{"record":{"id":"3ac7fca96ec7d2a2","repo":"cilium/cilium","slug":"failed-to-update-ciliumcidrgroup-s-w","errorCode":null,"errorMessage":"failed to update CiliumCIDRGroup %s: %w","messagePattern":"failed to update CiliumCIDRGroup (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/networkpolicy/external-groups/cidrgroup.go","lineNumber":219,"sourceCode":"\t\tlogfields.Name, ccg.Name,\n\t)\n\treturn ccg, nil\n}\n\n// updateCCG updates an existing CiliumCIDRGroup in the apisever.\n// falls back to Create if the group does not exist for some reason.\nfunc (gm *externalGroupManager) updateCCG(ctx context.Context, ccg *apiv2.CiliumCIDRGroup) (*apiv2.CiliumCIDRGroup, error) {\n\tccg, err := gm.clientset.CiliumV2().CiliumCIDRGroups().Update(ctx, ccg, metav1.UpdateOptions{FieldManager: FieldManager})\n\tif apierrors.IsNotFound(err) {\n\t\tgm.log.Warn(\"CiliumCIDRGroup for external group was unexpectedly deleted\",\n\t\t\tlogfields.Name, ccg.Name)\n\t\treturn gm.createCCG(ctx, ccg)\n\t}\n\tif err != nil {\n\t\tgm.log.Warn(\"Failed to update CiliumCIDRGroup for external Group\",\n\t\t\tlogfields.Name, ccg.Name,\n\t\t\tlogfields.Error, err)\n\t\treturn nil, fmt.Errorf(\"failed to update CiliumCIDRGroup %s: %w\", ccg.Name, err)\n\t}\n\tgm.log.Info(\"Updated CiliumCIDRGroup for external Group\",\n\t\tlogfields.Name, ccg.Name,\n\t)\n\treturn ccg, nil\n}\n\nfunc (gm *externalGroupManager) deleteCCG(ctx context.Context, name string) error {\n\t// Delete the underlying CCG\n\terr := gm.clientset.CiliumV2().CiliumCIDRGroups().Delete(ctx, name, metav1.DeleteOptions{})\n\tif err != nil && !apierrors.IsNotFound(err) {\n\t\tgm.log.Warn(\"Failed to delete stale CiliumCIDRGroup for external Group\",\n\t\t\tlogfields.Name, name,\n\t\t\tlogfields.Error, err)\n\t\treturn fmt.Errorf(\"failed to delete CiliumCIDRGroup %s: %w\", name, err)\n\t}\n\tgm.log.Info(\"Deleted stale CiliumCIDRGroup for external group\",\n\t\tlogfields.Name, name)","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/networkpolicy/external-groups/cidrgroup.go#L201-L237","documentation":"updateCCG updates an existing CiliumCIDRGroup via the Kubernetes API after a prior create returned AlreadyExists (or direct update path). If the Update call fails for reasons other than triggering a create, the error is logged at Warn and wrapped as 'failed to update CiliumCIDRGroup <name>: %w'. This indicates the existing group could not be brought to the desired CIDR set.","triggerScenarios":"gm.clientset.CiliumV2().CiliumCIDRGroups().Update returns an error — commonly a Conflict/OptimisticConcurrency (resourceVersion changed) or Forbidden/NotFound — while called from upsertCCG after the create attempt found the object already exists.","commonSituations":"Another controller or a user edited the CiliumCIDRGroup concurrently so resourceVersion is stale (typical conflict); RBAC missing update permission; the group was deleted between create and update; stale local cache of the object.","solutions":["If the error is a Conflict, re-fetch the latest CiliumCIDRGroup and retry the update with a fresh resourceVersion (Retry-On-Conflict).","Verify the object still exists: kubectl get ciliumcidrgroup <name>; if missing, go through createCCG again.","Grant the operator update permission on ciliumcidrgroups.cilium.io.","Inspect the wrapped %w cause for the precise API error and act on it."],"exampleFix":"// before\n_, err = gm.updateCCG(ctx, ccg) // stale resourceVersion -> conflict\n// after\nlatest, err := gm.clientset.CiliumV2().CiliumCIDRGroups().Get(ctx, ccg.Name, metav1.GetOptions{})\nif err != nil { return nil, err }\nlatest.CIDRGroups = ccg.CIDRGroups\n_, err = gm.updateCCG(ctx, latest)","handlingStrategy":"retry","validationCode":"latest, err := gm.clientset.CiliumV2().CiliumCIDRGroups().Get(ctx, ccg.Name, metav1.GetOptions{})\nif err != nil { return err }\nccg.ResourceVersion = latest.ResourceVersion","typeGuard":"func isConflict(err error) bool { return apierrors.IsConflict(errors.Unwrap(err) ?? err) }","tryCatchPattern":"err := retry.RetryOnConflict(retry.DefaultRetry, func() error {\n  latest, err := gm.clientset.CiliumV2().CiliumCIDRGroups().Get(ctx, ccg.Name, metav1.GetOptions{})\n  if err != nil { return err }\n  latest.CIDRGroups = ccg.CIDRGroups\n  _, err = gm.updateCCG(ctx, latest)\n  return err\n})","preventionTips":["Always re-Get the object and refresh resourceVersion before updating","Use client-go retry.RetryOnConflict for all CCG mutations","Avoid manual edits to operator-managed CiliumCIDRGroups","Ensure RBAC includes update verb on ciliumcidrgroups"],"tags":["cilium","kubernetes","cidrgroup","networkpolicy","conflict"],"backgroundTag":"kubernetes-api-request-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}