{"record":{"id":"c59c7a8d17514b9d","repo":"cilium/cilium","slug":"invalid-endpoint-id-s","errorCode":null,"errorMessage":"invalid endpoint id %s","messagePattern":"invalid endpoint id (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/commands/cell.go","lineNumber":117,"sourceCode":"\t\tif strings.HasPrefix(entry.Name(), file) {\n\t\t\tsuggestions = append(suggestions, filepath.Join(dir, entry.Name()))\n\t\t}\n\t}\n\treturn suggestions\n}\n\n// lookupEPs returns the set of endpoints that match the given specs,\n// or all endpoints if empty\nfunc lookupEPs(epl endpointmanager.EndpointsLookup, specs []string) ([]*endpoint.Endpoint, error) {\n\tif len(specs) == 0 {\n\t\treturn epl.GetEndpoints(), nil\n\t}\n\n\tout := make([]*endpoint.Endpoint, 0, len(specs))\n\tfor _, spec := range specs {\n\t\tif epid, err := strconv.Atoi(spec); err == nil {\n\t\t\tif epid > math.MaxUint16 || epid <= 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid endpoint id %s\", spec)\n\t\t\t}\n\t\t\tep := epl.LookupCiliumID(uint16(epid))\n\t\t\tif ep == nil {\n\t\t\t\treturn nil, fmt.Errorf(\"No endpoint with ID %d\", epid)\n\t\t\t}\n\t\t\tout = append(out, ep)\n\t\t} else if strings.Contains(spec, \"/\") {\n\t\t\teps := epl.GetEndpointsByPodName(spec)\n\t\t\tif len(eps) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"No endpoints with pod namespace/name %s\", spec)\n\t\t\t}\n\t\t\tout = append(out, eps...)\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"endpoint must either be numeric ID or <namespace/podname>s\")\n\t\t}\n\t}\n\treturn out, nil\n}","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/commands/cell.go#L99-L135","documentation":"lookupEPs in pkg/policy/commands/cell.go parses an endpoint spec as an integer and rejects IDs outside the valid Cilium endpoint-ID range (1..65535, since IDs are uint16). The %s echo of the original spec makes clear the argument itself is out of range, not merely unknown. This guards uint16 truncation in LookupCiliumID.","triggerScenarios":"Passing a numeric argument like 0, a negative number, or a value > 65535 to the policy mapstate/stage script commands (e.g. 'mapstate 70000').","commonSituations":"Confusing Cilium endpoint IDs with Kubernetes container/UID numbers or host PIDs; copy-pasting a 6+ digit number; passing 0 as a placeholder.","solutions":["Use a valid Cilium endpoint ID between 1 and 65535 (list endpoints via `cilium endpoint list`).","If you have a pod name, use the namespace/podname form instead of a numeric ID.","Verify you are not passing a Kubernetes UID or PID by mistake."],"exampleFix":"// before\npolicy/mapstate 98304\n// after\npolicy/mapstate 1234   // or: policy/mapstate default/my-pod","handlingStrategy":"validation","validationCode":"func validEPSpec(spec string) error {\n    id, err := strconv.Atoi(spec)\n    if err != nil { return nil } // may be podname form\n    if id <= 0 || id > math.MaxUint16 {\n        return fmt.Errorf(\"endpoint id %s out of range 1..65535\", spec)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"eps, err := lookupEPs(epl, args)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"invalid endpoint id\") {\n        return fmt.Errorf(\"%w; use an ID from `cilium endpoint list` (1-65535) or namespace/podname\", err)\n    }\n    return err\n}","preventionTips":["Only use IDs shown by `cilium endpoint list` - these are always <= 65535","Never pass UIDs, PIDs, or container IDs where a Cilium endpoint ID is expected","Prefer the namespace/podname form to avoid range mistakes entirely"],"tags":["cilium","endpoint","validation","cli"],"backgroundTag":"invalid-endpoint-id","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}