{"record":{"id":"ee6d7dcfba96092e","repo":"cilium/cilium","slug":"failed-to-build-dedicated-resources-w","errorCode":null,"errorMessage":"failed to build dedicated resources: %w","messagePattern":"failed to build dedicated resources: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ingress/ingress_reconcile.go","lineNumber":132,"sourceCode":"\t\tif err := r.tryCleanupDedicatedResources(ctx, req.NamespacedName); err != nil {\n\t\t\treturn controllerruntime.Fail(err)\n\t\t}\n\t}\n\n\t// Update status\n\tscopedLog.DebugContext(ctx, \"Updating Ingress status\")\n\tif err := r.updateIngressLoadbalancerStatus(ctx, ingress); err != nil {\n\t\treturn controllerruntime.Fail(fmt.Errorf(\"failed to update Ingress loadbalancer status: %w\", err))\n\t}\n\n\tscopedLog.InfoContext(ctx, \"Successfully reconciled Ingress\")\n\treturn controllerruntime.Success()\n}\n\nfunc (r *ingressReconciler) createOrUpdateDedicatedResources(ctx context.Context, ingress *networkingv1.Ingress, scopedLog *slog.Logger) error {\n\tdesiredCiliumEnvoyConfig, desiredService, desiredEndpoints, err := r.buildDedicatedResources(ctx, ingress, scopedLog)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to build dedicated resources: %w\", err)\n\t}\n\n\tif err := r.createOrUpdateService(ctx, desiredService); err != nil {\n\t\treturn err\n\t}\n\n\tif err := r.createOrUpdateCiliumEnvoyConfig(ctx, desiredCiliumEnvoyConfig); err != nil {\n\t\treturn err\n\t}\n\n\tif err := r.createOrUpdateEndpoints(ctx, desiredEndpoints); err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// propagateIngressAnnotationsAndLabels propagates Ingress annotation and label if required.","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ingress/ingress_reconcile.go#L114-L150","documentation":"In dedicated loadbalancing mode, createOrUpdateDedicatedResources calls buildDedicatedResources to construct the desired CiliumEnvoyConfig, Service, and Endpoints from the Ingress; if that builder fails, the error is wrapped as 'failed to build dedicated resources: %w'. This means the desired-state objects could not be derived (e.g. invalid Ingress spec), not that applying them failed.","triggerScenarios":"The Ingress spec references a backend Service that cannot be resolved for Endpoints construction, the Ingress has no valid backends/rules (empty or malformed path/backends), the IngressClass it references is missing or not the Cilium one, or TLS secret lookup fails while building the Envoy config.","commonSituations":"User created an Ingress with ingressClassName: cilium but empty rules or a typo'd backend service name; referenced TLS Secret absent in the namespace; Ingress spec using unsupported features (e.g. paths the operator cannot translate to Envoy config); old Ingress objects left after upgrading Cilium and switching modes.","solutions":["Read the wrapped cause in the operator log to see which resource/field failed to build","Validate the Ingress spec: kubectl describe ingress <name> — ensure rules, backends, and the referenced Service exist","Ensure any TLS secrets referenced by the Ingress exist in the same namespace","Confirm ingressClassName points to a valid, existing IngressClass handled by the Cilium operator"],"exampleFix":"// before\nrules:\n- http:\n    paths: []   # empty paths -> nothing to build\n// after\nrules:\n- http:\n    paths:\n    - path: \"/\"\n      pathType: Prefix\n      backend:\n        service:\n          name: my-svc\n          port:\n            number: 80","handlingStrategy":"validation","validationCode":"// validate Ingress before it is admitted to dedicated mode:\nfunc ingressBuildable(ing *networkingv1.Ingress) error {\n    if ing.Spec.DefaultBackend == nil && len(ing.Spec.Rules) == 0 {\n        return errors.New(\"ingress has no rules or default backend\")\n    }\n    for _, r := range ing.Spec.Rules {\n        if r.HTTP == nil { continue }\n        for _, p := range r.HTTP.Paths {\n            if p.Backend.Service == nil || p.Backend.Service.Name == \"\" {\n                return fmt.Errorf(\"path %q has no backend service\", p.Path)\n            }\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate Ingress specs (backends, ports, TLS secrets exist) with admission webhooks or kubeconform in CI","Never create Ingresses with empty rules/backends against ingressClassName: cilium","Keep referenced backend Services and TLS Secrets in place before applying Ingress objects","Check the wrapped builder error first — it names the exact missing field or object"],"tags":["kubernetes","ingress","cilium","resource-builder","envoy"],"backgroundTag":"ingress-resource-build-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}