cilium/cilium · error

failed to update BackendTLSPolicy status: %w

Error message

failed to update BackendTLSPolicy status: %w

What it means

Returned when r.backendTLSPolicyStatusManager.SetBackendTLSPolicyStatuses(...) fails while computing/updating the status of BackendTLSPolicy objects relevant to this Gateway. It maps policies to attached HTTPRoutes and writes their status conditions; failures are typically Kubernetes API errors (RBAC on backendtlspolicies/status, conflict, not-found) encountered during the status write.

Source

Thrown at operator/pkg/gateway-api/gateway_reconcile.go:143

		UDPRoutes:       inputs.UDPRoutes,
		ReferenceGrants: inputs.ReferenceGrants,
	}); err != nil {
		return controllerruntime.Fail(fmt.Errorf("failed to update route status: %w", err))
	}

	// Attached*Routes() relies on route status parents populated by the status
	// update helpers above, so it must only be used after route status has been
	// computed for this reconciliation.

	btlspStatusMap, err := r.backendTLSPolicyStatusManager.SetBackendTLSPolicyStatuses(
		ctx,
		scopedLog,
		req.NamespacedName,
		inputs.BackendTLSPolicies,
		inputs.AttachedHTTPRoutes(gw),
	)
	if err != nil {
		return controllerruntime.Fail(fmt.Errorf("failed to update BackendTLSPolicy status: %w", err))
	}

	listenerStatusResult, err := r.listenerStatusManager.SetListenerStatuses(ctx, gw, ListenerStatusInputs{
		MergedListeners:        inputs.MergedListeners,
		Namespaces:             inputs.Namespaces,
		AttachedListenerSets:   inputs.AttachedListenerSets,
		DisallowedListenerSets: inputs.DisallowedListenerSets,
		HTTPRoutes:             inputs.HTTPRoutes,
		TLSRoutes:              inputs.TLSRoutes,
		GRPCRoutes:             inputs.GRPCRoutes,
		TCPRoutes:              inputs.TCPRoutes,
		UDPRoutes:              inputs.UDPRoutes,
		ReferenceGrants:        inputs.ReferenceGrants,
	})
	if err != nil {
		setGatewayAccepted(gw, false, "Unable to set listener status", gatewayv1.GatewayReasonNoResources)
		setGatewayProgrammed(gw, metav1.ConditionFalse, "Unable to set listener status", gatewayv1.GatewayReasonListenersNotValid)
		return r.handleReconcileErrorWithStatus(ctx, fmt.Errorf("failed to set listener status: %w", err), original, gw)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the wrapped error in operator logs to identify the failing API call (RBAC vs conflict vs not-found).
2. Update Gateway API CRDs to the version matching the Cilium release so BackendTLSPolicy exists.
3. Grant update/patch on backendtlspolicies/status to the operator's ClusterRole.
4. For repeated 409 conflicts, pause/fix competing controllers (e.g. GitOps tooling managing status fields).
5. Verify the BackendTLSPolicy objects still exist; deletion races resolve on requeue.

Example fix

# before: CRDs too old, BackendTLSPolicy missing
# gateway.networking.k8s.io CRDs at an old version
// after: upgrade Gateway API CRDs to the version required by Cilium
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml

// Ensure the CRD and RBAC surface exists before using BackendTLSPolicy with Cilium
kubectl get crd backendtlspolicies.gateway.networking.k8s.io
kubectl auth can-i update backendtlspolicies/status --as=system:serviceaccount:cilium:cilium-operator

When it happens

Trigger: SetBackendTLSPolicyStatuses fails, usually when patching a BackendTLSPolicy status subresource: missing RBAC for backendtlspolicies/status, 409 conflict from concurrent modification, the policy object was deleted mid-reconcile, or the Gateway API CRDs lack the BackendTLSPolicy resource at the expected version.

Common situations: Cilium upgraded to require BackendTLSPolicy but the gateway.networking.k8s.io CRDs were never updated past an older version; RBAC policies scoped narrowly exclude backendtlspolicies/status; a GitOps controller (Argo/Flux) fights with the operator over policy status causing conflicts.

Related errors

• failed to update route status: %w
• failure during GRPCRoute checks: %w
• failed to update GRPCRoute status: %w
• failure during TCPRoute checks: %w
• failed to update TCPRoute status: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/5f283cc281021365. Report an issue: GitHub.