cilium/cilium · error

invalid endpoint id %s

Error message

invalid endpoint id %s

What it means

lookupEPs in pkg/policy/commands/cell.go parses an endpoint spec as an integer and rejects IDs outside the valid Cilium endpoint-ID range (1..65535, since IDs are uint16). The %s echo of the original spec makes clear the argument itself is out of range, not merely unknown. This guards uint16 truncation in LookupCiliumID.

Source

Thrown at pkg/policy/commands/cell.go:117

		if strings.HasPrefix(entry.Name(), file) {
			suggestions = append(suggestions, filepath.Join(dir, entry.Name()))
		}
	}
	return suggestions
}

// lookupEPs returns the set of endpoints that match the given specs,
// or all endpoints if empty
func lookupEPs(epl endpointmanager.EndpointsLookup, specs []string) ([]*endpoint.Endpoint, error) {
	if len(specs) == 0 {
		return epl.GetEndpoints(), nil
	}

	out := make([]*endpoint.Endpoint, 0, len(specs))
	for _, spec := range specs {
		if epid, err := strconv.Atoi(spec); err == nil {
			if epid > math.MaxUint16 || epid <= 0 {
				return nil, fmt.Errorf("invalid endpoint id %s", spec)
			}
			ep := epl.LookupCiliumID(uint16(epid))
			if ep == nil {
				return nil, fmt.Errorf("No endpoint with ID %d", epid)
			}
			out = append(out, ep)
		} else if strings.Contains(spec, "/") {
			eps := epl.GetEndpointsByPodName(spec)
			if len(eps) == 0 {
				return nil, fmt.Errorf("No endpoints with pod namespace/name %s", spec)
			}
			out = append(out, eps...)
		} else {
			return nil, fmt.Errorf("endpoint must either be numeric ID or <namespace/podname>s")
		}
	}
	return out, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Use a valid Cilium endpoint ID between 1 and 65535 (list endpoints via `cilium endpoint list`).
2. If you have a pod name, use the namespace/podname form instead of a numeric ID.
3. Verify you are not passing a Kubernetes UID or PID by mistake.

Example fix

// before
policy/mapstate 98304
// after
policy/mapstate 1234   // or: policy/mapstate default/my-pod

func validEPSpec(spec string) error {
    id, err := strconv.Atoi(spec)
    if err != nil { return nil } // may be podname form
    if id <= 0 || id > math.MaxUint16 {
        return fmt.Errorf("endpoint id %s out of range 1..65535", spec)
    }
    return nil
}

eps, err := lookupEPs(epl, args)
if err != nil {
    if strings.HasPrefix(err.Error(), "invalid endpoint id") {
        return fmt.Errorf("%w; use an ID from `cilium endpoint list` (1-65535) or namespace/podname", err)
    }
    return err
}

When it happens

Trigger: Passing a numeric argument like 0, a negative number, or a value > 65535 to the policy mapstate/stage script commands (e.g. 'mapstate 70000').

Common situations: Confusing Cilium endpoint IDs with Kubernetes container/UID numbers or host PIDs; copy-pasting a 6+ digit number; passing 0 as a placeholder.

Related errors

• service type %q is not valid
• invalid peer IP address: %w
• invalid clusterID: %w
• invalid IPv6 address %q
• invalid IPv4 address %q

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/c59c7a8d17514b9d. Report an issue: GitHub.