{"record":{"id":"9db631c54d29d02e","repo":"cilium/cilium","slug":"cid-reconciler-failed-to-init-w","errorCode":null,"errorMessage":"cid reconciler failed to init: %w","messagePattern":"cid reconciler failed to init: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"operator/pkg/ciliumidentity/controller.go","lineNumber":225,"sourceCode":"\t\t}))\n\n\twg.Wait()\n\n\twg.Add(1) // Adding cid events\n\n\tc.jobGroup.Add(\n\t\tjob.OneShot(\"proc-cid-events\", func(ctx context.Context, health cell.Health) error {\n\t\t\treturn c.processCiliumIdentityEvents(ctx, wg)\n\t\t}))\n\n\twg.Wait()\n}\n\nfunc (c *Controller) initReconciler(ctx context.Context) error {\n\tvar err error\n\tc.reconciler, err = newReconciler(ctx, c.logger, c.clusterInfo, c.clientset, c.namespace, c.pod, c.ciliumIdentity, c.ciliumEndpoint, c.ciliumEndpointSlice, c.cesEnabled, c)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cid reconciler failed to init: %w\", err)\n\t}\n\tc.logger.InfoContext(ctx, \"Starting CID controller reconciler\")\n\treturn nil\n}\n\nfunc (c *Controller) runResourceWorker(ctx context.Context) error {\n\tc.logger.InfoContext(ctx, \"Starting resource worker\")\n\tdefer c.logger.InfoContext(ctx, \"Stopping resource worker\")\n\n\tgo func() {\n\t\t<-ctx.Done()\n\t\tc.resourceQueue.ShutDown()\n\t}()\n\n\tfor c.processNextItem() {\n\t\tselect {\n\t\tcase <-ctx.Done():\n\t\t\treturn nil","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ciliumidentity/controller.go#L207-L243","documentation":"The CiliumIdentity controller's initReconciler wraps any error from newReconciler (constructing the CID reconciler with its stores and caches). If reconciler construction fails, the whole CID controller cannot start and this wrapped error propagates to the controller's run path. It indicates a startup-time problem, not a per-object reconciliation issue.","triggerScenarios":"newReconciler fails while initializing internal stores/caches for pods, CiliumIdentities, CiliumEndpoints, or CiliumEndpointSlices — typically because a resource store cannot be started or synced (CRD missing, informer start failure).","commonSituations":"cilium.io CRDs (CiliumIdentity, CiliumEndpoint, CiliumEndpointSlice) not installed or wrong version; API server unreachable at operator startup; misconfigured namespace or clusterInfo options.","solutions":["Check operator logs for the unwrapped root cause below this message","Verify all cilium.io CRDs are installed and matching the Cilium version: kubectl get crds | grep cilium.io","Confirm the operator can reach the Kubernetes API at startup (network policy, DNS, kubeconfig)","Ensure ciliumEndpointSlice/ces feature flags match the deployed Cilium agent version and redeploy"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"for (const crd of ['ciliumidentities','ciliumendpoints','ciliumendpointslices']) { await k8sApi.readCustomResourceDefinition(crd + '.cilium.io'); }","typeGuard":"function isInitError(err: unknown): err is { initFailed: true; cause: unknown } { return typeof err === 'object' && err !== null && (err as any).message?.includes('failed to init'); }","tryCatchPattern":"try { await controller.Run(ctx); } catch (err) { if (isInitError(err)) { log.fatal('CID controller init failed — check CRDs and API reachability', err); process.exit(1); } throw err; }","preventionTips":["Install/upgrade cilium.io CRDs in the same Helm invocation as the operator","Verify API server connectivity from the operator pod at startup","Align feature flags (CES enabled) with the agent/operator versions","Crash fast on init errors so orchestrator restarts with clean state"],"tags":["cilium","operator","startup","kubernetes"],"backgroundTag":"controller-init-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}