cilium/cilium · error

failure during TCPRoute checks: %w

Error message

failure during TCPRoute checks: %w

What it means

setTCPRouteStatuses runs common parentRef/reference-grant checks for each TCPRoute before writing status. This error wraps any failure returned by runCommonRouteChecks so SetRouteStatuses reports that TCPRoute processing aborted during the check phase.

Source

Thrown at operator/pkg/gateway-api/status_route.go:383

}

func (m *RouteStatusManager) setTCPRouteStatuses(ctx context.Context, scopedLog *slog.Logger, tcpRoutes []gatewayv1.TCPRoute, grants []gatewayv1.ReferenceGrant) error {
	scopedLog.Debug("Updating TCPRoute statuses for Gateway", numRoutes, len(tcpRoutes))
	for tcpRouteIndex, original := range tcpRoutes {
		tcpr := original.DeepCopy()
		tcpr.Status.Parents = pruneRouteParentStatuses(tcpr.Status.Parents, tcpr.Spec.ParentRefs, m.controllerName)

		i := &routechecks.TCPRouteInput{
			Ctx:            ctx,
			Logger:         scopedLog.With(logfields.TCPRoute, tcpr),
			Client:         m.client,
			Grants:         grants,
			TCPRoute:       tcpr,
			ControllerName: m.controllerName,
		}

		if err := m.runCommonRouteChecks(ctx, i, tcpr.Spec.ParentRefs, tcpr.Namespace); err != nil {
			return fmt.Errorf("failure during TCPRoute checks: %w", err)
		}

		if err := m.updateTCPRouteStatus(ctx, scopedLog, &original, tcpr); err != nil {
			return fmt.Errorf("failed to update TCPRoute status: %w", err)
		}

		tcpRoutes[tcpRouteIndex].Status = tcpr.Status
	}

	return nil
}

func (m *RouteStatusManager) setUDPRouteStatuses(ctx context.Context, scopedLog *slog.Logger, udpRoutes []gatewayv1.UDPRoute, grants []gatewayv1.ReferenceGrant) error {
	scopedLog.Debug("Updating UDPRoute statuses for Gateway", numRoutes, len(udpRoutes))
	for udpRouteIndex, original := range udpRoutes {
		udpr := original.DeepCopy()
		udpr.Status.Parents = pruneRouteParentStatuses(udpr.Status.Parents, udpr.Spec.ParentRefs, m.controllerName)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the wrapped inner error for the root cause
2. Requeue/retry the reconcile for transient API failures
3. Verify parentRefs target an existing Gateway in an allowed namespace
4. Check operator RBAC for reading Gateways and ReferenceGrants

kubectl get gateway -n <ns> && kubectl get referencegrant -A

if err := m.runCommonRouteChecks(ctx, i, tcpr.Spec.ParentRefs, tcpr.Namespace); err != nil {
    logger.Error(err, "tcproute checks failed", "namespace", tcpr.Namespace, "name", tcpr.Name)
    return fmt.Errorf("failure during TCPRoute checks: %w", err)
}

When it happens

Trigger: m.runCommonRouteChecks(ctx, i, tcpr.Spec.ParentRefs, tcpr.Namespace) returns a non-nil error while processing a TCPRoute.

Common situations: Context cancellation mid-reconcile; API errors fetching referenced Gateways or ReferenceGrants; missing/invalid parentRefs pointing at nonexistent Gateways.

Related errors

• failed to update TCPRoute status: %w
• failed to update route status: %w
• failed to update BackendTLSPolicy status: %w
• failure during GRPCRoute checks: %w
• failed to update GRPCRoute status: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/84ccc0c9474d0f42. Report an issue: GitHub.