{"record":{"id":"7b5235d19b940e96","repo":"cilium/cilium","slug":"invalid-fixed-identity-expecting-numeric-identi","errorCode":null,"errorMessage":"invalid fixed identity: expecting \"<numeric-identity>=<identity-name>\" got %q","messagePattern":"invalid fixed identity: expecting \"<numeric-identity>=<identity-name>\" got %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"daemon/cmd/daemon_main.go","lineNumber":98,"sourceCode":"\targDebugVerbosePolicy   = \"policy\"\n\targDebugVerboseTagged   = \"tagged\"\n\n\tapiTimeout   = 60 * time.Second\n\tdaemonSubsys = \"daemon\"\n\n\t// fatalSleep is the duration Cilium should sleep before existing in case\n\t// of a log.Fatal is issued or a CLI flag is specified but does not exist.\n\tfatalSleep = 2 * time.Second\n)\n\nfunc InitGlobalFlags(logger *slog.Logger, cmd *cobra.Command, vp *viper.Viper) {\n\tflags := cmd.Flags()\n\n\t// Validators\n\toption.Config.FixedIdentityMappingValidator = option.Validator(func(val string) error {\n\t\tvals := strings.Split(val, \"=\")\n\t\tif len(vals) != 2 {\n\t\t\treturn fmt.Errorf(`invalid fixed identity: expecting \"<numeric-identity>=<identity-name>\" got %q`, val)\n\t\t}\n\t\tni, err := identity.ParseNumericIdentity(vals[0])\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(`invalid numeric identity %q: %w`, val, err)\n\t\t}\n\t\tif !identity.IsUserReservedIdentity(ni) {\n\t\t\treturn fmt.Errorf(`invalid numeric identity %q: valid numeric identity is between %d and %d`,\n\t\t\t\tval, identity.UserReservedNumericIdentity.Uint32(), identity.MinimalNumericIdentity.Uint32())\n\t\t}\n\t\tlblStr := vals[1]\n\t\tlbl := labels.ParseLabel(lblStr)\n\t\tif lbl.IsReservedSource() {\n\t\t\treturn fmt.Errorf(`invalid source %q for label: %s`, labels.LabelSourceReserved, lblStr)\n\t\t}\n\t\treturn nil\n\t})\n\n\toption.Config.BPFMapEventBuffersValidator = option.Validator(func(val string) error {","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/daemon/cmd/daemon_main.go#L80-L116","documentation":"The `--fixed-identity-mapping` flag accepts entries of the form `<numeric-identity>=<identity-name>`. A Validator registered in daemon_main.go splits the value on '=' and rejects anything that doesn't yield exactly two parts with this error. The library throws it at flag/option parse time to catch malformed identity mappings before the agent starts.","triggerScenarios":"Passing a fixed identity mapping without exactly one '=' separator, e.g. `--fixed-identity-mapping=100` or `--fixed-identity-mapping=a=b=c` (strings.Split yields != 2 parts).","commonSituations":"Typo'ed flag values, quoting mistakes in Helm/manifests that drop the '=' part, or users specifying an identity name without the numeric prefix.","solutions":["Provide the mapping in `numeric-identity=identity-name` form, e.g. `--fixed-identity-mapping=100=production-frontend`.","Check quoting/escaping in manifests so the '=' survives shell/Helm templating.","Also ensure the numeric part is valid and within the user-reserved identity range — otherwise subsequent, more specific validation errors follow."],"exampleFix":"// before\ncilium-agent --fixed-identity-mapping=100\n// after\ncilium-agent --fixed-identity-mapping=100=production-frontend","handlingStrategy":"validation","validationCode":"// validate fixed identity mapping format before passing the flag\nfunc validFixedIdentity(v string) bool {\n    parts := strings.Split(v, \"=\")\n    return len(parts) == 2 && parts[0] != \"\" && parts[1] != \"\"\n}\nif !validFixedIdentity(flagValue) {\n    return fmt.Errorf(\"mapping %q must be <numeric-identity>=<identity-name>\", flagValue)\n}","typeGuard":null,"tryCatchPattern":"if err := startAgent(ctx); err != nil {\n    if strings.Contains(err.Error(), \"invalid fixed identity\") {\n        log.Printf(\"fix --fixed-identity-mapping to numeric-identity=identity-name format\")\n    }\n    return err\n}","preventionTips":["Validate flag values with the format key=value in Helm templates/CI before deploy","Quote values carefully in shells so '=' isn't dropped or duplicated (avoid a=b=c)","Use numeric identities inside the user-reserved range (e.g. >= 100) with descriptive names"],"tags":["cilium","configuration","flag-validation","identity"],"backgroundTag":"invalid-flag-format","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}