cilium/cilium · error

unable to update some endpoints with new namespace labels

Error message

unable to update some endpoints with new namespace labels

What it means

update in the namespace updater returns this error when applying new namespace labels to all affected endpoints failed for at least one endpoint. The cached old identity labels are then not updated, so a later run retries the diff.

Source

Thrown at pkg/endpointmanager/namespace_updater.go:151

			if ep.ApplySourceIPVerificationFromAnnotation(podAnno, newNS.Annotations) {
				u.log.Info("Namespace DelegateSourceIPVerification annotation changed, regenerating endpoint",
					logfields.K8sNamespace, newNS.Name,
					logfields.EndpointID, ep.ID,
					logfields.Value, newSIPAllowAnno)

				// Trigger datapath regeneration if the setting changed
				regenMetadata := &regeneration.ExternalRegenerationMetadata{
					Reason:            "namespace DelegateSourceIPVerification annotation changed",
					RegenerationLevel: regeneration.RegenerateWithDatapath,
				}
				if regen, _ := ep.SetRegenerateStateIfAlive(regenMetadata); regen {
					ep.Regenerate(regenMetadata)
				}
			}
		}
	}
	if failed {
		return errors.New("unable to update some endpoints with new namespace labels")
	}
	u.oldIdtyLabels[newNS.Name] = newIdtyLabels
	u.oldSIPAllowAnno[newNS.Name] = newSIPAllowAnno
	return nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect agent logs just before the error to find which endpoint(s) failed and why.
2. Retry — the updater keeps the previous labels cached, so the next namespace event recomputes the diff.
3. Verify affected endpoints can regenerate (check for underlying datapath/identity errors).
4. If caused by churn, reduce rapid label flipping on the namespace.

if err := nsUpdater.update(ns); err != nil {
    log.WithError(err).Warn("namespace label update partial failure; will retry on next event")
    return nil // updater caches old labels, diff retried later
}

When it happens

Trigger: run calls update after a namespace's labels changed; ep.Regenerate (or label-application) inside the loop sets failed=true when any endpoint cannot accept the new labels.

Common situations: Namespaces with many endpoints where some are disconnecting or busy during the update; regeneration failures due to datapath errors; rapid successive namespace label changes.

Related errors

• unable to retrieve ConfigMap %q: %w
• failed to get relevant labels for pod: %w
• failed to get relevant labels for pod: %w
• unable to get namespace %q, error: %w
• namespace %q not found in store

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/718cd6613bce4e7c. Report an issue: GitHub.