cilium/cilium · error

type is unknown: %s

Error message

type is unknown: %s

What it means

validate() checks a MCSAPIServiceSpec deserialized from the kvstore; a spec whose Service type is neither ClusterSetIP nor Headless is rejected with this error. It fires during Unmarshal when remote-synced MCS API data is corrupted or from an incompatible writer version.

Source

Thrown at pkg/clustermesh/mcsapi/types/mcsapiservicespec.go:152

	}

	*s = newMCSAPIServiceSpec

	return nil
}

func (s *MCSAPIServiceSpec) validate() error {
	switch {
	case s.Cluster == "":
		return errors.New("cluster is unset")
	case s.Namespace == "":
		return errors.New("namespace is unset")
	case s.Name == "":
		return errors.New("name is unset")
	case s.ExportCreationTimestamp.IsZero():
		return errors.New("exportCreationTimestamp is unset")
	case s.Type != mcsapiv1beta1.ClusterSetIP && s.Type != mcsapiv1beta1.Headless:
		return fmt.Errorf("type is unknown: %s", s.Type)
	case s.SessionAffinity != corev1.ServiceAffinityClientIP && s.SessionAffinity != corev1.ServiceAffinityNone:
		return fmt.Errorf("session affinity is unknown: %s", s.SessionAffinity)
	case s.InternalTrafficPolicy != nil &&
		*s.InternalTrafficPolicy != corev1.ServiceInternalTrafficPolicyCluster &&
		*s.InternalTrafficPolicy != corev1.ServiceInternalTrafficPolicyLocal:
		return fmt.Errorf("internal traffic policy is unknown: %s", *s.InternalTrafficPolicy)
	case s.TrafficDistribution != nil &&
		*s.TrafficDistribution != corev1.ServiceTrafficDistributionPreferClose &&
		*s.TrafficDistribution != corev1.ServiceTrafficDistributionPreferSameZone &&
		*s.TrafficDistribution != corev1.ServiceTrafficDistributionPreferSameNode:
		return fmt.Errorf("traffic distribution is unknown: %s", *s.TrafficDistribution)
	}

	return nil
}

// ValidatingMCSAPIServiceSpec wraps a MCSAPIServiceSpec to perform additional
// validation at unmarshal time.

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the offending kvstore entry and fix or delete it so it is re-exported with a valid type
2. Align cilium agent versions across clusters so the exporter writes only ClusterSetIP/Headless types
3. Regenerate the MCS API ServiceExport/Service on the source cluster
4. Report upstream if a supported type is being rejected

Example fix

// before (in stored spec JSON)
"type": "LoadBalancer"
// after
"type": "ClusterSetIP"

if spec.Type != mcsapiv1beta1.ClusterSetIP && spec.Type != mcsapiv1beta1.Headless {
    return fmt.Errorf("unsupported service type %q before sync", spec.Type)
}

func validMCSType(t mcsapiv1beta1.ServiceType) bool {
    return t == mcsapiv1beta1.ClusterSetIP || t == mcsapiv1beta1.Headless
}

spec, err := types.UnmarshalMCServiceSpec(key, data, validators...)
if err != nil {
    log.WithError(err).Warn("dropping invalid mcsapi spec; will re-sync")
    return nil // skip entry
}

When it happens

Trigger: Unmarshal of a stored/kvstore-encoded MCSAPIServiceSpec whose .Type field holds any value other than mcsapiv1beta1.ClusterSetIP or mcsapiv1beta1.Headless (empty string, "LoadBalancer", "NodePort", etc.).

Common situations: Version skew: an older/newer cilium agent or another tool wrote an unsupported Service type into the backing store; manual edits of stored objects; partial/corrupted kvstore entries.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• cluster is unset
• namespace is unset
• name is unset
• exportCreationTimestamp is unset
• session affinity is unknown: %s

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/9f085667c8a52db4. Report an issue: GitHub.