{"record":{"id":"1c2e5e587f18540d","repo":"cilium/cilium","slug":"failed-to-create-or-update-serviceimport-w","errorCode":null,"errorMessage":"failed to create or update ServiceImport: %w","messagePattern":"failed to create or update ServiceImport: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/clustermesh/mcsapi/serviceimport_controller.go","lineNumber":739,"sourceCode":"\treturn controllerruntime.Success()\n}\n\nfunc (r *mcsAPIServiceImportReconciler) createOrUpdateServiceImport(ctx context.Context, desiredSvcImport *mcsapiv1beta1.ServiceImport) (*mcsapiv1beta1.ServiceImport, error) {\n\tsvcImport := &mcsapiv1beta1.ServiceImport{\n\t\tObjectMeta: metav1.ObjectMeta{\n\t\t\tName:      desiredSvcImport.Name,\n\t\t\tNamespace: desiredSvcImport.Namespace,\n\t\t},\n\t}\n\n\tresult, err := controllerutil.CreateOrUpdate(ctx, r.Client, svcImport, func() error {\n\t\tsvcImport.Annotations = desiredSvcImport.Annotations\n\t\tsvcImport.Labels = desiredSvcImport.Labels\n\t\tsvcImport.Spec = desiredSvcImport.Spec\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create or update ServiceImport: %w\", err)\n\t}\n\n\tr.Logger.Debug(fmt.Sprintf(\"ServiceImport %s has been %s\", client.ObjectKeyFromObject(svcImport), result))\n\n\treturn svcImport, nil\n}\n\n// SetupWithManager sets up the controller with the Manager.\nfunc (r *mcsAPIServiceImportReconciler) SetupWithManager(mgr ctrl.Manager) error {\n\treturn ctrl.NewControllerManagedBy(mgr).\n\t\tFor(&mcsapiv1beta1.ServiceImport{}).\n\t\t// Watch for changes to ServiceExport\n\t\tWatches(&mcsapiv1beta1.ServiceExport{}, &handler.EnqueueRequestForObject{}).\n\t\t// Watch for changes to Services\n\t\tWatches(&corev1.Service{}, &handler.EnqueueRequestForObject{}).\n\t\t// Watch for changes to Namespace to requeue service imports and exports\n\t\tWatches(&corev1.Namespace{}, handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []ctrl.Request {\n\t\t\trequests := []ctrl.Request{}","sourceCodeStart":721,"sourceCodeEnd":757,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/clustermesh/mcsapi/serviceimport_controller.go#L721-L757","documentation":"createOrUpdateServiceImport uses controller-runtime's CreateOrUpdate (via the reconcile helper) to create or patch the local ServiceImport; if that call fails for any reason the error is wrapped as \"failed to create or update ServiceImport: %w\" and returned to Reconcile, where it triggers backoff/requeue. Common underlying causes are API server conflicts, validation rejections, or RBAC denials on the ServiceImport resource.","triggerScenarios":"The CreateOrUpdate mutate/update round trip errors: the object was modified concurrently (optimistic conflict), the ServiceImport spec failed API validation, the client lacked update permission, or the API server was unreachable.","commonSituations":"Frequent reconciles racing with another controller writing the same ServiceImport; stale cached object causing conflict on update; CRD not installed so the resource kind is missing; namespace/RBAC misconfiguration.","solutions":["Inspect the wrapped error: conflict (409) → retry is automatic via requeue; check status cause otherwise.","Verify the ServiceImport CRD is installed and the reconciler's client has get/create/update RBAC on mcsapi resources.","If conflicts recur, reduce concurrent writers or ensure the mutate function is idempotent and only touches owned fields.","Check API server health and client cache freshness if errors are sporadic."],"exampleFix":"// before: mutate clobbers foreign fields causing repeated conflicts\nsvcImport.Annotations = desiredSvcImport.Annotations\nsvcImport.Spec = desiredSvcImport.Spec\n\n// after: only set owned annotations, keep others\nif svcImport.Annotations == nil {\n    svcImport.Annotations = map[string]string{}\n}\nfor k, v := range desiredSvcImport.Annotations {\n    svcImport.Annotations[k] = v\n}\nsvcImport.Spec = desiredSvcImport.Spec","handlingStrategy":"retry","validationCode":"// preflight: CRD present and RBAC allows update\nif _, err := client.Resource(mcsapiGVR).Namespace(ns).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) && !crdInstalled {\n    return errors.New(\"ServiceImport CRD not installed\")\n}","typeGuard":null,"tryCatchPattern":"svcImport, err := createOrUpdateServiceImport(ctx, r, desired)\nif err != nil {\n    if apierrors.IsConflict(err) {\n        return ctrl.Result{RequeueAfter: time.Second}, nil // transient, requeue\n    }\n    if apierrors.IsForbidden(err) {\n        log.Error(\"RBAC denies ServiceImport update\", \"err\", err) // do not hot-loop\n    }\n    return ctrl.Result{}, fmt.Errorf(\"failed to create or update ServiceImport: %w\", err)\n}","preventionTips":["Keep the mutate function idempotent and touch only owned fields.","Grant RBAC get/create/update on multicluster.x-k8s.io serviceimports.","Install MCS API CRDs before the reconciler runs.","Distinguish conflict errors (retryable) from forbidden/validation errors (fatal) in Reconcile."],"tags":["mcsapi","serviceimport","controller-runtime","kubernetes"],"backgroundTag":"create-or-update-conflict","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}