{"record":{"id":"718cd6613bce4e7c","repo":"cilium/cilium","slug":"unable-to-update-some-endpoints-with-new-namespace","errorCode":null,"errorMessage":"unable to update some endpoints with new namespace labels","messagePattern":"unable to update some endpoints with new namespace labels","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/endpointmanager/namespace_updater.go","lineNumber":151,"sourceCode":"\t\t\tif ep.ApplySourceIPVerificationFromAnnotation(podAnno, newNS.Annotations) {\n\t\t\t\tu.log.Info(\"Namespace DelegateSourceIPVerification annotation changed, regenerating endpoint\",\n\t\t\t\t\tlogfields.K8sNamespace, newNS.Name,\n\t\t\t\t\tlogfields.EndpointID, ep.ID,\n\t\t\t\t\tlogfields.Value, newSIPAllowAnno)\n\n\t\t\t\t// Trigger datapath regeneration if the setting changed\n\t\t\t\tregenMetadata := &regeneration.ExternalRegenerationMetadata{\n\t\t\t\t\tReason:            \"namespace DelegateSourceIPVerification annotation changed\",\n\t\t\t\t\tRegenerationLevel: regeneration.RegenerateWithDatapath,\n\t\t\t\t}\n\t\t\t\tif regen, _ := ep.SetRegenerateStateIfAlive(regenMetadata); regen {\n\t\t\t\t\tep.Regenerate(regenMetadata)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif failed {\n\t\treturn errors.New(\"unable to update some endpoints with new namespace labels\")\n\t}\n\tu.oldIdtyLabels[newNS.Name] = newIdtyLabels\n\tu.oldSIPAllowAnno[newNS.Name] = newSIPAllowAnno\n\treturn nil\n}\n","sourceCodeStart":133,"sourceCodeEnd":157,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/endpointmanager/namespace_updater.go#L133-L157","documentation":"update in the namespace updater returns this error when applying new namespace labels to all affected endpoints failed for at least one endpoint. The cached old identity labels are then not updated, so a later run retries the diff.","triggerScenarios":"run calls update after a namespace's labels changed; ep.Regenerate (or label-application) inside the loop sets failed=true when any endpoint cannot accept the new labels.","commonSituations":"Namespaces with many endpoints where some are disconnecting or busy during the update; regeneration failures due to datapath errors; rapid successive namespace label changes.","solutions":["Inspect agent logs just before the error to find which endpoint(s) failed and why.","Retry — the updater keeps the previous labels cached, so the next namespace event recomputes the diff.","Verify affected endpoints can regenerate (check for underlying datapath/identity errors).","If caused by churn, reduce rapid label flipping on the namespace."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := nsUpdater.update(ns); err != nil {\n    log.WithError(err).Warn(\"namespace label update partial failure; will retry on next event\")\n    return nil // updater caches old labels, diff retried later\n}","preventionTips":["Check logs for the specific failing endpoint after each occurrence","Avoid rapid flipping of namespace labels","Ensure endpoints can regenerate (healthy datapath/identity allocation)"],"tags":["cilium","kubernetes","namespace","labels"],"backgroundTag":"endpoint-label-update-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}