cilium/cilium · warning

endpoint may not be associated reserved labels

Error message

endpoint may not be associated reserved labels

What it means

APICanModify enforces that API requests from users cannot modify endpoints carrying reserved orchestration-identity labels (e.g. reserved:host, reserved:init, reserved:health). If the endpoint's labels are reserved and it is not in init state, modification is rejected. Reserved endpoints are managed by Cilium itself.

Source

Thrown at pkg/endpoint/endpoint.go:1750

		stats.Forwarded++
		metrics.ProxyPolicyL7Total.WithLabelValues("forwarded", proxyType).Inc()
	case accesslog.VerdictDenied:
		stats.Denied++
		metrics.ProxyPolicyL7Total.WithLabelValues("denied", proxyType).Inc()
	case accesslog.VerdictError:
		stats.Error++
		metrics.ProxyPolicyL7Total.WithLabelValues("parse_errors", proxyType).Inc()
	}
}

// APICanModify determines whether API requests from a user are allowed to
// modify this endpoint.
func APICanModify(e *Endpoint) error {
	if e.IsInit() {
		return nil
	}
	if e.labels.OrchestrationIdentity.IsReserved() {
		return fmt.Errorf("endpoint may not be associated reserved labels")
	}
	return nil
}

// APICanModifyConfig determines whether API requests from users are allowed to
// modify the configuration of the endpoint.
func (e *Endpoint) APICanModifyConfig(n models.ConfigurationMap) error {
	if !e.labels.OrchestrationIdentity.IsReserved() {
		return nil
	}
	for config, val := range n {
		if optionSetting, err := option.NormalizeBool(val); err == nil {
			if e.Options.GetValue(config) == optionSetting {
				// The option won't be changed.
				continue
			}
			if config != option.Debug && config != option.DebugLB &&
				config != option.TraceNotify && config != option.PolicyVerdictNotify &&

View on GitHub (pinned to ac7b90affa)

Solutions

1. Stop trying to modify reserved endpoints via the API — manage them through Cilium itself (they are auto-managed).
2. Filter out endpoints with reserved labels in automation: skip endpoints whose labels include reserved:* entries.
3. If you need to affect host networking behavior, use the appropriate host firewall/host policy settings instead of endpoint modification.
4. Use cilium endpoint list to check which endpoints are reserved before issuing modification requests.

if e.labels.OrchestrationIdentity.IsReserved() && !e.IsInit() {
    // skip: reserved endpoints (reserved:host, reserved:health, ...) are agent-managed
    return nil
}
// safe to issue API modification

func apiCanModify(e *endpoint) bool { return e.IsInit() || !e.labels.OrchestrationIdentity.IsReserved() }

if err := APICanModify(e); err != nil {
    if strings.Contains(err.Error(), "reserved labels") {
        log.Printf("endpoint %s is reserved (host/init/health); manage via Cilium itself, skipping", e.ID)
        return nil
    }
    return err
}

When it happens

Trigger: A user API call (PUT/PATCH via the Cilium API or cilium CLI, e.g. cilium endpoint config/labels <id>) targets an endpoint whose labels.OrchestrationIdentity contains reserved labels, and the endpoint is not in 'init' state.

Common situations: Trying to change configuration or labels of the host endpoint (reserved:host), health endpoints (reserved:health), or ingress/init endpoints via the API; automation scripts iterating all endpoints and attempting to modify reserved ones.

Related errors

• policy map max entries limit exceeded
• lockdown is no longer needed, but a full policy recomputatio
• policy computation result has stale revision
• duplicate named ports
• failed to get target entries: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/6d13df6a9e0d94f8. Report an issue: GitHub.