{"record":{"id":"15d07c933e57aea0","repo":"cilium/cilium","slug":"not-allowed-to-add-generated-labels-s","errorCode":null,"errorMessage":"not allowed to add generated labels: %s","messagePattern":"not allowed to add generated labels: (.+?)","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/endpoint/api/endpoint_api_manager.go","lineNumber":189,"sourceCode":"\t\t\treturn invalidDataError(ep, err)\n\t\t} else if oldEp != nil {\n\t\t\treturn invalidDataError(ep, fmt.Errorf(\"IP %s is already in use\", id))\n\t\t}\n\t}\n\n\tif err = endpoint.APICanModify(ep); err != nil {\n\t\treturn invalidDataError(ep, err)\n\t}\n\n\tinfoLabels := labels.NewLabelsFromModel([]string{})\n\n\tif len(apiLabels) > 0 {\n\t\tif lbls := apiLabels.FindReserved(); lbls != nil {\n\t\t\treturn invalidDataError(ep, fmt.Errorf(\"not allowed to add reserved labels: %s\", lbls))\n\t\t}\n\n\t\tif apiLabels.IsGenerated() {\n\t\t\treturn invalidDataError(ep, fmt.Errorf(\"not allowed to add generated labels: %s\", apiLabels))\n\t\t}\n\n\t\tapiLabels, _ = labelsfilter.Filter(apiLabels)\n\t\tif len(apiLabels) == 0 {\n\t\t\treturn invalidDataError(ep, fmt.Errorf(\"no valid labels provided\"))\n\t\t}\n\t}\n\n\tvar cancel context.CancelFunc\n\tctx, cancel = context.WithCancel(ctx)\n\tm.endpointCreations.NewCreateRequest(ep, cancel)\n\tdefer m.endpointCreations.EndCreateRequest(ep)\n\n\tidentityLbls := maps.Clone(apiLabels)\n\n\tif ep.K8sNamespaceAndPodNameIsSet() && m.clientset.IsEnabled() {\n\t\tpod, k8sMetadata, err := m.handleOutdatedPodInformer(ctx, ep)\n\t\tif errors.Is(err, endpointmetadata.ErrPodStoreOutdated) {","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/endpoint/api/endpoint_api_manager.go#L171-L207","documentation":"Labels with the 'generated:' source (e.g. 'k8s:' auto-derived or plugin-generated labels) are owned by Cilium's label injection pipeline, not by API clients. CreateEndpoint rejects create requests whose labels are marked generated, since clients must not supply identities that look like they were produced by Cilium itself.","triggerScenarios":"POST /endpoints where apiLabels.IsGenerated() is true — i.e. the label set consists of labels carrying the generated source ('generated:*' or labels produced by Cilium's orchestrator filters).","commonSituations":"Client copies identity labels from another endpoint's resolved identity into a create call; automation that materializes 'k8s:...' style labels manually into the endpoint model.","solutions":["Remove generated:* labels from the request; send only user-supplied labels.","Use the K8s namespace/pod name fields so Cilium fetches real orchestrator labels itself (handleOutdatedPodInformer / metadata resolver path).","If you need k8s-derived labels, pass k8s: labels via the pod object, not the endpoint create model."],"exampleFix":"// before\nep.Labels = endpoint.Status.Identity.Labels // generated/k8s labels\n// after\nep.Labels = []string{\"my-app:frontend\"} // user labels only","handlingStrategy":"validation","validationCode":"func stripGeneratedAndReserved(ls []string) []string {\n    var out []string\n    for _, l := range ls {\n        if !strings.HasPrefix(l, \"reserved:\") && !strings.HasPrefix(l, \"generated:\") {\n            out = append(out, l)\n        }\n    }\n    return out\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only send user-sourced labels in API requests","Use namespace/pod-name fields so Cilium derives orchestrator labels itself","Audit automation that replays endpoint identity label sets"],"tags":["cilium","endpoint","labels","generated"],"backgroundTag":"reserved-label-not-allowed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}