cilium/cilium · error

unsupported entity: %s

Error message

unsupported entity: %s

What it means

IngressCommonRule.Validate looks up each entry in FromEntities in the static EntitySelectorMapping (well-known entities like "host", "world", "cluster", "init", "health", "unmanaged", "remote-node", etc.). This error is returned when a fromEntities entry is not a recognized built-in entity name.

Source

Thrown at pkg/policy/api/rule_validation.go:307

		}
	}

	for n := range i.FromCIDR {
		if err := i.FromCIDR[n].Validate(); err != nil {
			return errors.Join(err, retErr)
		}
	}

	for n := range i.FromCIDRSet {
		if err := i.FromCIDRSet[n].Validate(); err != nil {
			return errors.Join(err, retErr)
		}
	}

	for _, fromEntity := range i.FromEntities {
		_, ok := EntitySelectorMapping[fromEntity]
		if !ok {
			return errors.Join(fmt.Errorf("unsupported entity: %s", fromEntity), retErr)
		}
	}

	return retErr
}

func (i *IngressCommonRule) Sanitize() {
	for n := range i.FromEndpoints {
		i.FromEndpoints[n].Sanitize()
	}

	for n := range i.FromNodes {
		i.FromNodes[n].Sanitize()
	}

	for n := range i.FromCIDRSet {
		i.FromCIDRSet[n].Sanitize()
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Use a valid built-in entity: host, world, cluster, init, health, unmanaged, remote-node, kube-apiserver, ingress (depending on Cilium version)
2. Fix casing/typos — entity names are lowercase and exact
3. Replace the invalid entity with an explicit fromEndpoints label selector for the desired peers

Example fix

// before
fromEntities: ["All"]
// after
fromEntities: ["world", "cluster"]

var validEntities = []string{"host","world","cluster","init","health","unmanaged","remote-node","kube-apiserver","ingress"}
func entitySupported(e string) bool { return slices.Contains(validEntities, e) }

if err := rule.Validate(); err != nil {
	if strings.Contains(err.Error(), "unsupported entity") {
		// replace the entity with a valid one or a fromEndpoints selector
	}
	return err
}

When it happens

Trigger: Calling Rule.Validate on a rule whose Ingress.FromEntities slice contains a string with no key in EntitySelectorMapping — e.g. fromEntities: ["all"], a typo like "Host", or a custom label mistaken for an entity.

Common situations: Typos or wrong casing in entity names; assuming arbitrary label selectors work as entities; using entity names from other network-policy implementations (e.g. Kubernetes netpol semantics).

Related errors

• the ICMPs block may only be present without ToPorts. Define
• empty server name is not allowed
• rule must have one of EndpointSelector or NodeSelector
• rule cannot have both EndpointSelector and NodeSelector
• L7 policy is not supported on host ingress yet

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/a51d16ac46fdbf57. Report an issue: GitHub.