cilium/cilium · critical

cid reconciler failed to init: %w

Error message

cid reconciler failed to init: %w

What it means

The CiliumIdentity controller's initReconciler wraps any error from newReconciler (constructing the CID reconciler with its stores and caches). If reconciler construction fails, the whole CID controller cannot start and this wrapped error propagates to the controller's run path. It indicates a startup-time problem, not a per-object reconciliation issue.

Source

Thrown at operator/pkg/ciliumidentity/controller.go:225

		}))

	wg.Wait()

	wg.Add(1) // Adding cid events

	c.jobGroup.Add(
		job.OneShot("proc-cid-events", func(ctx context.Context, health cell.Health) error {
			return c.processCiliumIdentityEvents(ctx, wg)
		}))

	wg.Wait()
}

func (c *Controller) initReconciler(ctx context.Context) error {
	var err error
	c.reconciler, err = newReconciler(ctx, c.logger, c.clusterInfo, c.clientset, c.namespace, c.pod, c.ciliumIdentity, c.ciliumEndpoint, c.ciliumEndpointSlice, c.cesEnabled, c)
	if err != nil {
		return fmt.Errorf("cid reconciler failed to init: %w", err)
	}
	c.logger.InfoContext(ctx, "Starting CID controller reconciler")
	return nil
}

func (c *Controller) runResourceWorker(ctx context.Context) error {
	c.logger.InfoContext(ctx, "Starting resource worker")
	defer c.logger.InfoContext(ctx, "Stopping resource worker")

	go func() {
		<-ctx.Done()
		c.resourceQueue.ShutDown()
	}()

	for c.processNextItem() {
		select {
		case <-ctx.Done():
			return nil

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check operator logs for the unwrapped root cause below this message
2. Verify all cilium.io CRDs are installed and matching the Cilium version: kubectl get crds | grep cilium.io
3. Confirm the operator can reach the Kubernetes API at startup (network policy, DNS, kubeconfig)
4. Ensure ciliumEndpointSlice/ces feature flags match the deployed Cilium agent version and redeploy

for (const crd of ['ciliumidentities','ciliumendpoints','ciliumendpointslices']) { await k8sApi.readCustomResourceDefinition(crd + '.cilium.io'); }

function isInitError(err: unknown): err is { initFailed: true; cause: unknown } { return typeof err === 'object' && err !== null && (err as any).message?.includes('failed to init'); }

try { await controller.Run(ctx); } catch (err) { if (isInitError(err)) { log.fatal('CID controller init failed — check CRDs and API reachability', err); process.exit(1); } throw err; }

When it happens

Trigger: newReconciler fails while initializing internal stores/caches for pods, CiliumIdentities, CiliumEndpoints, or CiliumEndpointSlices — typically because a resource store cannot be started or synced (CRD missing, informer start failure).

Common situations: cilium.io CRDs (CiliumIdentity, CiliumEndpoint, CiliumEndpointSlice) not installed or wrong version; API server unreachable at operator startup; misconfigured namespace or clusterInfo options.

Related errors

• ⚠️ unable to restart Cilium Operator pods: %w
• failed to get features status from %s: %w
• failed to collect cilium-operator gops stats: %w
• failed to detect Cilium operator namespace: %w
• failed to check for Cilium operator Deployment: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/9db631c54d29d02e. Report an issue: GitHub.