--- title: "Create endpoint" method: PUT path: "/endpoint/{id}" tags: ["endpoint"] --- # Create endpoint `PUT /endpoint/{id}` Creates a new endpoint ## Path parameters - `id` string, required ## Request body - EndpointChangeRequest — Structure which contains the mutable elements of an Endpoint. - `id` integer — Local endpoint ID - `container-id` string — ID assigned by container runtime - `container-netns-path` string — Path of Container Netns - `labels` string[] — Set of labels - `interface-name` string — Name of network device in host netns - `interface-index` integer — Index of network device in host netns - `parent-interface-index` integer — Index of network device from which an IP was used as endpoint IP. Only relevant for ENI environments. - `container-interface-name` string — Name of network device in container netns - `state` 'waiting-for-identity' | 'not-ready' | 'waiting-to-regenerate' | 'regenerating' | 'restoring' | 'ready' | 'disconnecting' | 'disconnected' | 'invalid', required — State of endpoint - `mac` string — MAC address - `host-mac` string — MAC address - `addressing` AddressPair — Addressing information of an endpoint - `ipv4` string — IPv4 address - `ipv4-expiration-uuid` string — UUID of IPv4 expiration timer - `ipv4-pool-name` string — IPAM pool from which this IPv4 address was allocated - `ipv6` string — IPv6 address - `ipv6-expiration-uuid` string — UUID of IPv6 expiration timer - `ipv6-pool-name` string — IPAM pool from which this IPv6 address was allocated - `k8s-pod-name` string — Kubernetes pod name - `k8s-namespace` string — Kubernetes namespace name - `k8s-uid` string — Kubernetes pod UID - `datapath-map-id` integer — ID of datapath tail call map - `policy-enabled` boolean — Whether policy enforcement is enabled or not - `pid` integer — Process ID of the workload belonging to this endpoint - `sync-build-endpoint` boolean — Whether to build an endpoint synchronously - `is-secondary-interface` boolean — Whether this is a secondary pod interface - `netns-cookie` string — Network namespace cookie - `datapath-configuration` EndpointDatapathConfiguration — Datapath configuration to be used for the endpoint - `require-arp-passthrough` boolean — Enable ARP passthrough mode - `require-egress-prog` boolean — Endpoint requires a host-facing egress program to be attached to implement ingress policy and reverse NAT. - `external-ipam` boolean — Indicates that IPAM is done external to Cilium. This will prevent the IP from being released and re-allocation of the IP address is skipped on restore. - `require-routing` boolean — Endpoint requires BPF routing to be enabled, when disabled, routing is delegated to Linux routing. - `install-endpoint-route` boolean — Installs a route in the Linux routing table pointing to the device of the endpoint's interface. - `disable-sip-verification` boolean — Disable source IP verification for the endpoint. - `properties` unknown ## Response `201` Created - Endpoint — An endpoint is a namespaced network interface to which cilium applies policies - `id` integer — The cilium-agent-local ID of the endpoint - `spec` EndpointConfigurationSpec — An endpoint's configuration - `options` ConfigurationMap — Map of configuration key/value pairs. - `label-configuration` LabelConfigurationSpec — User desired Label configuration of an endpoint - `user` string[] — Set of labels - `status` EndpointStatus — The current state and configuration of the endpoint, its policy & datapath, and subcomponents - `external-identifiers` EndpointIdentifiers — Unique identifiers for this endpoint from outside cilium +deepequal-gen=true - `cni-attachment-id` string — ID assigned to this attachment by container runtime - `container-id` string — ID assigned by container runtime (deprecated, may not be unique) - `container-name` string — Name assigned to container (deprecated, may not be unique) - `docker-endpoint-id` string — Docker endpoint ID - `docker-network-id` string — Docker network ID - `pod-name` string — K8s pod for this endpoint (deprecated, may not be unique) - `k8s-pod-name` string — K8s pod name for this endpoint (deprecated, may not be unique) - `k8s-namespace` string — K8s namespace for this endpoint (deprecated, may not be unique) - `identity` Identity — Security identity - `id` integer — Unique identifier - `labels` string[] — Set of labels - `labelsSHA256` string — SHA256 of labels - `labels` LabelConfigurationStatus — Labels and label configuration of an endpoint - `realized` LabelConfigurationSpec — User desired Label configuration of an endpoint - `user` string[] — Set of labels - `security-relevant` string[] — Set of labels - `derived` string[] — Set of labels - `disabled` string[] — Set of labels - `realized` EndpointConfigurationSpec — An endpoint's configuration - `options` ConfigurationMap — Map of configuration key/value pairs. - `label-configuration` LabelConfigurationSpec — User desired Label configuration of an endpoint - `user` string[] — Set of labels - `networking` EndpointNetworking — Unique identifiers for this endpoint from outside cilium - `addressing` AddressPair[] — IP4/6 addresses assigned to this Endpoint - `ipv4` string — IPv4 address - `ipv4-expiration-uuid` string — UUID of IPv4 expiration timer - `ipv4-pool-name` string — IPAM pool from which this IPv4 address was allocated - `ipv6` string — IPv6 address - `ipv6-expiration-uuid` string — UUID of IPv6 expiration timer - `ipv6-pool-name` string — IPAM pool from which this IPv6 address was allocated - `host-addressing` NodeAddressing — Addressing information of a node for all address families +k8s:deepcopy-gen=true - `ipv6` NodeAddressingElement — Addressing information - `enabled` boolean — True if address family is enabled - `ip` string — IP address of node - `alloc-range` string — Address pool to be used for local endpoints - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP - `ipv4` NodeAddressingElement — Addressing information - `enabled` boolean — True if address family is enabled - `ip` string — IP address of node - `alloc-range` string — Address pool to be used for local endpoints - `address-type` string — Node address type, one of HostName, ExternalIP or InternalIP - `host-mac` string — MAC address - `mac` string — MAC address - `interface-name` string — Name of network device in host netns - `interface-index` integer — Index of network device in host netns - `container-interface-name` string — Name of network device in container netns - `policy` EndpointPolicyStatus — Policy information of an endpoint - `spec` EndpointPolicy — Policy information of an endpoint - `policy-revision` integer — The agent-local policy revision - `id` integer — Own identity of endpoint - `policy-enabled` 'none' | 'ingress' | 'egress' | 'both' | 'audit-ingress' | 'audit-egress' | 'audit-both' — Whether policy enforcement is enabled (ingress, egress, both or none) - `build` integer — Build number of calculated policy in use - `allowed-ingress-identities` integer[] — List of identities allowed to communicate to this endpoint - `denied-ingress-identities` integer[] — List of identities not allowed to communicate to this endpoint - `allowed-egress-identities` integer[] — List of identities to which this endpoint is allowed to communicate - `denied-egress-identities` integer[] — List of identities to which this endpoint is not allowed to communicate - `l4` L4Policy — L4 endpoint policy - `ingress` PolicyRule[] — List of L4 ingress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `egress` PolicyRule[] — List of L4 egress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `cidr-policy` CIDRPolicy — CIDR endpoint policy - `ingress` PolicyRule[] — List of CIDR ingress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `egress` PolicyRule[] — List of CIDR egress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `realized` EndpointPolicy — Policy information of an endpoint - `policy-revision` integer — The agent-local policy revision - `id` integer — Own identity of endpoint - `policy-enabled` 'none' | 'ingress' | 'egress' | 'both' | 'audit-ingress' | 'audit-egress' | 'audit-both' — Whether policy enforcement is enabled (ingress, egress, both or none) - `build` integer — Build number of calculated policy in use - `allowed-ingress-identities` integer[] — List of identities allowed to communicate to this endpoint - `denied-ingress-identities` integer[] — List of identities not allowed to communicate to this endpoint - `allowed-egress-identities` integer[] — List of identities to which this endpoint is allowed to communicate - `denied-egress-identities` integer[] — List of identities to which this endpoint is not allowed to communicate - `l4` L4Policy — L4 endpoint policy - `ingress` PolicyRule[] — List of L4 ingress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `egress` PolicyRule[] — List of L4 egress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `cidr-policy` CIDRPolicy — CIDR endpoint policy - `ingress` PolicyRule[] — List of CIDR ingress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `egress` PolicyRule[] — List of CIDR egress rules - `rule` string — The policy rule as json - `derived-from-rules` array[] — The policy rule labels identifying the policy rules this rule derives from - … - `rules-by-selector` object — The policy rule labels identifying the policy rules this rule derives from, mapped by selector - `proxy-policy-revision` integer — The policy revision currently enforced in the proxy for this endpoint - `proxy-statistics` ProxyStatistics[] — Statistics of the proxy redirects configured for this endpoint - `protocol` string — Name of the L7 protocol - `port` integer — The port subject to the redirect - `allocated-proxy-port` integer — The port the proxy is listening on - `location` 'ingress' | 'egress' — Location of where the redirect is installed - `statistics` RequestResponseStatistics — Statistics of a proxy redirect +k8s:deepcopy-gen=true - `requests` MessageForwardingStatistics — Statistics of a message forwarding entity - `received` integer — Number of messages received - `denied` integer — Number of messages denied - `error` integer — Number of errors while parsing messages - `forwarded` integer — Number of messages forwarded - `responses` MessageForwardingStatistics — Statistics of a message forwarding entity - `received` integer — Number of messages received - `denied` integer — Number of messages denied - `error` integer — Number of errors while parsing messages - `forwarded` integer — Number of messages forwarded - `log` EndpointStatusChange[] — Status log of endpoint - `timestamp` string — Timestamp when status change occurred - `code` 'ok' | 'failed' — Code indicate type of status change - `message` string — Status message - `state` 'waiting-for-identity' | 'not-ready' | 'waiting-to-regenerate' | 'regenerating' | 'restoring' | 'ready' | 'disconnecting' | 'disconnected' | 'invalid' — State of endpoint - `controllers` ControllerStatus[] — Collection of controller statuses - `name` string — Name of controller - `uuid` string, uuid — UUID of controller - `configuration` object — Configuration of controller +deepequal-gen=true +k8s:deepcopy-gen=true - `interval` string, duration — Regular synchronization interval - `error-retry-base` string, duration — Base error retry back-off time - `error-retry` boolean — Retry on error - `status` object — Current status of controller +k8s:deepcopy-gen=true - `success-count` integer — Total number of successful runs - `last-success-timestamp` string, date-time — Timestamp of last success - `failure-count` integer — Total number of failed runs - `last-failure-timestamp` string, date-time — Timestamp of last error - `consecutive-failure-count` integer — Number of consecutive errors since last success - `last-failure-msg` string — Error message of last failed run - `state` 'waiting-for-identity' | 'not-ready' | 'waiting-to-regenerate' | 'regenerating' | 'restoring' | 'ready' | 'disconnecting' | 'disconnected' | 'invalid', required — State of endpoint - `health` EndpointHealth — Health of the endpoint +deepequal-gen=true - `overallHealth` 'OK' | 'Bootstrap' | 'Pending' | 'Warning' | 'Failure' | 'Disabled' — A common set of statuses for endpoint health * ``OK`` = All components operational * ``Bootstrap`` = This component is being created * ``Pending`` = A change is being processed to be applied * ``Warning`` = This component is not applying up-to-date policies (but is still applying the previous version) * ``Failure`` = An error has occurred and no policy is being applied * ``Disabled`` = This endpoint is disabled and will not handle traffic - `bpf` 'OK' | 'Bootstrap' | 'Pending' | 'Warning' | 'Failure' | 'Disabled' — A common set of statuses for endpoint health * ``OK`` = All components operational * ``Bootstrap`` = This component is being created * ``Pending`` = A change is being processed to be applied * ``Warning`` = This component is not applying up-to-date policies (but is still applying the previous version) * ``Failure`` = An error has occurred and no policy is being applied * ``Disabled`` = This endpoint is disabled and will not handle traffic - `policy` 'OK' | 'Bootstrap' | 'Pending' | 'Warning' | 'Failure' | 'Disabled' — A common set of statuses for endpoint health * ``OK`` = All components operational * ``Bootstrap`` = This component is being created * ``Pending`` = A change is being processed to be applied * ``Warning`` = This component is not applying up-to-date policies (but is still applying the previous version) * ``Failure`` = An error has occurred and no policy is being applied * ``Disabled`` = This endpoint is disabled and will not handle traffic - `connected` boolean — Is this endpoint reachable - `namedPorts` Port[] — List of named Layer 4 port and protocol pairs which will be used in Network Policy specs. +deepequal-gen=true +k8s:deepcopy-gen=true - `protocol` 'TCP' | 'UDP' | 'SCTP' | 'ICMP' | 'ICMPV6' | 'ANY' — Layer 4 protocol - `port` integer — Layer 4 port number - `name` string — Optional layer 4 port name ## Other responses - `400` — Invalid endpoint in request - `403` — Forbidden - `409` — Endpoint already exists - `429` — Rate-limiting too many requests in the given time frame - `500` — Endpoint creation failed - `503` — Service Unavailable --- [API](https://skmtc.net/cilium/apis/cilium-api.md) · [All operations](https://skmtc.net/cilium/apis/cilium-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cilium/cilium-api/versions/351336b27221/schema)