cilium/cilium · error

not allowed to add generated labels: %s

Error message

not allowed to add generated labels: %s

What it means

Labels with the 'generated:' source (e.g. 'k8s:' auto-derived or plugin-generated labels) are owned by Cilium's label injection pipeline, not by API clients. CreateEndpoint rejects create requests whose labels are marked generated, since clients must not supply identities that look like they were produced by Cilium itself.

Source

Thrown at pkg/endpoint/api/endpoint_api_manager.go:189

			return invalidDataError(ep, err)
		} else if oldEp != nil {
			return invalidDataError(ep, fmt.Errorf("IP %s is already in use", id))
		}
	}

	if err = endpoint.APICanModify(ep); err != nil {
		return invalidDataError(ep, err)
	}

	infoLabels := labels.NewLabelsFromModel([]string{})

	if len(apiLabels) > 0 {
		if lbls := apiLabels.FindReserved(); lbls != nil {
			return invalidDataError(ep, fmt.Errorf("not allowed to add reserved labels: %s", lbls))
		}

		if apiLabels.IsGenerated() {
			return invalidDataError(ep, fmt.Errorf("not allowed to add generated labels: %s", apiLabels))
		}

		apiLabels, _ = labelsfilter.Filter(apiLabels)
		if len(apiLabels) == 0 {
			return invalidDataError(ep, fmt.Errorf("no valid labels provided"))
		}
	}

	var cancel context.CancelFunc
	ctx, cancel = context.WithCancel(ctx)
	m.endpointCreations.NewCreateRequest(ep, cancel)
	defer m.endpointCreations.EndCreateRequest(ep)

	identityLbls := maps.Clone(apiLabels)

	if ep.K8sNamespaceAndPodNameIsSet() && m.clientset.IsEnabled() {
		pod, k8sMetadata, err := m.handleOutdatedPodInformer(ctx, ep)
		if errors.Is(err, endpointmetadata.ErrPodStoreOutdated) {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Remove generated:* labels from the request; send only user-supplied labels.
2. Use the K8s namespace/pod name fields so Cilium fetches real orchestrator labels itself (handleOutdatedPodInformer / metadata resolver path).
3. If you need k8s-derived labels, pass k8s: labels via the pod object, not the endpoint create model.

Example fix

// before
ep.Labels = endpoint.Status.Identity.Labels // generated/k8s labels
// after
ep.Labels = []string{"my-app:frontend"} // user labels only

func stripGeneratedAndReserved(ls []string) []string {
    var out []string
    for _, l := range ls {
        if !strings.HasPrefix(l, "reserved:") && !strings.HasPrefix(l, "generated:") {
            out = append(out, l)
        }
    }
    return out
}

When it happens

Trigger: POST /endpoints where apiLabels.IsGenerated() is true — i.e. the label set consists of labels carrying the generated source ('generated:*' or labels produced by Cilium's orchestrator filters).

Common situations: Client copies identity labels from another endpoint's resolved identity into a create call; automation that materializes 'k8s:...' style labels manually into the endpoint model.

Related errors

• not allowed to add reserved labels: %s
• no valid labels provided
• PatchEndpointIDLabelsUpdateFailedCode
• api not ready
• endpoint not found

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/15d07c933e57aea0. Report an issue: GitHub.