{"record":{"id":"fe135314708dbe65","repo":"cilium/cilium","slug":"failed-to-create-ciliumenvoyconfig-for-service-w","errorCode":null,"errorMessage":"failed to create CiliumEnvoyConfig for service: %w","messagePattern":"failed to create CiliumEnvoyConfig for service: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ciliumenvoyconfig/ciliumenvoyconfig_reconcile.go","lineNumber":118,"sourceCode":"\t\t\treturn nil\n\t\t}\n\n\t\t// Update existing CEC\n\t\tupdated := existing.DeepCopy()\n\t\tupdated.Spec = desired.Spec\n\n\t\tscopedLog.DebugContext(ctx, \"Updating CiliumEnvoyConfig\")\n\t\tif err := r.client.Update(ctx, updated); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to update CiliumEnvoyConfig for service: %w\", err)\n\t\t}\n\n\t\tscopedLog.DebugContext(ctx, \"Updated CiliumEnvoyConfig for service\")\n\t\treturn nil\n\t}\n\n\tscopedLog.DebugContext(ctx, \"Creating CiliumEnvoyConfig\")\n\tif err := r.client.Create(ctx, desired); err != nil {\n\t\treturn fmt.Errorf(\"failed to create CiliumEnvoyConfig for service: %w\", err)\n\t}\n\n\tscopedLog.DebugContext(ctx, \"Created CiliumEnvoyConfig for service\")\n\treturn nil\n}\n\nfunc (r *ciliumEnvoyConfigReconciler) deleteEnvoyConfig(ctx context.Context, svc *corev1.Service) error {\n\texisting := ciliumv2.CiliumEnvoyConfig{}\n\tif err := r.client.Get(ctx, types.NamespacedName{Namespace: svc.Namespace, Name: fmt.Sprintf(\"%s-%s\", ciliumEnvoyLBPrefix, svc.Name)}, &existing); err != nil {\n\t\tif !k8serrors.IsNotFound(err) {\n\t\t\treturn fmt.Errorf(\"failed to lookup CiliumEnvoyConfig: %w\", err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tr.logger.DebugContext(ctx, \"Deleting CiliumEnvoyConfig\")\n\tif err := r.client.Delete(ctx, &existing); err != nil {\n\t\treturn fmt.Errorf(\"failed to delete CiliumEnvoyConfig for service: %w\", err)","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ciliumenvoyconfig/ciliumenvoyconfig_reconcile.go#L100-L136","documentation":"This error is returned by the Cilium operator's createOrUpdateEnvoyConfig when the Kubernetes client's Create call for a desired CiliumEnvoyConfig resource fails. The CEC is the resource that configures Envoy load balancing for a service of type LoadBalancer, so this means the operator could not materialize the required Envoy config object. The original API server error is wrapped with %w so it can be inspected with errors.Is/As.","triggerScenarios":"r.client.Create(ctx, desired) returns an error while reconciling a service — e.g. the CiliumEnvoyConfig CRD is not installed, an object with the same name exists with different spec (AlreadyExists race), the namespace is forbidden, or the object exceeds validation limits.","commonSituations":"Cilium Envoy config mode enabled in an older cluster missing the cilium.io CiliumEnvoyConfig CRD; two controllers racing to create the same CEC (AlreadyExists); RBAC denies the operator create on ciliumenvoyconfigs; api-server outage or timeouts during mass service creation.","solutions":["Verify the cilium.io_v2 CRDs (including CiliumEnvoyConfig) are installed and up to date with your Cilium version: kubectl get crd ciliumenvoyconfigs.cilium.io","Check the wrapped error with errors.Is(err, k8serrors.IsAlreadyExists) — if it races with creation, the reconciler will normally retry; ensure no conflicting manually created CEC with the same '<prefix>-<svc>' name exists","Confirm the operator's RBAC/ClusterRole allows create/update on ciliumenvoyconfigs.cilium.io","Check API server connectivity/health (kubectl get, operator logs for throttling) and re-trigger reconciliation"],"exampleFix":"// before\nif err := r.client.Create(ctx, desired); err != nil {\n\treturn fmt.Errorf(\"failed to create CiliumEnvoyConfig for service: %w\", err)\n}\n// after\nerr := r.client.Create(ctx, desired)\nif k8serrors.IsAlreadyExists(err) {\n\tif err := r.client.Update(ctx, desired); err != nil {\n\t\treturn fmt.Errorf(\"failed to update existing CiliumEnvoyConfig: %w\", err)\n\t}\n\treturn nil\n}\nif err != nil {\n\treturn fmt.Errorf(\"failed to create CiliumEnvoyConfig for service: %w\", err)\n}","handlingStrategy":"try-catch","validationCode":"const crd = await k8sApi.getApiResources(); if (!crd.resources.some(r => r.name === 'ciliumenvoyconfigs.cilium.io')) throw new Error('CiliumEnvoyConfig CRD not installed');","typeGuard":"function isStatusError(err: unknown): err is { response?: { statusCode: number }; reason?: string } { return typeof err === 'object' && err !== null && 'response' in err; }","tryCatchPattern":"try { await reconciler.reconcile(svc); } catch (err) { if (k8s.isAlreadyExists(err)) { /* reconcile expected race; safe to retry via controller backoff */ } else { log.error('CEC create failed', err); throw err; } }","preventionTips":["Ensure cilium.io CRDs are installed before deploying the operator","Grant operator RBAC create/update/get on ciliumenvoyconfigs.cilium.io","Treat AlreadyExists as retryable, not fatal","Monitor API server availability during service churn"],"tags":["kubernetes","cilium","operator","crd"],"backgroundTag":"crd-not-installed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}