{"record":{"id":"640e0e96370061e5","repo":"cilium/cilium","slug":"invalid-object-t","errorCode":null,"errorMessage":"invalid object %T","messagePattern":"invalid object %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/k8s/identitybackend/identity.go","lineNumber":311,"sourceCode":"\t}\n\n\tidentityTemplate := &v2.CiliumIdentity{\n\t\tObjectMeta: metav1.ObjectMeta{\n\t\t\tName: id.String(),\n\t\t},\n\t}\n\n\tobj, exists, err := c.Store.Get(identityTemplate)\n\tif err != nil {\n\t\treturn nil, exists, err\n\t}\n\tif !exists {\n\t\treturn nil, exists, nil\n\t}\n\n\tidentity, ok := obj.(*v2.CiliumIdentity)\n\tif !ok {\n\t\treturn nil, false, fmt.Errorf(\"invalid object %T\", obj)\n\t}\n\treturn identity, true, nil\n}\n\n// GetByID returns the key associated with an ID. Returns nil if no key is\n// associated with the ID.\n// Note: the lock field is not supported with the k8s CRD allocator.\nfunc (c *crdBackend) GetByID(ctx context.Context, id idpool.ID) (allocator.AllocatorKey, error) {\n\tidentity, exists, err := c.getById(ctx, id)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !exists {\n\t\treturn nil, nil\n\t}\n\n\treturn c.KeyFunc(identity.SecurityLabels), nil\n}","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/k8s/identitybackend/identity.go#L293-L329","documentation":"getById fetches an object from the local identity store by ID and then asserts it is a *v2.CiliumIdentity. If the store returns an object of any other type, the assertion fails and 'invalid object %T' is returned with the actual Go type. This is an invariant violation: only CiliumIdentity objects should ever be stored in this store.","triggerScenarios":"c.Store (keyed by identity ID) returns a non-nil object whose concrete type is not *v2.CiliumIdentity — e.g. a different resource type registered into the same store/informer cache by misconfiguration or a code bug.","commonSituations":"Mixed-version or corrupted informer cache; another controller writing unrelated objects that match the store's key scheme; a bug after a refactor that changed the stored type.","solutions":["Identify the actual type from %T in the error message and find what is inserting it into the store","Restart the agent to rebuild the informer store from the API server","Verify only CiliumIdentity objects exist: `kubectl get ciliumidentities -o yaml` and inspect the store population code path","Report/fix upstream if a mixed-version component injects wrong types into the shared store"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"func asCiliumIdentity(obj any) (*v2.CiliumIdentity, bool) {\n    id, ok := obj.(*v2.CiliumIdentity)\n    return id, ok\n}","tryCatchPattern":"idty, exists, err := backend.GetByID(ctx, id)\nif err != nil && strings.Contains(err.Error(), \"invalid object \") {\n    log.Errorf(\"store corruption: %s\", err)\n    // trigger store rebuild / restart\n}","preventionTips":["Ensure only CiliumIdentity objects are inserted into the identity store","Keep informer handlers strictly typed to *v2.CiliumIdentity","Restart/rebuild the store if a foreign object type is detected"],"tags":["kubernetes","cilium-identity","type-assertion"],"backgroundTag":"invalid-store-object-type","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}