cilium/cilium · error

failed to delete existing %T: %w

Error message

failed to delete existing %T: %w

What it means

After a successful Get in tryDeletingResource, the operator issues client.Delete. If the Delete call fails for any reason (finalizers, conflicts, RBAC, connection), it is wrapped as 'failed to delete existing %T'.

Source

Thrown at operator/pkg/ingress/ingress_reconcile.go:439

	for _, p := range prefixes {
		if strings.HasPrefix(s, p) {
			return true
		}
	}

	return false
}

func (r *ingressReconciler) tryDeletingResource(ctx context.Context, object client.Object, namespacedName types.NamespacedName) error {
	if err := r.client.Get(ctx, namespacedName, object); err != nil {
		if !k8serrors.IsNotFound(err) {
			return fmt.Errorf("failed to get existing %T: %w", object, err)
		}
		return nil
	}

	if err := r.client.Delete(ctx, object); err != nil {
		return fmt.Errorf("failed to delete existing %T: %w", object, err)
	}

	return nil
}

func (r *ingressReconciler) updateIngressLoadbalancerStatus(ctx context.Context, ingress *networkingv1.Ingress) error {
	serviceNamespacedName := types.NamespacedName{}
	if r.isEffectiveLoadbalancerModeDedicated(ingress) {
		serviceNamespacedName.Namespace = ingress.Namespace
		serviceNamespacedName.Name = shortener.ShortenK8sResourceName(fmt.Sprintf("%s-%s", ciliumIngressPrefix, ingress.Name))
	} else {
		serviceNamespacedName.Namespace = r.ciliumNamespace
		serviceNamespacedName.Name = r.sharedResourcesName
	}

	loadbalancerService := corev1.Service{}
	if err := r.client.Get(ctx, serviceNamespacedName, &loadbalancerService); err != nil {
		if !k8serrors.IsNotFound(err) {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the wrapped cause in operator logs
2. kubectl get <object> -o yaml and inspect stuck finalizers; remove them if orphaned
3. Verify operator RBAC includes 'delete' on the resource type
4. Confirm no admission webhook is rejecting DELETE requests (kubectl get validatingwebhookconfigurations)
5. If the namespace is terminating, wait for or repair namespace finalization

Example fix

// before: object stuck in Terminating due to orphaned finalizer
finalizers:
- some.legacy.controller/finalizer
// after: remove stale finalizer manually
kubectl patch ciliumenvoyconfig <name> -p '{"metadata":{"finalizers":[]}}' --type=merge

kubectl auth can-i delete services,ciliumenvoyconfigs.cilium.io --as=system:serviceaccount:<ns>:cilium-operator
kubectl get ciliumenvoyconfigs -A -o jsonpath='{.items[?(@.metadata.deletionTimestamp)].metadata.name}' # stuck objects

if err := tryDeletingResource(ctx, cec, cecKey); err != nil {
    if apierrors.IsConflict(err) {
        return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
    }
    log.Error(err, "delete failed; check finalizers/webhooks", "object", cecKey)
    return ctrl.Result{}, err
}

When it happens

Trigger: tryCleanupDedicatedResources -> tryDeletingResource; client.Delete returns error: object has stuck finalizers, deletion is forbidden by webhook/RBAC, conflict with another controller, or transient API server errors.

Common situations: Admission webhooks blocking deletion of CiliumEnvoyConfig; finalizers stuck on Service/CEC leaving objects in Terminating; operator lacking 'delete' verb; namespace already terminating.

Related errors

• failed to delete CiliumEnvoyConfig: %w
• failed to get existing %T: %w
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• pod store outdated
• unable to update some endpoints with new namespace labels

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/9f2559e948204ceb. Report an issue: GitHub.