{"record":{"id":"a51d16ac46fdbf57","repo":"cilium/cilium","slug":"unsupported-entity-s","errorCode":null,"errorMessage":"unsupported entity: %s","messagePattern":"unsupported entity: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/api/rule_validation.go","lineNumber":307,"sourceCode":"\t\t}\n\t}\n\n\tfor n := range i.FromCIDR {\n\t\tif err := i.FromCIDR[n].Validate(); err != nil {\n\t\t\treturn errors.Join(err, retErr)\n\t\t}\n\t}\n\n\tfor n := range i.FromCIDRSet {\n\t\tif err := i.FromCIDRSet[n].Validate(); err != nil {\n\t\t\treturn errors.Join(err, retErr)\n\t\t}\n\t}\n\n\tfor _, fromEntity := range i.FromEntities {\n\t\t_, ok := EntitySelectorMapping[fromEntity]\n\t\tif !ok {\n\t\t\treturn errors.Join(fmt.Errorf(\"unsupported entity: %s\", fromEntity), retErr)\n\t\t}\n\t}\n\n\treturn retErr\n}\n\nfunc (i *IngressCommonRule) Sanitize() {\n\tfor n := range i.FromEndpoints {\n\t\ti.FromEndpoints[n].Sanitize()\n\t}\n\n\tfor n := range i.FromNodes {\n\t\ti.FromNodes[n].Sanitize()\n\t}\n\n\tfor n := range i.FromCIDRSet {\n\t\ti.FromCIDRSet[n].Sanitize()\n\t}","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/api/rule_validation.go#L289-L325","documentation":"IngressCommonRule.Validate looks up each entry in FromEntities in the static EntitySelectorMapping (well-known entities like \"host\", \"world\", \"cluster\", \"init\", \"health\", \"unmanaged\", \"remote-node\", etc.). This error is returned when a fromEntities entry is not a recognized built-in entity name.","triggerScenarios":"Calling Rule.Validate on a rule whose Ingress.FromEntities slice contains a string with no key in EntitySelectorMapping — e.g. fromEntities: [\"all\"], a typo like \"Host\", or a custom label mistaken for an entity.","commonSituations":"Typos or wrong casing in entity names; assuming arbitrary label selectors work as entities; using entity names from other network-policy implementations (e.g. Kubernetes netpol semantics).","solutions":["Use a valid built-in entity: host, world, cluster, init, health, unmanaged, remote-node, kube-apiserver, ingress (depending on Cilium version)","Fix casing/typos — entity names are lowercase and exact","Replace the invalid entity with an explicit fromEndpoints label selector for the desired peers"],"exampleFix":"// before\nfromEntities: [\"All\"]\n// after\nfromEntities: [\"world\", \"cluster\"]","handlingStrategy":"validation","validationCode":"var validEntities = []string{\"host\",\"world\",\"cluster\",\"init\",\"health\",\"unmanaged\",\"remote-node\",\"kube-apiserver\",\"ingress\"}\nfunc entitySupported(e string) bool { return slices.Contains(validEntities, e) }","typeGuard":null,"tryCatchPattern":"if err := rule.Validate(); err != nil {\n\tif strings.Contains(err.Error(), \"unsupported entity\") {\n\t\t// replace the entity with a valid one or a fromEndpoints selector\n\t}\n\treturn err\n}","preventionTips":["Only use documented reserved entities in fromEntities/toEntities","Keep entity names lowercase and exact","Replace custom peer matching with fromEndpoints selectors instead of invented entities","Validate policies in CI against your Cilium version's EntitySelectorMapping"],"tags":["cilium","networkpolicy","entities","validation"],"backgroundTag":"unsupported-policy-entity","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}