{"record":{"id":"6ead0d62902a9d6c","repo":"cilium/cilium","slug":"endpoint-is-required","errorCode":null,"errorMessage":"endpoint is required","messagePattern":"endpoint is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/commands/mapstate_diff.go","lineNumber":202,"sourceCode":"\tDeleted *entryOut `json:\"deleted,omitempty\"`\n\tAdded   *entryOut `json:\"added,omitempty\"`\n}\n\nfunc newStageCmd(params CmdParams, state *script.State) (*stageCmd, error) {\n\ts := &stageCmd{\n\t\tparams: params,\n\t\tlog:    slog.New(slog.NewTextHandler(state.LogWriter(), nil)),\n\t}\n\n\tvar err error\n\ts.toAddPaths, err = state.Flags.GetStringSlice(\"filename\")\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tepSpec, _ := state.Flags.GetString(\"endpoint\")\n\tif epSpec == \"\" {\n\t\treturn nil, fmt.Errorf(\"endpoint is required\")\n\t}\n\n\teps, _ := lookupEPs(params.EPL, []string{epSpec})\n\tif len(eps) != 1 {\n\t\treturn nil, fmt.Errorf(\"endpoint not found!\")\n\t}\n\ts.ep = eps[0]\n\ts.epID, err = s.ep.GetSecurityIdentity()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tpr := params.Repository.(*policy.Repository)\n\tif pr == nil {\n\t\treturn nil, fmt.Errorf(\"BUG: could not cast policy repository\")\n\t}\n\t// Take a snapshot of the repository so we can make changes\n\ts.pr, s.ids = pr.Snapshot(s.log,","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/commands/mapstate_diff.go#L184-L220","documentation":"newStageCmd resolves the target endpoint before doing anything; it reads the `endpoint` flag and returns \"endpoint is required\" when the string is empty. The command cannot simulate a policy diff without knowing which endpoint's map to inspect.","triggerScenarios":"Calling mapstate-diff without the `--endpoint` flag, or with `--endpoint \"\"` (empty interpolation in a script).","commonSituations":"Omitting the flag in automation, a shell variable expanding to empty (unset EP_ID), or copying examples that assume a default endpoint.","solutions":["Pass `--endpoint <id|pod-name>` identifying the target endpoint","Fix the script variable so it expands to a real endpoint ID (`cilium endpoint list` to find IDs)","Quote/validate the flag value in wrappers before invoking the command"],"exampleFix":"// before\nENDPOINT=\"\" ; cilium bpf policy mapstate-diff --endpoint $ENDPOINT ...\n// after\nENDPOINT=$(cilium endpoint list -o json | jq -r '.[0].id') ; cilium bpf policy mapstate-diff --endpoint \"$ENDPOINT\" ...","handlingStrategy":"validation","validationCode":"epFlag := \"\"\nif epFlag == \"\" {\n    return errors.New(\"--endpoint must be set before invoking mapstate-diff\")\n}","typeGuard":null,"tryCatchPattern":"if err := run(); err != nil {\n    if strings.Contains(err.Error(), \"endpoint is required\") {\n        fmt.Fprintln(os.Stderr, \"pass --endpoint <id|namespace/pod>\")\n        os.Exit(2)\n    }\n    return err\n}","preventionTips":["Always pass --endpoint explicitly","Guard scripts: fail early if the endpoint variable is empty","Look up IDs via `cilium endpoint list` rather than hardcoding"],"tags":["cli","validation","cilium"],"backgroundTag":"missing-required-argument","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}