cilium/cilium · error

allocate: %w

Error message

allocate: %w

What it means

This wraps any error from CiliumIdentityAllocator.AllocateIdentity inside the 'identity allocate' Hubble/script debug command. It occurs when requesting a new identity for a comma-separated label list fails (kvstore/allocator errors, invalid labels, allocation range exhaustion). The wrap preserves the underlying cause.

Source

Thrown at pkg/identity/cache/allocator.go:1123

				}, nil
			},
		),
		"identity/allocate": script.Command(
			script.CmdUsage{
				Summary: "Allocate identity from the allocator",
				Args:    "labels",
			},
			func(s *script.State, args ...string) (script.WaitFunc, error) {
				var wait script.WaitFunc

				allArgs := []string(args)
				var labelArr []labels.Label
				for s := range strings.SplitSeq(allArgs[0], ",") {
					labelArr = append(labelArr, labels.ParseLabel(s))
				}
				id, _, err := a.AllocateIdentity(s.Context(), labels.LabelArray(labelArr).Labels(), true, identity.NumericIdentity(0))
				if err != nil {
					return wait, fmt.Errorf("allocate: %w", err)
				}
				wait = func(s *script.State) (stdout string, stderr string, err error) {
					return id.String() + "\n", "", nil
				}
				return wait, nil
			},
		),
		"identity/release": script.Command(
			script.CmdUsage{
				Summary: "Release identity from the allocator",
				Args:    "numeric-id",
			},
			func(s *script.State, args ...string) (script.WaitFunc, error) {
				if len(args) != 1 {
					return nil, fmt.Errorf("expected one arg but got %v, see usage details", len(args))
				}
				num, err := strconv.Atoi(args[0])
				if err != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped cause and fix it (restore kvstore connectivity, correct the label string).
2. Retry allocation once the allocator reports ready ('cilium status' shows kvstore/allocator healthy).
3. Simplify labels to valid key=value pairs separated by commas.

Example fix

// before: invalid label string
identity allocate not-a-label
// after
identity allocate k8s:app=frontend,k8s:tier=web

// ensure the agent is healthy first
cilium status --wait
// validate label format before allocating
for _, l := range strings.Split(labelsArg, ",") {
    if !strings.Contains(l, "=") { return fmt.Errorf("invalid label %q", l) }
}

id, _, err := a.AllocateIdentity(ctx, lbls, true, 0)
if err != nil {
    return fmt.Errorf("allocate: %w", err) // inspect %w cause for kvstore vs label issues
}

When it happens

Trigger: Running the script command 'identity allocate' with a labels argument while a.AllocateIdentity returns an error (kvstore unavailable, allocator not ready, invalid label).

Common situations: Running the debug script against an agent whose kvstore connection is down; passing malformed label lists; cluster allocation range exhausted in clustermesh.

Related errors

• identity %d not found
• ID %d does not belong to the allocation range of cluster ID
• unsupported key type %T
• expected one arg but got %v, see usage details
• failed to allocate new identity during label injection: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/51108b603c6e267f. Report an issue: GitHub.