{"record":{"id":"9f2559e948204ceb","repo":"cilium/cilium","slug":"failed-to-delete-existing-t-w","errorCode":null,"errorMessage":"failed to delete existing %T: %w","messagePattern":"failed to delete existing %T: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ingress/ingress_reconcile.go","lineNumber":439,"sourceCode":"\tfor _, p := range prefixes {\n\t\tif strings.HasPrefix(s, p) {\n\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n\nfunc (r *ingressReconciler) tryDeletingResource(ctx context.Context, object client.Object, namespacedName types.NamespacedName) error {\n\tif err := r.client.Get(ctx, namespacedName, object); err != nil {\n\t\tif !k8serrors.IsNotFound(err) {\n\t\t\treturn fmt.Errorf(\"failed to get existing %T: %w\", object, err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tif err := r.client.Delete(ctx, object); err != nil {\n\t\treturn fmt.Errorf(\"failed to delete existing %T: %w\", object, err)\n\t}\n\n\treturn nil\n}\n\nfunc (r *ingressReconciler) updateIngressLoadbalancerStatus(ctx context.Context, ingress *networkingv1.Ingress) error {\n\tserviceNamespacedName := types.NamespacedName{}\n\tif r.isEffectiveLoadbalancerModeDedicated(ingress) {\n\t\tserviceNamespacedName.Namespace = ingress.Namespace\n\t\tserviceNamespacedName.Name = shortener.ShortenK8sResourceName(fmt.Sprintf(\"%s-%s\", ciliumIngressPrefix, ingress.Name))\n\t} else {\n\t\tserviceNamespacedName.Namespace = r.ciliumNamespace\n\t\tserviceNamespacedName.Name = r.sharedResourcesName\n\t}\n\n\tloadbalancerService := corev1.Service{}\n\tif err := r.client.Get(ctx, serviceNamespacedName, &loadbalancerService); err != nil {\n\t\tif !k8serrors.IsNotFound(err) {","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ingress/ingress_reconcile.go#L421-L457","documentation":"After a successful Get in tryDeletingResource, the operator issues client.Delete. If the Delete call fails for any reason (finalizers, conflicts, RBAC, connection), it is wrapped as 'failed to delete existing %T'.","triggerScenarios":"tryCleanupDedicatedResources -> tryDeletingResource; client.Delete returns error: object has stuck finalizers, deletion is forbidden by webhook/RBAC, conflict with another controller, or transient API server errors.","commonSituations":"Admission webhooks blocking deletion of CiliumEnvoyConfig; finalizers stuck on Service/CEC leaving objects in Terminating; operator lacking 'delete' verb; namespace already terminating.","solutions":["Check the wrapped cause in operator logs","kubectl get <object> -o yaml and inspect stuck finalizers; remove them if orphaned","Verify operator RBAC includes 'delete' on the resource type","Confirm no admission webhook is rejecting DELETE requests (kubectl get validatingwebhookconfigurations)","If the namespace is terminating, wait for or repair namespace finalization"],"exampleFix":"// before: object stuck in Terminating due to orphaned finalizer\nfinalizers:\n- some.legacy.controller/finalizer\n// after: remove stale finalizer manually\nkubectl patch ciliumenvoyconfig <name> -p '{\"metadata\":{\"finalizers\":[]}}' --type=merge","handlingStrategy":"try-catch","validationCode":"kubectl auth can-i delete services,ciliumenvoyconfigs.cilium.io --as=system:serviceaccount:<ns>:cilium-operator\nkubectl get ciliumenvoyconfigs -A -o jsonpath='{.items[?(@.metadata.deletionTimestamp)].metadata.name}' # stuck objects","typeGuard":null,"tryCatchPattern":"if err := tryDeletingResource(ctx, cec, cecKey); err != nil {\n    if apierrors.IsConflict(err) {\n        return ctrl.Result{RequeueAfter: 5 * time.Second}, nil\n    }\n    log.Error(err, \"delete failed; check finalizers/webhooks\", \"object\", cecKey)\n    return ctrl.Result{}, err\n}","preventionTips":["Avoid installing finalizers on cilium-managed objects","Audit validating webhooks for DELETE rejections","Ensure 'delete' verb in operator RBAC","Alert on objects stuck in Terminating"],"tags":["kubernetes","delete","finalizers","cilium"],"backgroundTag":"kubernetes-delete-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}