{"record":{"id":"7553d491e5fa0e44","repo":"cilium/cilium","slug":"failed-to-create-or-update-service-w","errorCode":null,"errorMessage":"failed to create or update Service: %w","messagePattern":"failed to create or update Service: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ingress/ingress_reconcile.go","lineNumber":371,"sourceCode":"\tresult, err := controllerutil.CreateOrUpdate(ctx, r.client, svc, func() error {\n\t\t// Save and restore loadBalancerClass\n\t\t// e.g. if a mutating webhook writes this field\n\t\tlbClass := svc.Spec.LoadBalancerClass\n\t\tsvc.Spec = desiredService.Spec\n\t\tsvc.Spec.LoadBalancerClass = lbClass\n\n\t\tif desiredService.Spec.ExternalTrafficPolicy != \"\" {\n\t\t\tsvc.Spec.ExternalTrafficPolicy = desiredService.Spec.ExternalTrafficPolicy\n\t\t}\n\n\t\tsvc.OwnerReferences = desiredService.OwnerReferences\n\t\tsvc.Annotations = mergeMap(svc.Annotations, desiredService.Annotations)\n\t\tsvc.Labels = mergeMap(svc.Labels, desiredService.Labels)\n\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create or update Service: %w\", err)\n\t}\n\n\tr.logger.DebugContext(ctx, fmt.Sprintf(\"Service %s has been %s\", client.ObjectKeyFromObject(svc), result))\n\n\treturn nil\n}\n\nfunc (r *ingressReconciler) createOrUpdateEndpoints(ctx context.Context, desired *discoveryv1.EndpointSlice) error {\n\teps := desired.DeepCopy()\n\n\tresult, err := controllerutil.CreateOrUpdate(ctx, r.client, eps, func() error {\n\t\teps.Endpoints = desired.Endpoints\n\t\teps.Ports = desired.Ports\n\t\teps.OwnerReferences = desired.OwnerReferences\n\t\teps.Annotations = mergeMap(eps.Annotations, desired.Annotations)\n\t\teps.Labels = mergeMap(eps.Labels, desired.Labels)\n\n\t\treturn nil","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ingress/ingress_reconcile.go#L353-L389","documentation":"Wraps an error from controllerutil.CreateOrUpdate when reconciling the load-balancer Service backing a Cilium ingress. The operator creates a dedicated or shared Service of type LoadBalancer for the ingress; failure to Get/Create/Update it produces this wrapped error.","triggerScenarios":"createOrUpdateDedicatedResources calls createOrUpdateService; the Service Get fails (non-NotFound) or Create/Update is rejected (invalid fields, quota, RBAC, webhook).","commonSituations":"Service quota exceeded in namespace; annotation/label merge producing invalid metadata; LoadBalancer class annotation rejected; missing RBAC on core Services; API connectivity blips.","solutions":["Read the wrapped error from operator logs to identify Get vs Create vs Update failure","Check namespace Service quota: kubectl describe quota -n <ns>","Verify operator RBAC permits create/update on Services","Validate the generated Service spec (type LoadBalancer, labels/annotations) against your cluster policies","Retry; transient conflicts are resolved on the next reconcile"],"exampleFix":"// before: ingress class annotation forcing unsupported lb type\nannotations[\"service.beta.kubernetes.io/aws-load-balancer-type\"] = \"wrong-type\"\n// after: only set supported annotations, or remove custom ones\nif val, ok := ingress.Annotations[\"lb-annotation\"]; ok && isValid(val) {\n    annotations[\"service.beta.kubernetes.io/aws-load-balancer-type\"] = val\n}","handlingStrategy":"try-catch","validationCode":"kubectl auth can-i create services -n <ingress-ns> --as=system:serviceaccount:<ns>:cilium-operator\nkubectl get resourcequota -n <ingress-ns>","typeGuard":null,"tryCatchPattern":"if err := createOrUpdateService(ctx, ingress, svc); err != nil {\n    if apierrors.IsConflict(err) || apierrors.IsTooManyRequests(err) {\n        return ctrl.Result{RequeueAfter: time.Second * 5}, nil\n    }\n    return ctrl.Result{}, fmt.Errorf(\"lb service reconcile failed: %w\", err)\n}","preventionTips":["Check Service quotas in target namespaces","Grant Services CRUD to operator ServiceAccount","Avoid unsupported load-balancer annotations in ingress config","Requeue on conflict errors instead of crashing"],"tags":["kubernetes","service","ingress","cilium"],"backgroundTag":"kubernetes-create-or-update-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}