PAPERCLIP_K8S_EGRESS_MODE must be "cilium" or "standard" (go

Error message

PAPERCLIP_K8S_EGRESS_MODE must be "cilium" or "standard" (got "${egressMode}").

What it means

Egress guard in parseExecutionPolicyBootstrapEnv: PAPERCLIP_K8S_EGRESS_MODE is set but is neither 'cilium' nor 'standard'. The network-egress enforcement style would be ambiguous, so startup fails instead of guessing.

Source

Thrown at server/src/services/execution-policy-bootstrap.ts:100

    // inCluster defaults to false (matches the plugin schema default); an
    // in-cluster cloud deployment sets PAPERCLIP_K8S_IN_CLUSTER=true.
    inCluster: parseBool(env.PAPERCLIP_K8S_IN_CLUSTER) ?? false,
  };

  const backend = env.PAPERCLIP_K8S_BACKEND?.trim();
  if (backend) {
    if (backend !== "job" && backend !== "sandbox-cr") {
      throw new Error(
        `PAPERCLIP_K8S_BACKEND must be "job" or "sandbox-cr" (got "${backend}").`,
      );
    }
    kubernetesConfig.backend = backend;
  }

  const egressMode = env.PAPERCLIP_K8S_EGRESS_MODE?.trim();
  if (egressMode) {
    if (egressMode !== "cilium" && egressMode !== "standard") {
      throw new Error(
        `PAPERCLIP_K8S_EGRESS_MODE must be "cilium" or "standard" (got "${egressMode}").`,
      );
    }
    kubernetesConfig.egressMode = egressMode;
  }

  const runtimeClassName = env.PAPERCLIP_K8S_RUNTIME_CLASS_NAME?.trim();
  if (runtimeClassName) kubernetesConfig.runtimeClassName = runtimeClassName;

  const namespacePrefix = env.PAPERCLIP_K8S_NAMESPACE_PREFIX?.trim();
  if (namespacePrefix) kubernetesConfig.namespacePrefix = namespacePrefix;

  const imageRegistry = env.PAPERCLIP_K8S_IMAGE_REGISTRY?.trim();
  if (imageRegistry) kubernetesConfig.imageRegistry = imageRegistry;

  const rpcTimeoutMs = parsePositiveIntMs(env.PAPERCLIP_K8S_RPC_TIMEOUT_MS);
  if (rpcTimeoutMs !== undefined) kubernetesConfig.timeoutMs = rpcTimeoutMs;

View on GitHub (pinned to 120ae5428f)

Solutions

Set PAPERCLIP_K8S_EGRESS_MODE to "cilium" or "standard".

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at server/src/services/execution-policy-bootstrap.ts:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/dc7bdbecd8dbfe84. Report an issue: GitHub.