cilium/cilium · error

invalid object %T

Error message

invalid object %T

What it means

getById fetches an object from the local identity store by ID and then asserts it is a *v2.CiliumIdentity. If the store returns an object of any other type, the assertion fails and 'invalid object %T' is returned with the actual Go type. This is an invariant violation: only CiliumIdentity objects should ever be stored in this store.

Source

Thrown at pkg/k8s/identitybackend/identity.go:311

	}

	identityTemplate := &v2.CiliumIdentity{
		ObjectMeta: metav1.ObjectMeta{
			Name: id.String(),
		},
	}

	obj, exists, err := c.Store.Get(identityTemplate)
	if err != nil {
		return nil, exists, err
	}
	if !exists {
		return nil, exists, nil
	}

	identity, ok := obj.(*v2.CiliumIdentity)
	if !ok {
		return nil, false, fmt.Errorf("invalid object %T", obj)
	}
	return identity, true, nil
}

// GetByID returns the key associated with an ID. Returns nil if no key is
// associated with the ID.
// Note: the lock field is not supported with the k8s CRD allocator.
func (c *crdBackend) GetByID(ctx context.Context, id idpool.ID) (allocator.AllocatorKey, error) {
	identity, exists, err := c.getById(ctx, id)
	if err != nil {
		return nil, err
	}
	if !exists {
		return nil, nil
	}

	return c.KeyFunc(identity.SecurityLabels), nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Identify the actual type from %T in the error message and find what is inserting it into the store
2. Restart the agent to rebuild the informer store from the API server
3. Verify only CiliumIdentity objects exist: `kubectl get ciliumidentities -o yaml` and inspect the store population code path
4. Report/fix upstream if a mixed-version component injects wrong types into the shared store

func asCiliumIdentity(obj any) (*v2.CiliumIdentity, bool) {
    id, ok := obj.(*v2.CiliumIdentity)
    return id, ok
}

idty, exists, err := backend.GetByID(ctx, id)
if err != nil && strings.Contains(err.Error(), "invalid object ") {
    log.Errorf("store corruption: %s", err)
    // trigger store rebuild / restart
}

When it happens

Trigger: c.Store (keyed by identity ID) returns a non-nil object whose concrete type is not *v2.CiliumIdentity — e.g. a different resource type registered into the same store/informer cache by misconfiguration or a code bug.

Common situations: Mixed-version or corrupted informer cache; another controller writing unrelated objects that match the store's key scheme; a bug after a refactor that changed the stored type.

Related errors

• failed to get relevant labels for pod: %w
• %w - found %T
• unknown object type %T
• unknown object type %T
• %w - found %T

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/640e0e96370061e5. Report an issue: GitHub.