cilium/cilium · error

%s (use %s)

Error message

%s (use %s)

What it means

The cilium-operator CLI validates the --ipam flag against the modes supported by the selected binary; when the requested IPAM mode is unsupported it builds "<binary> doesn't support --ipam=<value>" and appends " (use <recommended>)" when a replacement mode can be recommended. It is a configuration-time validation error from cmd/flags.go, thrown before the operator starts.

Source

Thrown at operator/cmd/flags.go:109

		recommendInstead := func() string {
			switch ipamFlagValue {
			case ipamOption.IPAMENI:
				return "cilium-operator-aws"
			case ipamOption.IPAMAzure:
				return "cilium-operator-azure"
			case ipamOption.IPAMAlibabaCloud:
				return "cilium-operator-alibabacloud"
			case ipamOption.IPAMKubernetes, ipamOption.IPAMClusterPool, ipamOption.IPAMCRD:
				return "cilium-operator-generic"
			default:
				return ""
			}
		}

		unsupporterErr := func() error {
			errMsg := fmt.Sprintf("%s doesn't support --%s=%s", binaryName, option.IPAM, ipamFlagValue)
			if recommendation := recommendInstead(); recommendation != "" {
				return fmt.Errorf("%s (use %s)", errMsg, recommendation)
			}
			return errors.New(errMsg)
		}

		switch binaryName {
		case "cilium-operator":
			if recommendation := recommendInstead(); recommendation != "" {
				logger.Warn(fmt.Sprintf("cilium-operator will be deprecated in the future, for --%s=%s use %s as it has lower memory footprint", option.IPAM, ipamFlagValue, recommendation))
			}
		case "cilium-operator-aws":
			if ipamFlagValue != ipamOption.IPAMENI {
				return unsupporterErr()
			}
		case "cilium-operator-azure":
			if ipamFlagValue != ipamOption.IPAMAzure {
				return unsupporterErr()
			}
		case "cilium-operator-alibabacloud":

View on GitHub (pinned to ac7b90affa)

Solutions

1. Use the recommended IPAM mode from the error message (e.g. switch to "cluster-pool" or "kubernetes")
2. Run the correct operator binary for the environment: cloud-specific IPAM modes require the cloud-enabled cilium-operator image, not the generic one
3. Fix the operator Deployment/flags in your Helm values or manifests and redeploy
4. Check Cilium version docs for supported --ipam values if upgrading changed the accepted set

Example fix

// before
args: ["cilium-operator-generic", "--ipam=cilium-block-cidr"]
// after
args: ["cilium-operator-generic", "--ipam=kubernetes"]

validIPAM := map[string]bool{"kubernetes": true, "cluster-pool": true, "eni": true, "azure": true}
mode := flags.IPAM
binary := "cilium-operator-generic" // or cilium-operator
if !validIPAM[mode] || (binary == "cilium-operator-generic" && mode != "kubernetes" && mode != "cluster-pool") {
	return fmt.Errorf("%s doesn't support --ipam=%s", binary, mode)
}

When it happens

Trigger: Starting cilium-operator (or a variant like clustermesh-apiserver) with --ipam set to a mode the binary doesn't handle, e.g. cilium-operator-generic with a k8s-specific IPAM mode such as "cilium-block-cidr" or an ENI/Azure mode on the wrong binary.

Common situations: Copying Helm/manifest flags between operator variants (cilium-operator vs cilium-operator-generic) after changing cloud or IPAM mode; upgrading Cilium and a flag value was renamed or became binary-specific; hand-edited DaemonSet args.

Related errors

• ${binaryName} doesn't support --${ipam}=${ipamFlagValue}
• invalid flag(s): %w
• unknown key: %s
• unknown key: %s
• key=%s not bound to a flag

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/fdbdae9a32877d89. Report an issue: GitHub.