{"record":{"id":"81a6743fc584d4b1","repo":"kubernetes/kubernetes","slug":"failed-to-create-endpointslice-for-endpoints-s-s","errorCode":null,"errorMessage":"failed to create EndpointSlice for Endpoints %s/%s: %v","messagePattern":"failed to create EndpointSlice for Endpoints (.+?)/(.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/controller/endpointslicemirroring/reconciler.go","lineNumber":259,"sourceCode":"func (r *reconciler) finalize(ctx context.Context, endpoints *corev1.Endpoints, slices slicesByAction) error {\n\t// If there are slices to create and delete, recycle the slices marked for\n\t// deletion by replacing creates with updates of slices that would otherwise\n\t// be deleted.\n\trecycleSlices(&slices)\n\n\tepsClient := r.client.DiscoveryV1().EndpointSlices(endpoints.Namespace)\n\n\t// Don't create more EndpointSlices if corresponding Endpoints resource is\n\t// being deleted.\n\tif endpoints.DeletionTimestamp == nil {\n\t\tfor _, endpointSlice := range slices.toCreate {\n\t\t\tcreatedSlice, err := epsClient.Create(ctx, endpointSlice, metav1.CreateOptions{})\n\t\t\tif err != nil {\n\t\t\t\t// If the namespace is terminating, creates will continue to fail. Simply drop the item.\n\t\t\t\tif errors.HasStatusCause(err, corev1.NamespaceTerminatingCause) {\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn fmt.Errorf(\"failed to create EndpointSlice for Endpoints %s/%s: %v\", endpoints.Namespace, endpoints.Name, err)\n\t\t\t}\n\t\t\tr.endpointSliceTracker.Update(createdSlice)\n\t\t\tmetrics.EndpointSliceChanges.WithLabelValues(\"create\").Inc()\n\t\t}\n\t}\n\n\tfor _, endpointSlice := range slices.toUpdate {\n\t\tupdatedSlice, err := epsClient.Update(ctx, endpointSlice, metav1.UpdateOptions{})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to update %s EndpointSlice for Endpoints %s/%s: %v\", endpointSlice.Name, endpoints.Namespace, endpoints.Name, err)\n\t\t}\n\t\tr.endpointSliceTracker.Update(updatedSlice)\n\t\tmetrics.EndpointSliceChanges.WithLabelValues(\"update\").Inc()\n\t}\n\n\tfor _, endpointSlice := range slices.toDelete {\n\t\terr := epsClient.Delete(ctx, endpointSlice.Name, metav1.DeleteOptions{})\n\t\tif err != nil {","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/pkg/controller/endpointslicemirroring/reconciler.go#L241-L277","documentation":"Returned by finalize() in the reconciler when epsClient.Create() fails to create a new EndpointSlice for a mirrored Endpoints resource. The NamespaceTerminatingCause is already handled separately (returns nil to drop the item). All other create failures — quota exceeded, validation errors, API server unreachable, admission denial — produce this wrapped error. It propagates up through reconcile() to the controller's syncHandler, which returns it to the work queue for exponential-backoff retry.","triggerScenarios":"The reconciler computes desired EndpointSlices from an Endpoints resource and calls DiscoveryV1().EndpointSlices(namespace).Create(). The API server rejects the request for any reason other than namespace terminating — common causes include ResourceQuota limits on EndpointSlices, ValidatingAdmissionWebhook rejection, webhook timeouts, or transient API server 5xx errors.","commonSituations":"Clusters with strict admission webhooks (OPA Gatekeeper, Kyverno) that reject EndpointSlice creation. Clusters under heavy load where the API server returns 429/503. Environments with ResourceQuota objects limiting discovery.k8s.io/endpointslices count.","solutions":["Check the full error message — it includes the underlying API server error which identifies the exact cause (quota, validation, admission).","If the cause is admission webhook denial, review the webhook policy and the EndpointSlice spec that was rejected.","If the cause is ResourceQuota, increase the endpointslices quota or remove unnecessary slices.","If the cause is transient (5xx, timeout), the work queue will retry automatically — monitor whether the error clears on subsequent syncs.","Verify the kube-apiserver is healthy and responsive: kubectl get --raw='/readyz'."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Before creating, verify the namespace is not terminating\n// (the controller already handles this, but for custom controllers:)\nfunc namespaceIsActive(client kubernetes.Interface, namespace string) bool {\n    ns, err := client.CoreV1().Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{})\n    if err != nil {\n        return false\n    }\n    return ns.Status.Phase == corev1.NamespaceActive && ns.DeletionTimestamp == nil\n}","typeGuard":null,"tryCatchPattern":"// The work queue already retries with exponential backoff.\n// For custom code wrapping this controller:\nfunc handleReconcileError(err error) {\n    if errors.HasStatusCause(err, corev1.NamespaceTerminatingCause) {\n        return // expected, drop silently\n    }\n    if apierrors.IsTooManyRequests(err) || apierrors.IsServerTimeout(err) {\n        // transient — will be retried by workqueue\n        return\n    }\n    utilruntime.HandleError(err)\n}","preventionTips":["Ensure ResourceQuota limits accommodate the expected number of EndpointSlices.","Review admission webhook policies that may reject EndpointSlice creation.","Monitor API server health and latency to catch transient failures early.","Verify the controller service account has create permissions on endpointslices.discovery.k8s.io."],"tags":["kubernetes","endpointslice-mirroring","api-server","create","admission","controller"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}