cilium/cilium · error

failed to build dedicated resources: %w

Error message

failed to build dedicated resources: %w

What it means

In dedicated loadbalancing mode, createOrUpdateDedicatedResources calls buildDedicatedResources to construct the desired CiliumEnvoyConfig, Service, and Endpoints from the Ingress; if that builder fails, the error is wrapped as 'failed to build dedicated resources: %w'. This means the desired-state objects could not be derived (e.g. invalid Ingress spec), not that applying them failed.

Source

Thrown at operator/pkg/ingress/ingress_reconcile.go:132

		if err := r.tryCleanupDedicatedResources(ctx, req.NamespacedName); err != nil {
			return controllerruntime.Fail(err)
		}
	}

	// Update status
	scopedLog.DebugContext(ctx, "Updating Ingress status")
	if err := r.updateIngressLoadbalancerStatus(ctx, ingress); err != nil {
		return controllerruntime.Fail(fmt.Errorf("failed to update Ingress loadbalancer status: %w", err))
	}

	scopedLog.InfoContext(ctx, "Successfully reconciled Ingress")
	return controllerruntime.Success()
}

func (r *ingressReconciler) createOrUpdateDedicatedResources(ctx context.Context, ingress *networkingv1.Ingress, scopedLog *slog.Logger) error {
	desiredCiliumEnvoyConfig, desiredService, desiredEndpoints, err := r.buildDedicatedResources(ctx, ingress, scopedLog)
	if err != nil {
		return fmt.Errorf("failed to build dedicated resources: %w", err)
	}

	if err := r.createOrUpdateService(ctx, desiredService); err != nil {
		return err
	}

	if err := r.createOrUpdateCiliumEnvoyConfig(ctx, desiredCiliumEnvoyConfig); err != nil {
		return err
	}

	if err := r.createOrUpdateEndpoints(ctx, desiredEndpoints); err != nil {
		return err
	}

	return nil
}

// propagateIngressAnnotationsAndLabels propagates Ingress annotation and label if required.

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped cause in the operator log to see which resource/field failed to build
2. Validate the Ingress spec: kubectl describe ingress <name> — ensure rules, backends, and the referenced Service exist
3. Ensure any TLS secrets referenced by the Ingress exist in the same namespace
4. Confirm ingressClassName points to a valid, existing IngressClass handled by the Cilium operator

Example fix

// before
rules:
- http:
    paths: []   # empty paths -> nothing to build
// after
rules:
- http:
    paths:
    - path: "/"
      pathType: Prefix
      backend:
        service:
          name: my-svc
          port:
            number: 80

// validate Ingress before it is admitted to dedicated mode:
func ingressBuildable(ing *networkingv1.Ingress) error {
    if ing.Spec.DefaultBackend == nil && len(ing.Spec.Rules) == 0 {
        return errors.New("ingress has no rules or default backend")
    }
    for _, r := range ing.Spec.Rules {
        if r.HTTP == nil { continue }
        for _, p := range r.HTTP.Paths {
            if p.Backend.Service == nil || p.Backend.Service.Name == "" {
                return fmt.Errorf("path %q has no backend service", p.Path)
            }
        }
    }
    return nil
}

When it happens

Trigger: The Ingress spec references a backend Service that cannot be resolved for Endpoints construction, the Ingress has no valid backends/rules (empty or malformed path/backends), the IngressClass it references is missing or not the Cilium one, or TLS secret lookup fails while building the Envoy config.

Common situations: User created an Ingress with ingressClassName: cilium but empty rules or a typo'd backend service name; referenced TLS Secret absent in the namespace; Ingress spec using unsupported features (e.g. paths the operator cannot translate to Envoy config); old Ingress objects left after upgrading Cilium and switching modes.

Related errors

• failed to build shared resources: %w
• failed to collect Ingresses: %w
• failed to collect IngressClasses: %w
• unable to allocate ingress IPs: %w, see https://cilium.link/
• failed to get CiliumEnvoyConfig for service: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/ee6d7dcfba96092e. Report an issue: GitHub.