cilium/cilium · error

unable to create CiliumEgressGatewayPolicy %s: %w

Error message

unable to create CiliumEgressGatewayPolicy %s: %w

What it means

Thrown when applying the CiliumEgressGatewayPolicy (CEGP) used by the connection-disruption egress-gateway test fails. The policy is applied via ct.K8sClient().ApplyGeneric, and any apply error is wrapped with the policy name. It means the egress gateway test resources could not be installed.

Source

Thrown at cilium-cli/connectivity/check/deployment.go:1250

					return err
				}

				ct.testConnDisruptClientL7TrafficDeploymentNames = append(ct.testConnDisruptClientL7TrafficDeploymentNames, clientDeploymentName)
			}
		} else {
			ct.Info("Skipping conn-disrupt-test for L7 traffic")
		}

		if ct.ShouldRunConnDisruptEgressGateway() {
			gatewayNode, nonGatewayNode, err := ct.getGatewayAndNonGatewayNodes()
			if err != nil {
				return err
			}
			cegp := newConnDisruptCEGP(ct.params.TestNamespace, gatewayNode)
			ct.Logf("✨ [%s] Deploying %s CiliumEgressGatewayPolicy...", ct.K8sClient().ClusterName(), cegp.Name)
			_, err = ct.K8sClient().ApplyGeneric(ctx, cegp)
			if err != nil {
				return fmt.Errorf("unable to create CiliumEgressGatewayPolicy %s: %w", cegp.Name, err)
			}

			if err := ct.createTestConnDisruptServerDeployAndSvc(ctx, testConnDisruptServerEgressGatewayDeploymentName, KindTestConnDisruptEgressGateway, 1,
				testConnDisruptEgressGatewayServiceName, testConnDisruptServerEgressGatewayAppLabel, true, newConnDisruptCNPForEgressGateway, ""); err != nil {
				return err
			}

			if err := ct.createTestConnDisruptClientDeployment(ctx, testConnDisruptClientEgressGatewayOnGatewayNodeDeploymentName, KindTestConnDisruptEgressGateway,
				testConnDisruptClientEgressGatewayOnGatewayNodeAppLabel, fmt.Sprintf("test-conn-disrupt-egw.%s.svc.cluster.local.:8000", ct.params.TestNamespace),
				1, false, map[string]string{"kubernetes.io/hostname": gatewayNode}, ""); err != nil {
				return err
			}
			if err := ct.createTestConnDisruptClientDeployment(ctx, testConnDisruptClientEgressGatewayOnNonGatewayNodeDeploymentName, KindTestConnDisruptEgressGateway,
				testConnDisruptClientEgressGatewayOnNonGatewayNodeAppLabel, fmt.Sprintf("test-conn-disrupt-egw.%s.svc.cluster.local.:8000", ct.params.TestNamespace),
				1, false, map[string]string{"kubernetes.io/hostname": nonGatewayNode}, ""); err != nil {
				return err
			}
			for _, clientDeploy := range []string{testConnDisruptClientEgressGatewayOnGatewayNodeDeploymentName, testConnDisruptClientEgressGatewayOnNonGatewayNodeDeploymentName} {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the CiliumEgressGatewayPolicy CRD exists: kubectl get crd ciliumegressgatewaypolicies.cilium.io.
2. Enable egress gateway in Cilium (helm: --set egressGateway.enabled=true) before running the test.
3. Confirm the gatewayNode used by newConnDisruptCEGP has matching node labels (kubectl get nodes --show-labels).
4. Check RBAC allows create/update on cilium.io/v2alpha1 resources.
5. Skip the egress-gateway test if the feature is intentionally disabled (use --test filters).

Example fix

// before: CRD missing because egress gateway disabled
_, err = ct.K8sClient().ApplyGeneric(ctx, cegp)
// after: enable the feature first
helm upgrade cilium cilium/cilium --set egressGateway.enabled=true --reuse-values
_, err = ct.K8sClient().ApplyGeneric(ctx, cegp)

// verify the CRD and gateway node exist before applying the CEGP
if _, err := clientset.RESTClient().Get().AbsPath("/apis/apiextensions.k8s.io/v1/customresourcedefinitions/ciliumegressgatewaypolicies.cilium.io").DoRaw(ctx); err != nil {
  return fmt.Errorf("egress gateway CRD not installed: %w", err)
}
nodes, _ := clientset.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
if len(nodes.Items) == 0 { return fmt.Errorf("no nodes for gateway selection") }

func crdMissing(err error) bool { return apierrors.IsNotFound(err) || strings.Contains(err.Error(), "no matches for kind") }

if err := applyCEGP(ctx); err != nil {
  if crdMissing(err) { return fmt.Errorf("enable egressGateway in Cilium before this test: %w", err) }
  return err
}

When it happens

Trigger: ApplyGeneric(ctx, newConnDisruptCEGP(ct.params.TestNamespace, gatewayNode)) fails, typically because the CiliumEgressGatewayPolicy CRD is missing (egress gateway not enabled) or the referenced gatewayNode label doesn't match a real node.

Common situations: Cilium installed without --enable-ipv4-egress-gateway / egress gateway disabled, so the cilium.io/v2alpha1 CiliumEgressGatewayPolicy CRD does not exist; node selector/labels in the CEGP referencing a non-existent gateway node; running the test on clusters where the CRD schema is older; RBAC denial for the CRD resource.

Related errors

• Error listing Cilium network policies: %w
• unable to list CiliumNodes: %w
• unable to list Cilium pods: %w
• failed to fetch bgp state from %s: %w
• failed to create sysdump collector: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/64199732d95d4448. Report an issue: GitHub.