{"record":{"id":"87546c86afb6cf78","repo":"cilium/cilium","slug":"unknown-requested-auth-type-s","errorCode":null,"errorMessage":"unknown requested auth type: %s","messagePattern":"unknown requested auth type: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/manager.go","lineNumber":194,"sourceCode":"\treturn true\n}\n\n// clearPendingAuth marks the pending authentication as finished.\nfunc (a *AuthManager) clearPendingAuth(key authKey) {\n\ta.logger.Debug(\"Clearing pending authentication\", logfields.Key, key)\n\n\ta.mutex.Lock()\n\tdefer a.mutex.Unlock()\n\tdelete(a.pending, key)\n}\n\nfunc (a *AuthManager) authenticate(key authKey) error {\n\ta.logger.Debug(\"Policy is requiring authentication\", logfields.Key, key)\n\n\t// Authenticate according to the requested auth type\n\th, ok := a.authHandlers[key.authType]\n\tif !ok {\n\t\treturn fmt.Errorf(\"unknown requested auth type: %s\", key.authType)\n\t}\n\n\tnodeIP := a.nodeIDHandler.GetNodeIP(key.remoteNodeID)\n\tif nodeIP == \"\" {\n\t\treturn fmt.Errorf(\"remote node IP not available for node ID %d\", key.remoteNodeID)\n\t}\n\n\tauthReq := &authRequest{\n\t\tlocalIdentity:  key.localIdentity,\n\t\tremoteIdentity: key.remoteIdentity,\n\t\tremoteNodeIP:   nodeIP,\n\t}\n\n\tauthResp, err := h.authenticate(authReq)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to authenticate with auth type %s: %w\", key.authType, err)\n\t}\n","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/auth/manager.go#L176-L212","documentation":"authenticate() looks up the handler registered for the authType stored in the auth key. If no handler is registered for that type, authentication cannot proceed and this error is returned, meaning policy requires an auth type the manager does not support.","triggerScenarios":"An authKey pulled from the auth map or policy computation carries an authType for which a.authHandlers has no entry — e.g. an entry written by an older/newer cilium version with an auth type not compiled into this binary, or handlers that failed to register at startup.","commonSituations":"Rolling upgrade/downgrade where datapath entries use auth types unknown to the new binary; custom builds lacking an auth handler (e.g. no SPIRE) while policy still requires that auth type; misconfigured CiliumNetworkPolicy authentication mode referencing an unavailable type; entries left in the eBPF map after features were disabled.","solutions":["Check policy/CiliumNetworkPolicies for authentication modes requesting auth types not enabled in this cilium build; adjust policy to supported types","Ensure the matching auth handler (e.g. SPIRE) is enabled and registered at startup","After upgrades/downgrades, restart or flush stale auth map entries written with unknown auth types","Verify all nodes in the cluster run compatible cilium versions so keys aren't written with unsupported types","Add the missing authType to the manager's handler set if this is a custom build"],"exampleFix":"// before\nh, ok := a.authHandlers[key.authType]\nif !ok {\n    return fmt.Errorf(\"unknown requested auth type: %s\", key.authType)\n}\n// after\nh, ok := a.authHandlers[key.authType]\nif !ok {\n    a.logger.Warn(\"dropping auth entry with unknown auth type\", logfields.Key, key)\n    return a.authmap.Delete(key) // clean up stale entry instead of failing repeatedly\n}","handlingStrategy":"validation","validationCode":"// Verify policy auth modes against supported handlers before applying policy\nfor _, mode := range policyAuthModes {\n    if !supportedAuthTypes.Contains(mode) {\n        return fmt.Errorf(\"policy requires unsupported auth type %s\", mode)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := authenticate(key)\nif err != nil && strings.HasPrefix(err.Error(), \"unknown requested auth type\") {\n    log.Warn(\"unsupported auth type requested; flush stale map entries and fix policy\", \"key\", key)\n    _ = authmap.Delete(key)\n}","preventionTips":["Only use authentication modes supported by the deployed cilium build in CiliumNetworkPolicies","Keep cilium versions consistent across the cluster","Flush auth map entries after feature-disabling or version changes","Enable and register all needed auth handlers (e.g. SPIRE) before applying auth policies"],"tags":["authentication","policy","auth-type","cilium"],"backgroundTag":"unknown-auth-type","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}