFound (line 100-102) before wrapping the error, so only genuine deletion failures (permission, API errors) produce this error. The %w verb preserves the error chain for unwrapping.","triggerScenarios":"The cleaner identifies a PodCertificateRequest older than the threshold and calls client.CertificatesV1().PodCertificateRequests(namespace).Delete(ctx, name, opts) with a UID precondition. The delete fails with a non-NotFound error: permission denied, API server error, or UID mismatch (Conflict, since the PCR was recreated with a different UID).","commonSituations":"The controller manager lacks RBAC permission to delete podcertificaterequests. The PCR was deleted and a new one with the same name but different UID was created (UID precondition Conflict). API server connectivity issues during the cleanup polling interval.","solutions":["Check the wrapped error — if it is a Conflict (apierrors.IsConflict), the UID precondition failed because the PCR was replaced; this is benign.","Verify the controller manager's ClusterRole includes 'delete' on 'podcertificaterequests'.","Ensure the PodCertificateRequests feature gate is enabled and the API is available in the cluster version.","If errors persist, check API server health and the PCR API registration."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// The PCR cleaner already handles NotFound. If building custom cleanup:\nif err := client.CertificatesV1().PodCertificateRequests(ns).Delete(ctx, name, opts); err != nil {\n    if k8serrors.IsNotFound(err) {\n        return nil // already cleaned\n    }\n    if k8serrors.IsConflict(err) {\n        // UID precondition failed — PCR was replaced\n        return nil\n    }\n    return fmt.Errorf(\"unable to delete PodCertificateRequest %q: %w\", ns+\"/\"+name, err)\n}","preventionTips":["Ensure the controller manager's ClusterRole includes 'delete' on 'podcertificaterequests'.","Handle Conflict (UID mismatch) errors gracefully — they indicate the resource was replaced.","Verify the PodCertificateRequests feature gate is enabled in the cluster.","Monitor cleaner error rates; persistent non-Conflict errors indicate RBAC issues."],"tags":["certificates","cleaner","garbage-collection","pod-certificate-request","delete","rbac","kubernetes"],"backgroundTag":null,"analyzedSha":"94c136764292cc5fac976c0de6587daaea56410f","analyzedAt":"2026-08-08T23:58:27.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}