{"record":{"id":"64199732d95d4448","repo":"cilium/cilium","slug":"unable-to-create-ciliumegressgatewaypolicy-s-w","errorCode":null,"errorMessage":"unable to create CiliumEgressGatewayPolicy %s: %w","messagePattern":"unable to create CiliumEgressGatewayPolicy (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/connectivity/check/deployment.go","lineNumber":1250,"sourceCode":"\t\t\t\t\treturn err\n\t\t\t\t}\n\n\t\t\t\tct.testConnDisruptClientL7TrafficDeploymentNames = append(ct.testConnDisruptClientL7TrafficDeploymentNames, clientDeploymentName)\n\t\t\t}\n\t\t} else {\n\t\t\tct.Info(\"Skipping conn-disrupt-test for L7 traffic\")\n\t\t}\n\n\t\tif ct.ShouldRunConnDisruptEgressGateway() {\n\t\t\tgatewayNode, nonGatewayNode, err := ct.getGatewayAndNonGatewayNodes()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tcegp := newConnDisruptCEGP(ct.params.TestNamespace, gatewayNode)\n\t\t\tct.Logf(\"✨ [%s] Deploying %s CiliumEgressGatewayPolicy...\", ct.K8sClient().ClusterName(), cegp.Name)\n\t\t\t_, err = ct.K8sClient().ApplyGeneric(ctx, cegp)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"unable to create CiliumEgressGatewayPolicy %s: %w\", cegp.Name, err)\n\t\t\t}\n\n\t\t\tif err := ct.createTestConnDisruptServerDeployAndSvc(ctx, testConnDisruptServerEgressGatewayDeploymentName, KindTestConnDisruptEgressGateway, 1,\n\t\t\t\ttestConnDisruptEgressGatewayServiceName, testConnDisruptServerEgressGatewayAppLabel, true, newConnDisruptCNPForEgressGateway, \"\"); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tif err := ct.createTestConnDisruptClientDeployment(ctx, testConnDisruptClientEgressGatewayOnGatewayNodeDeploymentName, KindTestConnDisruptEgressGateway,\n\t\t\t\ttestConnDisruptClientEgressGatewayOnGatewayNodeAppLabel, fmt.Sprintf(\"test-conn-disrupt-egw.%s.svc.cluster.local.:8000\", ct.params.TestNamespace),\n\t\t\t\t1, false, map[string]string{\"kubernetes.io/hostname\": gatewayNode}, \"\"); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif err := ct.createTestConnDisruptClientDeployment(ctx, testConnDisruptClientEgressGatewayOnNonGatewayNodeDeploymentName, KindTestConnDisruptEgressGateway,\n\t\t\t\ttestConnDisruptClientEgressGatewayOnNonGatewayNodeAppLabel, fmt.Sprintf(\"test-conn-disrupt-egw.%s.svc.cluster.local.:8000\", ct.params.TestNamespace),\n\t\t\t\t1, false, map[string]string{\"kubernetes.io/hostname\": nonGatewayNode}, \"\"); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tfor _, clientDeploy := range []string{testConnDisruptClientEgressGatewayOnGatewayNodeDeploymentName, testConnDisruptClientEgressGatewayOnNonGatewayNodeDeploymentName} {","sourceCodeStart":1232,"sourceCodeEnd":1268,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/connectivity/check/deployment.go#L1232-L1268","documentation":"Thrown when applying the CiliumEgressGatewayPolicy (CEGP) used by the connection-disruption egress-gateway test fails. The policy is applied via ct.K8sClient().ApplyGeneric, and any apply error is wrapped with the policy name. It means the egress gateway test resources could not be installed.","triggerScenarios":"ApplyGeneric(ctx, newConnDisruptCEGP(ct.params.TestNamespace, gatewayNode)) fails, typically because the CiliumEgressGatewayPolicy CRD is missing (egress gateway not enabled) or the referenced gatewayNode label doesn't match a real node.","commonSituations":"Cilium installed without --enable-ipv4-egress-gateway / egress gateway disabled, so the cilium.io/v2alpha1 CiliumEgressGatewayPolicy CRD does not exist; node selector/labels in the CEGP referencing a non-existent gateway node; running the test on clusters where the CRD schema is older; RBAC denial for the CRD resource.","solutions":["Verify the CiliumEgressGatewayPolicy CRD exists: kubectl get crd ciliumegressgatewaypolicies.cilium.io.","Enable egress gateway in Cilium (helm: --set egressGateway.enabled=true) before running the test.","Confirm the gatewayNode used by newConnDisruptCEGP has matching node labels (kubectl get nodes --show-labels).","Check RBAC allows create/update on cilium.io/v2alpha1 resources.","Skip the egress-gateway test if the feature is intentionally disabled (use --test filters)."],"exampleFix":"// before: CRD missing because egress gateway disabled\n_, err = ct.K8sClient().ApplyGeneric(ctx, cegp)\n// after: enable the feature first\nhelm upgrade cilium cilium/cilium --set egressGateway.enabled=true --reuse-values\n_, err = ct.K8sClient().ApplyGeneric(ctx, cegp)","handlingStrategy":"validation","validationCode":"// verify the CRD and gateway node exist before applying the CEGP\nif _, err := clientset.RESTClient().Get().AbsPath(\"/apis/apiextensions.k8s.io/v1/customresourcedefinitions/ciliumegressgatewaypolicies.cilium.io\").DoRaw(ctx); err != nil {\n  return fmt.Errorf(\"egress gateway CRD not installed: %w\", err)\n}\nnodes, _ := clientset.CoreV1().Nodes().List(ctx, metav1.ListOptions{})\nif len(nodes.Items) == 0 { return fmt.Errorf(\"no nodes for gateway selection\") }","typeGuard":"func crdMissing(err error) bool { return apierrors.IsNotFound(err) || strings.Contains(err.Error(), \"no matches for kind\") }","tryCatchPattern":"if err := applyCEGP(ctx); err != nil {\n  if crdMissing(err) { return fmt.Errorf(\"enable egressGateway in Cilium before this test: %w\", err) }\n  return err\n}","preventionTips":["Enable Cilium egress gateway (CRD) before running egress tests","Confirm the gateway node label referenced by the CEGP exists","Check RBAC for cilium.io/v2alpha1 resources","Skip egress-gateway tests when the feature is intentionally off"],"tags":["kubernetes","cilium-cli","egress-gateway","crd"],"backgroundTag":"k8s-resource-creation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}