cilium/cilium · error

egress gateway is not supported in combination with the Cili

Error message

egress gateway is not supported in combination with the CiliumEndpointSlice feature

What it means

Egress gateway and the CiliumEndpointSlice (CES) feature are mutually exclusive in this Cilium version. NewEgressGatewayManager is a hive cell constructor; when it detects EnableCiliumEndpointSlice is enabled while egress gateway is on, it fails construction so the agent refuses to start with an incompatible configuration.

Source

Thrown at pkg/egressgateway/manager.go:198

func NewEgressGatewayManager(p Params) (out struct {
	cell.Out

	*Manager
	defines.NodeOut
}, err error) {
	dcfg := p.DaemonConfig

	if !dcfg.EnableEgressGateway {
		return out, nil
	}

	if dcfg.IdentityAllocationMode != option.IdentityAllocationModeCRD {
		return out, fmt.Errorf("egress gateway is not supported in %s identity allocation mode", dcfg.IdentityAllocationMode)
	}

	if dcfg.EnableCiliumEndpointSlice {
		return out, errors.New("egress gateway is not supported in combination with the CiliumEndpointSlice feature")
	}

	// TODO: refactor config checks for both ipv4 and ipv6, and derive whether the environment supports egress gateway policies for either protocol
	// We need to make sure that ipv4/v6 only environments only create the necessary resources and don't fail if unneeded features are missing.
	if !dcfg.EnableIPv4Masquerade || !dcfg.EnableBPFMasquerade {
		return out, fmt.Errorf("egress gateway requires --%s=\"true\" and --%s=\"true\"", option.EnableIPv4Masquerade, option.EnableBPFMasquerade)
	}

	if p.TunnelConfig.UnderlayProtocol() != tunnel.IPv4 {
		return out, errors.New("egress gateway requires an IPv4 underlay")
	}

	if !dcfg.EnableIPv6Masquerade {
		p.Logger.Info(fmt.Sprintf("egress gateway ipv6 policies require --%s=\"true\"", option.EnableIPv6Masquerade))
	}

	out.Manager, err = newEgressGatewayManager(p)
	if err != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Disable CiliumEndpointSlice: set enableCiliumEndpointSlice=false in the Cilium ConfigMap / --enable-cilium-endpoint-slice=false.
2. Or disable egress gateway (--enable-egress-gateway=false) and remove CiliumEgressGatewayPolicy resources if CES is required.
3. Upgrade to a Cilium release where egress gateway supports CES, if available.
4. Check helm values for conflicting flags (e.g. ciliumEndpointSlice.enabled vs egressGateway.enabled) in the deployment.

Example fix

// before (helm values)
// ciliumEndpointSlice.enabled: true
// egressGateway.enabled: true
// after
ciliumEndpointSlice.enabled: false
egressGateway.enabled: true

// check the effective Cilium config before rollout
if cfg.EnableEgressGateway && cfg.EnableCiliumEndpointSlice {
    return errors.New("egress gateway cannot run with CiliumEndpointSlice enabled; disable one of them")
}

if err := startAgent(); err != nil {
    if strings.Contains(err.Error(), "not supported in combination with the CiliumEndpointSlice") {
        // fix helm values and restart
    }
}

When it happens

Trigger: Daemon started with --enable-egress-gateway=true and --enable-cilium-endpoint-slice=true (or EnableCiliumEndpointSlice set via ConfigMap) on a CRD identity-allocation cluster; the constructor returns this error during hive startup.

Common situations: Enabling CES for scalability while egress gateway policies (CiliumEgressGatewayPolicies) are still deployed; operator defaults turning on CES; upgrading Cilium where a previously compatible combination is now rejected.

Related errors

• egress gateway requires an IPv4 underlay
• failed to init and validate daemon config: %w
• failed to create datapath regeneration trigger: %w
• egress gateway is not supported in %s identity allocation mo
• gateway configuration can't specify both an interface and an

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b0c854a1e73af7d1. Report an issue: GitHub.