{"record":{"id":"5f283cc281021365","repo":"cilium/cilium","slug":"failed-to-update-backendtlspolicy-status-w","errorCode":null,"errorMessage":"failed to update BackendTLSPolicy status: %w","messagePattern":"failed to update BackendTLSPolicy status: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/gateway-api/gateway_reconcile.go","lineNumber":143,"sourceCode":"\t\tUDPRoutes:       inputs.UDPRoutes,\n\t\tReferenceGrants: inputs.ReferenceGrants,\n\t}); err != nil {\n\t\treturn controllerruntime.Fail(fmt.Errorf(\"failed to update route status: %w\", err))\n\t}\n\n\t// Attached*Routes() relies on route status parents populated by the status\n\t// update helpers above, so it must only be used after route status has been\n\t// computed for this reconciliation.\n\n\tbtlspStatusMap, err := r.backendTLSPolicyStatusManager.SetBackendTLSPolicyStatuses(\n\t\tctx,\n\t\tscopedLog,\n\t\treq.NamespacedName,\n\t\tinputs.BackendTLSPolicies,\n\t\tinputs.AttachedHTTPRoutes(gw),\n\t)\n\tif err != nil {\n\t\treturn controllerruntime.Fail(fmt.Errorf(\"failed to update BackendTLSPolicy status: %w\", err))\n\t}\n\n\tlistenerStatusResult, err := r.listenerStatusManager.SetListenerStatuses(ctx, gw, ListenerStatusInputs{\n\t\tMergedListeners:        inputs.MergedListeners,\n\t\tNamespaces:             inputs.Namespaces,\n\t\tAttachedListenerSets:   inputs.AttachedListenerSets,\n\t\tDisallowedListenerSets: inputs.DisallowedListenerSets,\n\t\tHTTPRoutes:             inputs.HTTPRoutes,\n\t\tTLSRoutes:              inputs.TLSRoutes,\n\t\tGRPCRoutes:             inputs.GRPCRoutes,\n\t\tTCPRoutes:              inputs.TCPRoutes,\n\t\tUDPRoutes:              inputs.UDPRoutes,\n\t\tReferenceGrants:        inputs.ReferenceGrants,\n\t})\n\tif err != nil {\n\t\tsetGatewayAccepted(gw, false, \"Unable to set listener status\", gatewayv1.GatewayReasonNoResources)\n\t\tsetGatewayProgrammed(gw, metav1.ConditionFalse, \"Unable to set listener status\", gatewayv1.GatewayReasonListenersNotValid)\n\t\treturn r.handleReconcileErrorWithStatus(ctx, fmt.Errorf(\"failed to set listener status: %w\", err), original, gw)","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/gateway-api/gateway_reconcile.go#L125-L161","documentation":"Returned when r.backendTLSPolicyStatusManager.SetBackendTLSPolicyStatuses(...) fails while computing/updating the status of BackendTLSPolicy objects relevant to this Gateway. It maps policies to attached HTTPRoutes and writes their status conditions; failures are typically Kubernetes API errors (RBAC on backendtlspolicies/status, conflict, not-found) encountered during the status write.","triggerScenarios":"SetBackendTLSPolicyStatuses fails, usually when patching a BackendTLSPolicy status subresource: missing RBAC for backendtlspolicies/status, 409 conflict from concurrent modification, the policy object was deleted mid-reconcile, or the Gateway API CRDs lack the BackendTLSPolicy resource at the expected version.","commonSituations":"Cilium upgraded to require BackendTLSPolicy but the gateway.networking.k8s.io CRDs were never updated past an older version; RBAC policies scoped narrowly exclude backendtlspolicies/status; a GitOps controller (Argo/Flux) fights with the operator over policy status causing conflicts.","solutions":["Check the wrapped error in operator logs to identify the failing API call (RBAC vs conflict vs not-found).","Update Gateway API CRDs to the version matching the Cilium release so BackendTLSPolicy exists.","Grant update/patch on backendtlspolicies/status to the operator's ClusterRole.","For repeated 409 conflicts, pause/fix competing controllers (e.g. GitOps tooling managing status fields).","Verify the BackendTLSPolicy objects still exist; deletion races resolve on requeue."],"exampleFix":"# before: CRDs too old, BackendTLSPolicy missing\n# gateway.networking.k8s.io CRDs at an old version\n// after: upgrade Gateway API CRDs to the version required by Cilium\nkubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml","handlingStrategy":"validation","validationCode":"// Ensure the CRD and RBAC surface exists before using BackendTLSPolicy with Cilium\nkubectl get crd backendtlspolicies.gateway.networking.k8s.io\nkubectl auth can-i update backendtlspolicies/status --as=system:serviceaccount:cilium:cilium-operator","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Upgrade Gateway API CRDs whenever upgrading Cilium.","Include backendtlspolicies/status in the operator's RBAC verbs.","Do not let GitOps tooling own the .status field of policies (server-side apply conflicts).","Use kubectl wait on policy conditions after applying to confirm status writes succeed."],"tags":["kubernetes","gateway-api","backendtlspolicy","status-update"],"backgroundTag":"kubernetes-status-update-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}