cilium/cilium · error

unexpected cluster name: got %s, expected %s

Error message

unexpected cluster name: got %s, expected %s

What it means

clusterNameValidator checks that the value of the cilium.io/cluster label equals the locally configured cluster name. When the label exists but its value differs, this error is returned. It prevents an agent from validating identities belonging to a different cluster.

Source

Thrown at pkg/identity/cache/allocator.go:1069

			return nil
		}

		gi, ok := ak.(*key.GlobalIdentity)
		if !ok {
			return fmt.Errorf("unsupported key type %T", ak)
		}

		var found bool
		for _, lbl := range gi.LabelArray {
			if lbl.Key != api.PolicyLabelCluster {
				continue
			}

			switch {
			case lbl.Source != labels.LabelSourceK8s:
				return fmt.Errorf("unexpected source for cluster label: got %s, expected %s", lbl.Source, labels.LabelSourceK8s)
			case lbl.Value != clusterName:
				return fmt.Errorf("unexpected cluster name: got %s, expected %s", lbl.Value, clusterName)
			default:
				found = true
			}
		}

		if !found {
			return fmt.Errorf("could not find expected label %s", api.PolicyLabelCluster)
		}

		return nil
	}
}

func ScriptCmds(a *CachingIdentityAllocator) map[string]script.Cmd {
	return map[string]script.Cmd{
		"identity/list": script.Command(
			script.CmdUsage{
				Summary: "List all identities in the allocator",

View on GitHub (pinned to ac7b90affa)

Solutions

1. Set --cluster-name on the agent to match the cluster labels of the identities you intend to share.
2. Purge stale identities from the old cluster name in the kvstore.
3. Verify each clustermesh peer uses a unique cluster-name.

Example fix

// before
cilium-agent --cluster-name=west --cluster-id=1  # identities labeled cluster=prod
// after
cilium-agent --cluster-name=prod --cluster-id=1

for _, lbl := range gi.LabelArray {
    if lbl.Key == api.PolicyLabelCluster && lbl.Value != clusterName {
        return fmt.Errorf("identity from cluster %q, expected %q", lbl.Value, clusterName)
    }
}

if err != nil && strings.Contains(err.Error(), "unexpected cluster name") {
    log.WithError(err).Errorf("identity belongs to a different cluster; check --cluster-name")
}

When it happens

Trigger: An identity carries PolicyLabelCluster with a value that does not match the agent's --cluster-name, typically observed during kvstore sync when entries from another cluster are visible.

Common situations: Two clusters sharing an etcd with identical or misconfigured --cluster-name values; renaming a cluster without purging old identities; copying kvstore data between environments.

Related errors

• could not find expected label %s
• cluster is unset
• namespace is unset
• name is unset
• exportCreationTimestamp is unset

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/27079203af96efdd. Report an issue: GitHub.