{"record":{"id":"51108b603c6e267f","repo":"cilium/cilium","slug":"allocate-w","errorCode":null,"errorMessage":"allocate: %w","messagePattern":"allocate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/identity/cache/allocator.go","lineNumber":1123,"sourceCode":"\t\t\t\t}, nil\n\t\t\t},\n\t\t),\n\t\t\"identity/allocate\": script.Command(\n\t\t\tscript.CmdUsage{\n\t\t\t\tSummary: \"Allocate identity from the allocator\",\n\t\t\t\tArgs:    \"labels\",\n\t\t\t},\n\t\t\tfunc(s *script.State, args ...string) (script.WaitFunc, error) {\n\t\t\t\tvar wait script.WaitFunc\n\n\t\t\t\tallArgs := []string(args)\n\t\t\t\tvar labelArr []labels.Label\n\t\t\t\tfor s := range strings.SplitSeq(allArgs[0], \",\") {\n\t\t\t\t\tlabelArr = append(labelArr, labels.ParseLabel(s))\n\t\t\t\t}\n\t\t\t\tid, _, err := a.AllocateIdentity(s.Context(), labels.LabelArray(labelArr).Labels(), true, identity.NumericIdentity(0))\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn wait, fmt.Errorf(\"allocate: %w\", err)\n\t\t\t\t}\n\t\t\t\twait = func(s *script.State) (stdout string, stderr string, err error) {\n\t\t\t\t\treturn id.String() + \"\\n\", \"\", nil\n\t\t\t\t}\n\t\t\t\treturn wait, nil\n\t\t\t},\n\t\t),\n\t\t\"identity/release\": script.Command(\n\t\t\tscript.CmdUsage{\n\t\t\t\tSummary: \"Release identity from the allocator\",\n\t\t\t\tArgs:    \"numeric-id\",\n\t\t\t},\n\t\t\tfunc(s *script.State, args ...string) (script.WaitFunc, error) {\n\t\t\t\tif len(args) != 1 {\n\t\t\t\t\treturn nil, fmt.Errorf(\"expected one arg but got %v, see usage details\", len(args))\n\t\t\t\t}\n\t\t\t\tnum, err := strconv.Atoi(args[0])\n\t\t\t\tif err != nil {","sourceCodeStart":1105,"sourceCodeEnd":1141,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/identity/cache/allocator.go#L1105-L1141","documentation":"This wraps any error from CiliumIdentityAllocator.AllocateIdentity inside the 'identity allocate' Hubble/script debug command. It occurs when requesting a new identity for a comma-separated label list fails (kvstore/allocator errors, invalid labels, allocation range exhaustion). The wrap preserves the underlying cause.","triggerScenarios":"Running the script command 'identity allocate' with a labels argument while a.AllocateIdentity returns an error (kvstore unavailable, allocator not ready, invalid label).","commonSituations":"Running the debug script against an agent whose kvstore connection is down; passing malformed label lists; cluster allocation range exhausted in clustermesh.","solutions":["Read the wrapped cause and fix it (restore kvstore connectivity, correct the label string).","Retry allocation once the allocator reports ready ('cilium status' shows kvstore/allocator healthy).","Simplify labels to valid key=value pairs separated by commas."],"exampleFix":"// before: invalid label string\nidentity allocate not-a-label\n// after\nidentity allocate k8s:app=frontend,k8s:tier=web","handlingStrategy":"try-catch","validationCode":"// ensure the agent is healthy first\ncilium status --wait\n// validate label format before allocating\nfor _, l := range strings.Split(labelsArg, \",\") {\n    if !strings.Contains(l, \"=\") { return fmt.Errorf(\"invalid label %q\", l) }\n}","typeGuard":null,"tryCatchPattern":"id, _, err := a.AllocateIdentity(ctx, lbls, true, 0)\nif err != nil {\n    return fmt.Errorf(\"allocate: %w\", err) // inspect %w cause for kvstore vs label issues\n}","preventionTips":["Check kvstore/allocator health before running allocation scripts.","Use well-formed key=value labels with source prefixes.","Watch for allocation-range exhaustion in clustermesh setups."],"tags":["cilium","identity-allocation","debug-script"],"backgroundTag":"identity-allocation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}