cilium/cilium · error

failed to get existing %T: %w

Error message

failed to get existing %T: %w

What it means

tryDeletingResource performs a Get before Delete during cleanup of dedicated ingress resources. If Get fails with anything other than NotFound, the error is wrapped as 'failed to get existing %T'. This is a pre-delete existence check failing, not the delete itself.

Source

Thrown at operator/pkg/ingress/ingress_reconcile.go:433

	}

	return dst
}

func atLeastOnePrefixMatches(s string, prefixes []string) bool {
	for _, p := range prefixes {
		if strings.HasPrefix(s, p) {
			return true
		}
	}

	return false
}

func (r *ingressReconciler) tryDeletingResource(ctx context.Context, object client.Object, namespacedName types.NamespacedName) error {
	if err := r.client.Get(ctx, namespacedName, object); err != nil {
		if !k8serrors.IsNotFound(err) {
			return fmt.Errorf("failed to get existing %T: %w", object, err)
		}
		return nil
	}

	if err := r.client.Delete(ctx, object); err != nil {
		return fmt.Errorf("failed to delete existing %T: %w", object, err)
	}

	return nil
}

func (r *ingressReconciler) updateIngressLoadbalancerStatus(ctx context.Context, ingress *networkingv1.Ingress) error {
	serviceNamespacedName := types.NamespacedName{}
	if r.isEffectiveLoadbalancerModeDedicated(ingress) {
		serviceNamespacedName.Namespace = ingress.Namespace
		serviceNamespacedName.Name = shortener.ShortenK8sResourceName(fmt.Sprintf("%s-%s", ciliumIngressPrefix, ingress.Name))
	} else {
		serviceNamespacedName.Namespace = r.ciliumNamespace

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check operator logs for the wrapped cause (connection vs RBAC vs timeout)
2. Verify operator RBAC can 'get' every resource type used by the ingress class (Service, Endpoints, CEC, ConfigMap)
3. Check API server health: kubectl get --raw=/readyz
4. If it was a transient outage, re-trigger cleanup by updating the ingress or restarting the operator
5. If it happens with a specific %T only, inspect the CRD for that type

Example fix

// before: operator cannot get ciliumenvoyconfigs during cleanup
// after: grant read access in operator ClusterRole
- apiGroups: ["cilium.io"]
  resources: ["ciliumenvoyconfigs"]
  verbs: ["get", "list", "watch", "delete"]

kubectl auth can-i get services,endpoints,ciliumenvoyconfigs.cilium.io --as=system:serviceaccount:<ns>:cilium-operator

err := tryDeletingResource(ctx, &corev1.Service{}, svcKey)
if err != nil {
    if apierrors.IsServerTimeout(err) || isTransient(err) {
        return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
    }
    if apierrors.IsForbidden(err) {
        log.Error(err, "RBAC blocks cleanup Get")
    }
    return ctrl.Result{}, err
}

When it happens

Trigger: tryCleanupDedicatedResources (ingress deletion / class change) calls tryDeletingResource for Service/Endpoints/CEC etc.; client.Get returns a non-NotFound error: API server connection failure, RBAC denial, timeout, or context cancellation.

Common situations: API server temporarily unreachable during cluster upgrade; operator lacks read permission on the object type being cleaned; context deadline exceeded during mass ingress deletions.

Related errors

• failed to delete CiliumEnvoyConfig: %w
• failed to delete existing %T: %w
• failed to delete CiliumCIDRGroup %s: %w
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• pod store outdated

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/bc874cee2200c682. Report an issue: GitHub.