kubernetes/kubernetes · error

failed to create EndpointSlice for Endpoints %s/%s: %v

Error message

failed to create EndpointSlice for Endpoints %s/%s: %v

What it means

Returned by finalize() in the reconciler when epsClient.Create() fails to create a new EndpointSlice for a mirrored Endpoints resource. The NamespaceTerminatingCause is already handled separately (returns nil to drop the item). All other create failures — quota exceeded, validation errors, API server unreachable, admission denial — produce this wrapped error. It propagates up through reconcile() to the controller's syncHandler, which returns it to the work queue for exponential-backoff retry.

Source

Thrown at pkg/controller/endpointslicemirroring/reconciler.go:259

func (r *reconciler) finalize(ctx context.Context, endpoints *corev1.Endpoints, slices slicesByAction) error {
	// If there are slices to create and delete, recycle the slices marked for
	// deletion by replacing creates with updates of slices that would otherwise
	// be deleted.
	recycleSlices(&slices)

	epsClient := r.client.DiscoveryV1().EndpointSlices(endpoints.Namespace)

	// Don't create more EndpointSlices if corresponding Endpoints resource is
	// being deleted.
	if endpoints.DeletionTimestamp == nil {
		for _, endpointSlice := range slices.toCreate {
			createdSlice, err := epsClient.Create(ctx, endpointSlice, metav1.CreateOptions{})
			if err != nil {
				// If the namespace is terminating, creates will continue to fail. Simply drop the item.
				if errors.HasStatusCause(err, corev1.NamespaceTerminatingCause) {
					return nil
				}
				return fmt.Errorf("failed to create EndpointSlice for Endpoints %s/%s: %v", endpoints.Namespace, endpoints.Name, err)
			}
			r.endpointSliceTracker.Update(createdSlice)
			metrics.EndpointSliceChanges.WithLabelValues("create").Inc()
		}
	}

	for _, endpointSlice := range slices.toUpdate {
		updatedSlice, err := epsClient.Update(ctx, endpointSlice, metav1.UpdateOptions{})
		if err != nil {
			return fmt.Errorf("failed to update %s EndpointSlice for Endpoints %s/%s: %v", endpointSlice.Name, endpoints.Namespace, endpoints.Name, err)
		}
		r.endpointSliceTracker.Update(updatedSlice)
		metrics.EndpointSliceChanges.WithLabelValues("update").Inc()
	}

	for _, endpointSlice := range slices.toDelete {
		err := epsClient.Delete(ctx, endpointSlice.Name, metav1.DeleteOptions{})
		if err != nil {

View on GitHub (pinned to b882c60b40)

Solutions

  1. Check the full error message — it includes the underlying API server error which identifies the exact cause (quota, validation, admission).
  2. If the cause is admission webhook denial, review the webhook policy and the EndpointSlice spec that was rejected.
  3. If the cause is ResourceQuota, increase the endpointslices quota or remove unnecessary slices.
  4. If the cause is transient (5xx, timeout), the work queue will retry automatically — monitor whether the error clears on subsequent syncs.
  5. Verify the kube-apiserver is healthy and responsive: kubectl get --raw='/readyz'.
Defensive patterns

Strategy: retry

Validate before calling

// Before creating, verify the namespace is not terminating
// (the controller already handles this, but for custom controllers:)
func namespaceIsActive(client kubernetes.Interface, namespace string) bool {
    ns, err := client.CoreV1().Namespaces().Get(context.TODO(), namespace, metav1.GetOptions{})
    if err != nil {
        return false
    }
    return ns.Status.Phase == corev1.NamespaceActive && ns.DeletionTimestamp == nil
}

Try / catch

// The work queue already retries with exponential backoff.
// For custom code wrapping this controller:
func handleReconcileError(err error) {
    if errors.HasStatusCause(err, corev1.NamespaceTerminatingCause) {
        return // expected, drop silently
    }
    if apierrors.IsTooManyRequests(err) || apierrors.IsServerTimeout(err) {
        // transient — will be retried by workqueue
        return
    }
    utilruntime.HandleError(err)
}

Prevention

When it happens

Trigger: The reconciler computes desired EndpointSlices from an Endpoints resource and calls DiscoveryV1().EndpointSlices(namespace).Create(). The API server rejects the request for any reason other than namespace terminating — common causes include ResourceQuota limits on EndpointSlices, ValidatingAdmissionWebhook rejection, webhook timeouts, or transient API server 5xx errors.

Common situations: Clusters with strict admission webhooks (OPA Gatekeeper, Kyverno) that reject EndpointSlice creation. Clusters under heavy load where the API server returns 429/503. Environments with ResourceQuota objects limiting discovery.k8s.io/endpointslices count.

Related errors

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/81a6743fc584d4b1. Report an issue: GitHub.