{"record":{"id":"4582f18336511a43","repo":"cilium/cilium","slug":"failed-to-create-or-update-ciliumenvoyconfig-w","errorCode":null,"errorMessage":"failed to create or update CiliumEnvoyConfig: %w","messagePattern":"failed to create or update CiliumEnvoyConfig: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ingress/ingress_reconcile.go","lineNumber":342,"sourceCode":"\t// Otherwise, the subsequent CreateOrUpdate will fail as spec.resources is required field.\n\tif len(cec.Spec.Resources) == 0 {\n\t\terr := r.client.Delete(ctx, cec)\n\t\tif err != nil && !k8serrors.IsNotFound(err) {\n\t\t\treturn fmt.Errorf(\"failed to delete CiliumEnvoyConfig: %w\", err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tresult, err := controllerutil.CreateOrUpdate(ctx, r.client, cec, func() error {\n\t\tcec.Spec = desiredCEC.Spec\n\t\tcec.OwnerReferences = desiredCEC.OwnerReferences\n\t\tcec.Annotations = mergeMap(cec.Annotations, desiredCEC.Annotations)\n\t\tcec.Labels = mergeMap(cec.Labels, desiredCEC.Labels)\n\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create or update CiliumEnvoyConfig: %w\", err)\n\t}\n\n\tr.logger.DebugContext(ctx, fmt.Sprintf(\"CiliumEnvoyConfig %s has been %s\", client.ObjectKeyFromObject(cec), result))\n\n\treturn nil\n}\n\nfunc (r *ingressReconciler) createOrUpdateService(ctx context.Context, desiredService *corev1.Service) error {\n\tsvc := desiredService.DeepCopy()\n\n\tresult, err := controllerutil.CreateOrUpdate(ctx, r.client, svc, func() error {\n\t\t// Save and restore loadBalancerClass\n\t\t// e.g. if a mutating webhook writes this field\n\t\tlbClass := svc.Spec.LoadBalancerClass\n\t\tsvc.Spec = desiredService.Spec\n\t\tsvc.Spec.LoadBalancerClass = lbClass\n\n\t\tif desiredService.Spec.ExternalTrafficPolicy != \"\" {","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ingress/ingress_reconcile.go#L324-L360","documentation":"This error wraps the underlying error returned by controller-runtime's CreateOrUpdate during the CreateOrUpdateCEC controller-runtime retry.EscalatingVerbosity loop (controllerutil.CreateOrUpdate) for a CiliumEnvoyConfig resource. Cilium's ingress operator creates/updates CEC objects to configure Envoy routing for ingress traffic. It fires whenever create-or-update of the CEC fails for any reason (API server rejection, conflict, RBAC, invalid spec).","triggerScenarios":"createOrUpdateDedicatedResources or createOrUpdateSharedResources calls createOrUpdateCiliumEnvoyConfig; controllerutil.CreateOrUpdate returns an error from Get, Create, or Update of the CiliumEnvoyConfig (e.g. mutation rejected by webhook, RBAC denied, context cancelled, API server unreachable).","commonSituations":"Missing RBAC permissions on cilium.io/ciliumenvoyconfigs; a validating webhook rejecting the desired Envoy config; invalid spec (bad listeners/filters) rejected by API server; concurrent controllers conflicting during shared-ingress mode; CRD ciliumenvoyconfigs not installed.","solutions":["Inspect the wrapped cause (%w chain) with `kubectl logs` on the cilium-operator to see whether it's RBAC, validation, or connection error","Verify CRDs are installed: kubectl get crd ciliumenvoyconfigs.cilium.io","Check the operator's ClusterRole allows get/create/update/patch on ciliumenvoyconfigs","Validate the Envoy config fields produced (annotations like io.cilium.ingress) match CRD schema","Re-run reconcile; CreateOrUpdate is idempotent and transient conflicts resolve on retry"],"exampleFix":"// before: CEC spec fields not present in installed CRD version\ncec.Spec.ExternalListeners = desiredCEC.ExternalListeners\n// after: guard against nil/unsupported fields and ensure CRD up to date\nif desiredCEC.Spec.Resources != nil {\n    cec.Spec.Resources = desiredCEC.Spec.Resources\n}\n// and upgrade cilium CRDs: kubectl apply -f cilium-crds.yaml","handlingStrategy":"try-catch","validationCode":"kubectl get crd ciliumenvoyconfigs.cilium.io && kubectl auth can-i create ciliumenvoyconfigs.cilium.io --as=system:serviceaccount:<ns>:cilium-operator","typeGuard":null,"tryCatchPattern":"err := createOrUpdateCiliumEnvoyConfig(ctx, ingress, cec)\nif err != nil {\n    // inspect wrapped cause\n    log.Error(err, \"CEC create/update failed\")\n    var apiErr *apierrors.StatusError\n    if errors.As(err, &apiErr) {\n        log.Info(\"reason\", \"reason\", apiErr.ErrStatus.Reason, \"msg\", apiErr.ErrStatus.Message)\n    }\n    return ctrl.Result{RequeueAfter: 30 * time.Second}, err\n}","preventionTips":["Keep cilium CRDs in sync with the operator version","Pre-validate ClusterRole covers ciliumenvoyconfigs CRUD","Avoid webhooks that reject cilium.io resources","Monitor operator logs for repeated reconcile failures"],"tags":["kubernetes","cilium","controller-runtime","ingress"],"backgroundTag":"kubernetes-create-or-update-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}