cilium/cilium · error

failed to create or update Service: %w

Error message

failed to create or update Service: %w

What it means

Wraps an error from controllerutil.CreateOrUpdate when reconciling the load-balancer Service backing a Cilium ingress. The operator creates a dedicated or shared Service of type LoadBalancer for the ingress; failure to Get/Create/Update it produces this wrapped error.

Source

Thrown at operator/pkg/ingress/ingress_reconcile.go:371

	result, err := controllerutil.CreateOrUpdate(ctx, r.client, svc, func() error {
		// Save and restore loadBalancerClass
		// e.g. if a mutating webhook writes this field
		lbClass := svc.Spec.LoadBalancerClass
		svc.Spec = desiredService.Spec
		svc.Spec.LoadBalancerClass = lbClass

		if desiredService.Spec.ExternalTrafficPolicy != "" {
			svc.Spec.ExternalTrafficPolicy = desiredService.Spec.ExternalTrafficPolicy
		}

		svc.OwnerReferences = desiredService.OwnerReferences
		svc.Annotations = mergeMap(svc.Annotations, desiredService.Annotations)
		svc.Labels = mergeMap(svc.Labels, desiredService.Labels)

		return nil
	})
	if err != nil {
		return fmt.Errorf("failed to create or update Service: %w", err)
	}

	r.logger.DebugContext(ctx, fmt.Sprintf("Service %s has been %s", client.ObjectKeyFromObject(svc), result))

	return nil
}

func (r *ingressReconciler) createOrUpdateEndpoints(ctx context.Context, desired *discoveryv1.EndpointSlice) error {
	eps := desired.DeepCopy()

	result, err := controllerutil.CreateOrUpdate(ctx, r.client, eps, func() error {
		eps.Endpoints = desired.Endpoints
		eps.Ports = desired.Ports
		eps.OwnerReferences = desired.OwnerReferences
		eps.Annotations = mergeMap(eps.Annotations, desired.Annotations)
		eps.Labels = mergeMap(eps.Labels, desired.Labels)

		return nil

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped error from operator logs to identify Get vs Create vs Update failure
2. Check namespace Service quota: kubectl describe quota -n <ns>
3. Verify operator RBAC permits create/update on Services
4. Validate the generated Service spec (type LoadBalancer, labels/annotations) against your cluster policies
5. Retry; transient conflicts are resolved on the next reconcile

Example fix

// before: ingress class annotation forcing unsupported lb type
annotations["service.beta.kubernetes.io/aws-load-balancer-type"] = "wrong-type"
// after: only set supported annotations, or remove custom ones
if val, ok := ingress.Annotations["lb-annotation"]; ok && isValid(val) {
    annotations["service.beta.kubernetes.io/aws-load-balancer-type"] = val
}

kubectl auth can-i create services -n <ingress-ns> --as=system:serviceaccount:<ns>:cilium-operator
kubectl get resourcequota -n <ingress-ns>

if err := createOrUpdateService(ctx, ingress, svc); err != nil {
    if apierrors.IsConflict(err) || apierrors.IsTooManyRequests(err) {
        return ctrl.Result{RequeueAfter: time.Second * 5}, nil
    }
    return ctrl.Result{}, fmt.Errorf("lb service reconcile failed: %w", err)
}

When it happens

Trigger: createOrUpdateDedicatedResources calls createOrUpdateService; the Service Get fails (non-NotFound) or Create/Update is rejected (invalid fields, quota, RBAC, webhook).

Common situations: Service quota exceeded in namespace; annotation/label merge producing invalid metadata; LoadBalancer class annotation rejected; missing RBAC on core Services; API connectivity blips.

Related errors

• unable to get clustermesh service %q: %w
• port of service could not be derived, service has no ports
• timeout reached waiting for service %s to appear in Cilium p
• failed to collect Ingresses: %w
• failed to collect IngressClasses: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/7553d491e5fa0e44. Report an issue: GitHub.