cilium/cilium · error

failed to create or update CiliumEnvoyConfig: %w

Error message

failed to create or update CiliumEnvoyConfig: %w

What it means

This error wraps the underlying error returned by controller-runtime's CreateOrUpdate during the CreateOrUpdateCEC controller-runtime retry.EscalatingVerbosity loop (controllerutil.CreateOrUpdate) for a CiliumEnvoyConfig resource. Cilium's ingress operator creates/updates CEC objects to configure Envoy routing for ingress traffic. It fires whenever create-or-update of the CEC fails for any reason (API server rejection, conflict, RBAC, invalid spec).

Source

Thrown at operator/pkg/ingress/ingress_reconcile.go:342

	// Otherwise, the subsequent CreateOrUpdate will fail as spec.resources is required field.
	if len(cec.Spec.Resources) == 0 {
		err := r.client.Delete(ctx, cec)
		if err != nil && !k8serrors.IsNotFound(err) {
			return fmt.Errorf("failed to delete CiliumEnvoyConfig: %w", err)
		}
		return nil
	}

	result, err := controllerutil.CreateOrUpdate(ctx, r.client, cec, func() error {
		cec.Spec = desiredCEC.Spec
		cec.OwnerReferences = desiredCEC.OwnerReferences
		cec.Annotations = mergeMap(cec.Annotations, desiredCEC.Annotations)
		cec.Labels = mergeMap(cec.Labels, desiredCEC.Labels)

		return nil
	})
	if err != nil {
		return fmt.Errorf("failed to create or update CiliumEnvoyConfig: %w", err)
	}

	r.logger.DebugContext(ctx, fmt.Sprintf("CiliumEnvoyConfig %s has been %s", client.ObjectKeyFromObject(cec), result))

	return nil
}

func (r *ingressReconciler) createOrUpdateService(ctx context.Context, desiredService *corev1.Service) error {
	svc := desiredService.DeepCopy()

	result, err := controllerutil.CreateOrUpdate(ctx, r.client, svc, func() error {
		// Save and restore loadBalancerClass
		// e.g. if a mutating webhook writes this field
		lbClass := svc.Spec.LoadBalancerClass
		svc.Spec = desiredService.Spec
		svc.Spec.LoadBalancerClass = lbClass

		if desiredService.Spec.ExternalTrafficPolicy != "" {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the wrapped cause (%w chain) with `kubectl logs` on the cilium-operator to see whether it's RBAC, validation, or connection error
2. Verify CRDs are installed: kubectl get crd ciliumenvoyconfigs.cilium.io
3. Check the operator's ClusterRole allows get/create/update/patch on ciliumenvoyconfigs
4. Validate the Envoy config fields produced (annotations like io.cilium.ingress) match CRD schema
5. Re-run reconcile; CreateOrUpdate is idempotent and transient conflicts resolve on retry

Example fix

// before: CEC spec fields not present in installed CRD version
cec.Spec.ExternalListeners = desiredCEC.ExternalListeners
// after: guard against nil/unsupported fields and ensure CRD up to date
if desiredCEC.Spec.Resources != nil {
    cec.Spec.Resources = desiredCEC.Spec.Resources
}
// and upgrade cilium CRDs: kubectl apply -f cilium-crds.yaml

kubectl get crd ciliumenvoyconfigs.cilium.io && kubectl auth can-i create ciliumenvoyconfigs.cilium.io --as=system:serviceaccount:<ns>:cilium-operator

err := createOrUpdateCiliumEnvoyConfig(ctx, ingress, cec)
if err != nil {
    // inspect wrapped cause
    log.Error(err, "CEC create/update failed")
    var apiErr *apierrors.StatusError
    if errors.As(err, &apiErr) {
        log.Info("reason", "reason", apiErr.ErrStatus.Reason, "msg", apiErr.ErrStatus.Message)
    }
    return ctrl.Result{RequeueAfter: 30 * time.Second}, err
}

When it happens

Trigger: createOrUpdateDedicatedResources or createOrUpdateSharedResources calls createOrUpdateCiliumEnvoyConfig; controllerutil.CreateOrUpdate returns an error from Get, Create, or Update of the CiliumEnvoyConfig (e.g. mutation rejected by webhook, RBAC denied, context cancelled, API server unreachable).

Common situations: Missing RBAC permissions on cilium.io/ciliumenvoyconfigs; a validating webhook rejecting the desired Envoy config; invalid spec (bad listeners/filters) rejected by API server; concurrent controllers conflicting during shared-ingress mode; CRD ciliumenvoyconfigs not installed.

Related errors

• failed to collect Ingresses: %w
• failed to collect IngressClasses: %w
• failed to set owner reference: %w
• failed to add types from %s to scheme: %w
• failed to parse annotation value for %q: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4582f18336511a43. Report an issue: GitHub.