{"record":{"id":"b0c854a1e73af7d1","repo":"cilium/cilium","slug":"egress-gateway-is-not-supported-in-combination-wit","errorCode":null,"errorMessage":"egress gateway is not supported in combination with the CiliumEndpointSlice feature","messagePattern":"egress gateway is not supported in combination with the CiliumEndpointSlice feature","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/egressgateway/manager.go","lineNumber":198,"sourceCode":"\nfunc NewEgressGatewayManager(p Params) (out struct {\n\tcell.Out\n\n\t*Manager\n\tdefines.NodeOut\n}, err error) {\n\tdcfg := p.DaemonConfig\n\n\tif !dcfg.EnableEgressGateway {\n\t\treturn out, nil\n\t}\n\n\tif dcfg.IdentityAllocationMode != option.IdentityAllocationModeCRD {\n\t\treturn out, fmt.Errorf(\"egress gateway is not supported in %s identity allocation mode\", dcfg.IdentityAllocationMode)\n\t}\n\n\tif dcfg.EnableCiliumEndpointSlice {\n\t\treturn out, errors.New(\"egress gateway is not supported in combination with the CiliumEndpointSlice feature\")\n\t}\n\n\t// TODO: refactor config checks for both ipv4 and ipv6, and derive whether the environment supports egress gateway policies for either protocol\n\t// We need to make sure that ipv4/v6 only environments only create the necessary resources and don't fail if unneeded features are missing.\n\tif !dcfg.EnableIPv4Masquerade || !dcfg.EnableBPFMasquerade {\n\t\treturn out, fmt.Errorf(\"egress gateway requires --%s=\\\"true\\\" and --%s=\\\"true\\\"\", option.EnableIPv4Masquerade, option.EnableBPFMasquerade)\n\t}\n\n\tif p.TunnelConfig.UnderlayProtocol() != tunnel.IPv4 {\n\t\treturn out, errors.New(\"egress gateway requires an IPv4 underlay\")\n\t}\n\n\tif !dcfg.EnableIPv6Masquerade {\n\t\tp.Logger.Info(fmt.Sprintf(\"egress gateway ipv6 policies require --%s=\\\"true\\\"\", option.EnableIPv6Masquerade))\n\t}\n\n\tout.Manager, err = newEgressGatewayManager(p)\n\tif err != nil {","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/egressgateway/manager.go#L180-L216","documentation":"Egress gateway and the CiliumEndpointSlice (CES) feature are mutually exclusive in this Cilium version. NewEgressGatewayManager is a hive cell constructor; when it detects EnableCiliumEndpointSlice is enabled while egress gateway is on, it fails construction so the agent refuses to start with an incompatible configuration.","triggerScenarios":"Daemon started with --enable-egress-gateway=true and --enable-cilium-endpoint-slice=true (or EnableCiliumEndpointSlice set via ConfigMap) on a CRD identity-allocation cluster; the constructor returns this error during hive startup.","commonSituations":"Enabling CES for scalability while egress gateway policies (CiliumEgressGatewayPolicies) are still deployed; operator defaults turning on CES; upgrading Cilium where a previously compatible combination is now rejected.","solutions":["Disable CiliumEndpointSlice: set enableCiliumEndpointSlice=false in the Cilium ConfigMap / --enable-cilium-endpoint-slice=false.","Or disable egress gateway (--enable-egress-gateway=false) and remove CiliumEgressGatewayPolicy resources if CES is required.","Upgrade to a Cilium release where egress gateway supports CES, if available.","Check helm values for conflicting flags (e.g. ciliumEndpointSlice.enabled vs egressGateway.enabled) in the deployment."],"exampleFix":"// before (helm values)\n// ciliumEndpointSlice.enabled: true\n// egressGateway.enabled: true\n// after\nciliumEndpointSlice.enabled: false\negressGateway.enabled: true","handlingStrategy":"validation","validationCode":"// check the effective Cilium config before rollout\nif cfg.EnableEgressGateway && cfg.EnableCiliumEndpointSlice {\n    return errors.New(\"egress gateway cannot run with CiliumEndpointSlice enabled; disable one of them\")\n}","typeGuard":null,"tryCatchPattern":"if err := startAgent(); err != nil {\n    if strings.Contains(err.Error(), \"not supported in combination with the CiliumEndpointSlice\") {\n        // fix helm values and restart\n    }\n}","preventionTips":["Keep feature-flag matrices (egressGateway vs ciliumEndpointSlice) validated in CI via helm template + config assertions.","When enabling CES, audit all Cilium feature flags for documented incompatibilities first.","Upgrade Cilium to a version that supports egress gateway with CES instead of mixing flags."],"tags":["cilium","egress-gateway","configuration","startup"],"backgroundTag":"incompatible-feature-flags","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}