Cilium

root@node5:~# bpftool feature probe | grep map_type
eBPF map_type hash is available
eBPF map_type array is available
eBPF map_type prog_array is available
eBPF map_type perf_event_array is available
eBPF map_type percpu_hash is available
eBPF map_type percpu_array is available
eBPF map_type stack_trace is available
eBPF map_type cgroup_array is available
eBPF map_type lru_hash is available
eBPF map_type lru_percpu_hash is available
eBPF map_type lpm_trie is available
eBPF map_type array_of_maps is available
eBPF map_type hash_of_maps is available
eBPF map_type devmap is available
eBPF map_type sockmap is available
eBPF map_type cpumap is available
eBPF map_type xskmap is available
eBPF map_type sockhash is available
eBPF map_type cgroup_storage is available
eBPF map_type reuseport_sockarray is available
eBPF map_type percpu_cgroup_storage is available
eBPF map_type queue is available
eBPF map_type stack is available
eBPF map_type sk_storage is available
eBPF map_type devmap_hash is available
eBPF map_type struct_ops is available
eBPF map_type ringbuf is available
eBPF map_type inode_storage is available
eBPF map_type task_storage is available
eBPF map_type bloom_filter is available
eBPF map_type user_ringbuf is available
eBPF map_type cgrp_storage is available

# 查询当前系统支持的程序类型
root@node5:~# bpftool feature probe | grep program_type
eBPF program_type socket_filter is available
eBPF program_type kprobe is available
eBPF program_type sched_cls is available
eBPF program_type sched_act is available
eBPF program_type tracepoint is available
eBPF program_type xdp is available
eBPF program_type perf_event is available
eBPF program_type cgroup_skb is available
eBPF program_type cgroup_sock is available
eBPF program_type lwt_in is available
eBPF program_type lwt_out is available
eBPF program_type lwt_xmit is available
eBPF program_type sock_ops is available
eBPF program_type sk_skb is available
eBPF program_type cgroup_device is available
eBPF program_type sk_msg is available
eBPF program_type raw_tracepoint is available
eBPF program_type cgroup_sock_addr is available
eBPF program_type lwt_seg6local is available
eBPF program_type lirc_mode2 is NOT available
eBPF program_type sk_reuseport is available
eBPF program_type flow_dissector is available
eBPF program_type cgroup_sysctl is available
eBPF program_type raw_tracepoint_writable is available
eBPF program_type cgroup_sockopt is available
eBPF program_type tracing is available
eBPF program_type struct_ops is available
eBPF program_type ext is available
eBPF program_type lsm is available
eBPF program_type sk_lookup is available
eBPF program_type syscall is available
eBPF program_type netfilter is available

# 查看现有的队列
root@node1:~# tc -s qdisc ls dev ens32
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 435417331994 bytes 895868720 pkt (dropped 0, overlimits 0 requeues 302340)
 backlog 0b 0p requeues 302340

root@node1:/opt/cilium# tree -L 1  bpf/
bpf/
├── bpf_alignchecker.c # C与Go的消息结构体格式校验
├── bpf_host.c  # 物理层的网卡tc ingress\egress相关过滤器
├── bpf_lxc.c # 容器上的网络环境、网络流量管控等
├── bpf_network.c # 网络控制相关
├── bpf_overlay.c # overlay 控制代码
├── bpf_sock.c # sock控制相关，包含流量大小控制、TCP状态变化控制
├── bpf_xdp.c # DP层控制相关
├── complexity-tests
├── COPYING
├── custom
├── ep_config.h
├── filter_config.h
├── include
├── lib
├── LICENSE.BSD-2-Clause
├── LICENSE.GPL-2.0
├── Makefile
├── Makefile.bpf
├── netdev_config.h
├── node_config.h
├── source_names_to_ids.h
└── tests

(⎈|kubeasz-test:nfs)➜  ~ kubectl get ciliumnode
NAME    CILIUMINTERNALIP   INTERNALIP    AGE
node1   10.233.66.89       172.16.7.30   24d
node2   10.233.64.85       172.16.7.31   24d
node3   10.233.65.143      172.16.7.32   24d
node4   10.233.68.229      172.16.7.33   24d
node5   10.233.67.96       172.16.7.34   24d
node6   10.233.69.139      172.16.7.35   23d

(⎈|kubeasz-test:monitoring)➜  ~ kubectl get cn node1 -o yaml
apiVersion: cilium.io/v2
kind: CiliumNode
metadata:
  creationTimestamp: "2025-08-20T07:05:10Z"
  generation: 33
  labels:
    beta.kubernetes.io/arch: amd64
    beta.kubernetes.io/os: linux
    kubernetes.io/arch: amd64
    kubernetes.io/hostname: node1
    kubernetes.io/os: linux
    node-role.kubernetes.io/control-plane: ""
    node.kubernetes.io/exclude-from-external-load-balancers: ""
    openebs.io/nodename: node1
  name: node1
  ownerReferences:
  - apiVersion: v1
    kind: Node
    name: node1
    uid: add1b2b6-5a4d-4882-9c52-be844c221253
  resourceVersion: "13826717"
  uid: 34624aac-196e-4e8a-a9d7-c8f0d3813f0e
spec:
  addresses:
  - ip: 172.16.7.30
    type: InternalIP
  - ip: 10.233.66.89
    type: CiliumInternalIP
  alibaba-cloud: {}
  azure: {}
  bootid: 5c26c664-8df0-4385-90f6-ace4c9cc9e80
  encryption: {}
  eni: {}
  health:
    ipv4: 10.233.66.85
  ingress: {}
  ipam:
    podCIDRs:
    - 10.233.66.0/24
    pools: {}
status:
  alibaba-cloud: {}
  azure: {}
  eni: {}
  ipam:
    operator-status: {}

apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:
  routing-mode: tunnel
  tunnel-protocol: vxlan

root@node6:~# ip --detail link show cilium_vxlan
7: cilium_vxlan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether ba:41:db:f7:e0:e1 brd ff:ff:ff:ff:ff:ff promiscuity 0  allmulti 0 minmtu 68 maxmtu 65535
    vxlan external id 0 srcport 0 0 dstport 8472 nolearning ttl auto ageing 300 udpcsum noudp6zerocsumtx noudp6zerocsumrx addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 65536 tso_max_segs 65535 gro_max_size 65536

root@node6:/home/cilium# ip route
default via 172.16.0.254 dev ens32 proto static
10.233.64.0/24 via 10.233.69.139 dev cilium_host proto kernel src 10.233.69.139 mtu 1450
10.233.65.0/24 via 10.233.69.139 dev cilium_host proto kernel src 10.233.69.139 mtu 1450
10.233.66.0/24 via 10.233.69.139 dev cilium_host proto kernel src 10.233.69.139 mtu 1450
10.233.67.0/24 via 10.233.69.139 dev cilium_host proto kernel src 10.233.69.139 mtu 1450
10.233.68.0/24 via 10.233.69.139 dev cilium_host proto kernel src 10.233.69.139 mtu 1450
10.233.69.0/24 via 10.233.69.139 dev cilium_host proto kernel src 10.233.69.139
10.233.69.139 dev cilium_host proto kernel scope link
172.16.0.0/16 dev ens32 proto kernel scope link src 172.16.7.35

root@node6:/home/cilium# ip addr ls
5: cilium_net@cilium_host: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether be:ef:8a:3c:d5:99 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::bcef:8aff:fe3c:d599/64 scope link
       valid_lft forever preferred_lft forever
6: cilium_host@cilium_net: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether ea:5e:98:86:cd:e2 brd ff:ff:ff:ff:ff:ff
    inet 10.233.69.139/32 scope global cilium_host
       valid_lft forever preferred_lft forever
    inet6 fe80::e85e:98ff:fe86:cde2/64 scope link
       valid_lft forever preferred_lft forever

# cilium_host 和  cilium_net 是一对
root@node6:/home/cilium# ip link ls

5: cilium_net@cilium_host: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether be:ef:8a:3c:d5:99 brd ff:ff:ff:ff:ff:ff
6: cilium_host@cilium_net: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether ea:5e:98:86:cd:e2 brd ff:ff:ff:ff:ff:ff

// plugins/cilium-cni/cmd/cmd.go
func (cmd *Cmd) Add(args *skel.CmdArgs) (err error) {
	//  1. 从args中加载相应的网络配置
	n, err := types.LoadNetConf(args.StdinData)
	if err != nil {
		return fmt.Errorf("unable to parse CNI configuration %q: %w", string(args.StdinData), err)
	}

    // ...

	cniArgs := &types.ArgsSpec{}
	if err = cniTypes.LoadArgs(args.Args, cniArgs); err != nil {
		return fmt.Errorf("unable to extract CNI arguments: %w", err)
	}
	scopedLogger = buildLogAttrsWithCNIArgs(scopedLogger, cniArgs)

	c, err := client.NewDefaultClientWithTimeout(defaults.ClientConnectTimeout)
	if err != nil {
		return fmt.Errorf("unable to connect to Cilium agent: %w", client.Hint(err))
	}

	conf, err := getConfigFromCiliumAgent(c)
	if err != nil {
		return err
	}

    // ...

	for _, epConf := range configs {
		if err = ns.Do(func() error {
			return link.DeleteByName(epConf.IfName())
		}); err != nil {
			return fmt.Errorf("failed removing interface %q from namespace %q: %w",
				epConf.IfName(), args.Netns, err)
		}

		var ipam *models.IPAMResponse
		var releaseIPsFunc func(context.Context)
		// 获取 ipam 信息
		if conf.IpamMode == ipamOption.IPAMDelegatedPlugin {
			ipam, releaseIPsFunc, err = allocateIPsWithDelegatedPlugin(context.TODO(), conf, n, args.StdinData)
		} else {
			ipam, releaseIPsFunc, err = allocateIPsWithCiliumAgent(scopedLogger, c, cniArgs, epConf.IPAMPool())
		}

		// release addresses on failure
		defer func() {
			if err != nil && releaseIPsFunc != nil {
				releaseIPsFunc(context.TODO())
			}
		}()

		if err != nil {
			return err
		}

		if err = connector.SufficientAddressing(ipam.HostAddressing); err != nil {
			return fmt.Errorf("IP allocation addressing is insufficient: %w", err)
		}

		if !ipv6IsEnabled(ipam) && !ipv4IsEnabled(ipam) {
			return errors.New("IPAM did provide neither IPv4 nor IPv6 address")
		}

		state, ep, err := epConf.PrepareEndpoint(ipam)
		if err != nil {
			return fmt.Errorf("unable to prepare endpoint configuration: %w", err)
		}

		cniID := ep.ContainerID + ":" + ep.ContainerInterfaceName
		linkConfig := connector.LinkConfig{
			GROIPv6MaxSize: int(conf.GROMaxSize),
			GSOIPv6MaxSize: int(conf.GSOMaxSize),
			GROIPv4MaxSize: int(conf.GROIPV4MaxSize),
			GSOIPv4MaxSize: int(conf.GSOIPV4MaxSize),
			DeviceMTU:      int(conf.DeviceMTU),
		}
		var hostLink, epLink netlink.Link
		var tmpIfName string
		var l2Mode bool
        // 3. 根据配置的模式, 选择对应的设备初始化方式
		switch conf.DatapathMode {
		case datapathOption.DatapathModeVeth:
			l2Mode = true
			hostLink, epLink, tmpIfName, err = connector.SetupVeth(scopedLogger, cniID, linkConfig, sysctl)
		case datapathOption.DatapathModeNetkit, datapathOption.DatapathModeNetkitL2:
			l2Mode = conf.DatapathMode == datapathOption.DatapathModeNetkitL2
			hostLink, epLink, tmpIfName, err = connector.SetupNetkit(scopedLogger, cniID, linkConfig, l2Mode, sysctl)
		}
		if err != nil {
			return fmt.Errorf("unable to set up link on host side: %w", err)
		}
		defer func() {
			if err != nil {
				if err2 := netlink.LinkDel(hostLink); err2 != nil {
					scopedLogger.Warn(
						"Failed to clean up and delete link",
						logfields.Error, err2,
						logfields.Veth, hostLink.Attrs().Name,
					)
				}
			}
		}()

		iface := &cniTypesV1.Interface{
			Name: hostLink.Attrs().Name,
		}
		if l2Mode {
			iface.Mac = hostLink.Attrs().HardwareAddr.String()
		}
		res.Interfaces = append(res.Interfaces, iface)

		// CNI插件将对端veth放置到容器所在的网络空间中
		if err := netlink.LinkSetNsFd(epLink, ns.FD()); err != nil {
			return fmt.Errorf("unable to move netkit pair %q to netns %s: %w", epLink, args.Netns, err)
		}
		// 重命名对端设备,会将容器内的veth从tmp53057 重命名为eth0
		err = connector.RenameLinkInRemoteNs(ns, tmpIfName, epConf.IfName())
		if err != nil {
			return fmt.Errorf("unable to set up netkit on container side: %w", err)
		}

		if l2Mode {
			ep.Mac = epLink.Attrs().HardwareAddr.String()
			ep.HostMac = hostLink.Attrs().HardwareAddr.String()
		}
		ep.InterfaceIndex = int64(hostLink.Attrs().Index)
		ep.InterfaceName = hostLink.Attrs().Name

		var (
			ipConfig   *cniTypesV1.IPConfig
			ipv6Config *cniTypesV1.IPConfig
			routes     []*cniTypes.Route
		)
        // ...

		if ipv4IsEnabled(ipam) && conf.Addressing.IPV4 != nil {
			ep.Addressing.IPV4 = ipam.Address.IPV4
			ep.Addressing.IPV4PoolName = ipam.Address.IPV4PoolName
			ep.Addressing.IPV4ExpirationUUID = ipam.IPV4.ExpirationUUID

			// 准备 IP 配置信息
			ipConfig, routes, err = prepareIP(ep.Addressing.IPV4, state, int(conf.RouteMTU))
			if err != nil {
				return fmt.Errorf("unable to prepare IP addressing for %s: %w", ep.Addressing.IPV4, err)
			}
			// set the addresses interface index to that of the container-side interface
			ipConfig.Interface = cniTypesV1.Int(len(res.Interfaces))
			res.IPs = append(res.IPs, ipConfig)
			res.Routes = append(res.Routes, routes...)
		}

		if needsEndpointRoutingOnHost(conf) {
			if ipam.IPV4 != nil && ipConfig != nil {
				err = interfaceAdd(scopedLogger, ipConfig, ipam.IPV4, conf)
				if err != nil {
					return fmt.Errorf("unable to setup interface datapath: %w", err)
				}
			}

			if ipam.IPV6 != nil && ipv6Config != nil {
				err = interfaceAdd(scopedLogger, ipv6Config, ipam.IPV6, conf)
				if err != nil {
					return fmt.Errorf("unable to setup interface datapath: %w", err)
				}
			}
		}

		var macAddrStr string

		if err = ns.Do(func() error {
			if err := reserveLocalIPPorts(conf, sysctl); err != nil {
				scopedLogger.Warn(
					"Unable to reserve local ip ports",
					logfields.Error, err,
				)
			}

            // 4. 分配IP给Pod的网络设备
			macAddrStr, err = configureIface(scopedLogger, ipam, epConf.IfName(), state)
			return err
		}); err != nil {
			return fmt.Errorf("unable to configure interfaces in container namespace: %w", err)
		}

		var cookie uint64
		if getNetnsCookie {
			if err = ns.Do(func() error {
				cookie, err = netns.GetNetNSCookie()
				return err
			}); err != nil {
				if errors.Is(err, unix.ENOPROTOOPT) {
					getNetnsCookie = false
				}
				scopedLogger.Info(
					"Unable to get netns cookie",
					logfields.Error, err,
					logfields.ContainerID, args.ContainerID,
				)
			}
		}
		ep.NetnsCookie = strconv.FormatUint(cookie, 10)

		// Specify that endpoint must be regenerated synchronously. See GH-4409.
		ep.SyncBuildEndpoint = true
		var newEp *models.Endpoint
		// 创建endpoint对象
		if newEp, err = c.EndpointCreate(ep); err != nil {
			scopedLogger.Warn(
				"Unable to create endpoint",
				logfields.Error, err,
				logfields.ContainerID, ep.ContainerID,
			)
			return fmt.Errorf("unable to create endpoint: %w", err)
		}
		if newEp != nil && newEp.Status != nil && newEp.Status.Networking != nil && newEp.Status.Networking.Mac != "" {
			// Set the MAC address on the interface in the container namespace
			if conf.DatapathMode != datapathOption.DatapathModeNetkit {
				err = ns.Do(func() error {
					return mac.ReplaceMacAddressWithLinkName(args.IfName, newEp.Status.Networking.Mac)
				})
				if err != nil {
					return fmt.Errorf("unable to set MAC address on interface %s: %w", args.IfName, err)
				}
			}
			macAddrStr = newEp.Status.Networking.Mac
		}
		if err = ns.Do(func() error {
			return configureCongestionControl(conf, sysctl)
		}); err != nil {
			return fmt.Errorf("unable to configure congestion control: %w", err)
		}
		res.Interfaces = append(res.Interfaces, &cniTypesV1.Interface{
			Name:    epConf.IfName(),
			Mac:     macAddrStr,
			Sandbox: args.Netns,
		})
		scopedLogger.Debug(
			"Endpoint successfully created",
			logfields.Error, err,
			logfields.ContainerID, ep.ContainerID,
		)
	}

	return cniTypes.PrintResult(res, n.CNIVersion)
}

~ kubectl get ciliumendpoint -n monitoring
NAME                                           SECURITY IDENTITY   ENDPOINT STATE   IPV4            IPV6
alertmanager-main-0                            17144               ready            10.233.67.49
alertmanager-main-1                            17144               ready            10.233.68.15

// pkg/endpoint/api/endpoint_api_manager.go

// HTTP Handle 创建Endpoint对象
func (m *endpointAPIManager) CreateEndpoint(ctx context.Context, epTemplate *models.EndpointChangeRequest) (*endpoint.Endpoint, int, error) {
    // ...

	// We don't need to create the endpoint with the labels. This might cause
	// the endpoint regeneration to not be triggered further down, with the
	// ep.UpdateLabels or the ep.RunMetadataResolver, because the regeneration
	// is only triggered in case the labels are changed, which they might not
	// change because NewEndpointFromChangeModel would contain the
	// epTemplate.Labels, the same labels we would be calling ep.UpdateLabels or
	// the ep.RunMetadataResolver.
	apiLabels := labels.NewLabelsFromModel(epTemplate.Labels)
	epTemplate.Labels = nil

	ep, err := m.endpointCreator.NewEndpointFromChangeModel(ctx, epTemplate)
	if err != nil {
		return invalidDataError(ep, fmt.Errorf("unable to parse endpoint parameters: %w", err))
	}

	oldEp := m.endpointManager.LookupCiliumID(ep.ID)
	if oldEp != nil {
		return invalidDataError(ep, fmt.Errorf("endpoint ID %d already exists", ep.ID))
	}

	oldEp = m.endpointManager.LookupCNIAttachmentID(ep.GetCNIAttachmentID())
	if oldEp != nil {
		return invalidDataError(ep, fmt.Errorf("endpoint for CNI attachment ID %s already exists", ep.GetCNIAttachmentID()))
	}

	// 这个端点的ID并校验它是否合法
	var checkIDs []string

	if ep.IPv4.IsValid() {
		checkIDs = append(checkIDs, endpointid.NewID(endpointid.IPv4Prefix, ep.IPv4.String()))
	}

	if ep.IPv6.IsValid() {
		checkIDs = append(checkIDs, endpointid.NewID(endpointid.IPv6Prefix, ep.IPv6.String()))
	}

	for _, id := range checkIDs {
		oldEp, err := m.endpointManager.Lookup(id)
		if err != nil {
			return invalidDataError(ep, err)
		} else if oldEp != nil {
			return invalidDataError(ep, fmt.Errorf("IP %s is already in use", id))
		}
	}

	if err = endpoint.APICanModify(ep); err != nil {
		return invalidDataError(ep, err)
	}

	infoLabels := labels.NewLabelsFromModel([]string{})

	if len(apiLabels) > 0 {
		if lbls := apiLabels.FindReserved(); lbls != nil {
			return invalidDataError(ep, fmt.Errorf("not allowed to add reserved labels: %s", lbls))
		}

		apiLabels, _ = labelsfilter.Filter(apiLabels)
		if len(apiLabels) == 0 {
			return invalidDataError(ep, fmt.Errorf("no valid labels provided"))
		}
	}

	var cancel context.CancelFunc
	ctx, cancel = context.WithCancel(ctx)
	m.endpointCreations.NewCreateRequest(ep, cancel)
	defer m.endpointCreations.EndCreateRequest(ep)

	identityLbls := maps.Clone(apiLabels)

	if ep.K8sNamespaceAndPodNameIsSet() && m.clientset.IsEnabled() {
		pod, k8sMetadata, err := m.handleOutdatedPodInformer(ctx, ep)
		if errors.Is(err, endpointmetadata.ErrPodStoreOutdated) {
            // ...
		}

		if err != nil {
			ep.Logger("api").Warn("Unable to fetch kubernetes labels", logfields.Error, err)
		} else {
			ep.SetPod(pod)
			ep.SetK8sMetadata(k8sMetadata.ContainerPorts)
			identityLbls.MergeLabels(k8sMetadata.IdentityLabels)
			infoLabels.MergeLabels(k8sMetadata.InfoLabels)
			if _, ok := pod.Annotations[bandwidth.IngressBandwidth]; ok && !m.bandwidthManager.Enabled() {
				m.logger.Warn("Endpoint has bandwidth annotation, but BPF bandwidth manager is disabled. This annotation is ignored.",
					logfields.K8sPodName, epTemplate.K8sNamespace+"/"+epTemplate.K8sPodName,
					logfields.Annotation, bandwidth.IngressBandwidth,
					logfields.Annotations, pod.Annotations,
				)
			}
			if _, ok := pod.Annotations[bandwidth.EgressBandwidth]; ok && !m.bandwidthManager.Enabled() {
				m.logger.Warn("Endpoint has %s annotation, but BPF bandwidth manager is disabled. This annotation is ignored.",
					logfields.K8sPodName, epTemplate.K8sNamespace+"/"+epTemplate.K8sPodName,
					logfields.Annotation, bandwidth.EgressBandwidth,
					logfields.Annotations, pod.Annotations,
				)
			}
			if hwAddr, ok := pod.Annotations[annotation.PodAnnotationMAC]; !ep.GetDisableLegacyIdentifiers() && ok {
				mac, err := mac.ParseMAC(hwAddr)
				if err != nil {
					m.logger.Error("Unable to parse MAC address",
						logfields.Error, err,
						logfields.K8sPodName, epTemplate.K8sNamespace+"/"+epTemplate.K8sPodName,
					)
					return invalidDataError(ep, err)
				}
				ep.SetMac(mac)
			}
		}
	}

	// The following docs describe the cases where the init identity is used:
	// http://docs.cilium.io/en/latest/policy/lifecycle/#init-identity
	if len(identityLbls) == 0 {
		// If the endpoint has no labels, give the endpoint a special identity with
		// label reserved:init so we can generate a custom policy for it until we
		// get its actual identity.
		identityLbls = labels.Labels{
			labels.IDNameInit: labels.NewLabel(labels.IDNameInit, "", labels.LabelSourceReserved),
		}
	}

	// e.ID assigned here
	err = m.endpointManager.AddEndpoint(ep)
	if err != nil {
		return m.errorDuringCreation(ep, fmt.Errorf("unable to insert endpoint into manager: %w", err))
	}

	var regenTriggered bool
	if ep.K8sNamespaceAndPodNameIsSet() && m.clientset.IsEnabled() {
		// We need to refetch the pod labels again because we have just added
		// the endpoint into the endpoint manager. If we have received any pod
		// events, more specifically any events that modified the pod labels,
		// between the time the pod was created and the time it was added
		// into the endpoint manager, the pod event would not have been processed
		// since the pod event handler would not find the endpoint for that pod
		// in the endpoint manager. Thus, we will fetch the labels again
		// and update the endpoint with these labels.
		// Wait for the regeneration to be triggered before continuing.
		regenTriggered = ep.RunMetadataResolver(false, true, apiLabels, m.endpointMetadata.FetchK8sMetadataForEndpoint)
	} else {
		regenTriggered = ep.UpdateLabels(ctx, labels.LabelSourceAny, identityLbls, infoLabels, true)
	}

	select {
	case <-ctx.Done():
		return m.errorDuringCreation(ep, fmt.Errorf("request cancelled while resolving identity"))
	default:
	}

	if !regenTriggered {
		regenMetadata := &regeneration.ExternalRegenerationMetadata{
			Reason:            "Initial build on endpoint creation",
			ParentContext:     ctx,
			RegenerationLevel: regeneration.RegenerateWithDatapath,
		}
		build, err := ep.SetRegenerateStateIfAlive(regenMetadata)
		if err != nil {
			return m.errorDuringCreation(ep, err)
		}
		if build {
			ep.Regenerate(regenMetadata)
		}
	}

	if epTemplate.SyncBuildEndpoint {
		if err := ep.WaitForFirstRegeneration(ctx); err != nil {
			return m.errorDuringCreation(ep, err)
		}
	}

	// The endpoint has been successfully created, stop the expiration
	// timers of all attached IPs
	if addressing := epTemplate.Addressing; addressing != nil {
		if uuid := addressing.IPV4ExpirationUUID; uuid != "" {
			if ip := net.ParseIP(addressing.IPV4); ip != nil {
				pool := ipam.PoolOrDefault(addressing.IPV4PoolName)
				if err := m.ipam.StopExpirationTimer(ip, pool, uuid); err != nil {
					return m.errorDuringCreation(ep, err)
				}
			}
		}
		if uuid := addressing.IPV6ExpirationUUID; uuid != "" {
			if ip := net.ParseIP(addressing.IPV6); ip != nil {
				pool := ipam.PoolOrDefault(addressing.IPV6PoolName)
				if err := m.ipam.StopExpirationTimer(ip, pool, uuid); err != nil {
					return m.errorDuringCreation(ep, err)
				}
			}
		}
	}

	return ep, 0, nil
}

func (mgr *endpointManager) AddEndpoint(ep *endpoint.Endpoint) (err error) {
    // ..

	err = mgr.expose(ep)
    // ...
}


func (mgr *endpointManager) expose(ep *endpoint.Endpoint) error {
	newID, err := mgr.allocateID(ep.ID)
	if err != nil {
		return err
	}

	mgr.mutex.Lock()
	// Get a copy of the identifiers before exposing the endpoint
	identifiers := ep.Identifiers()
	ep.PolicyMapPressureUpdater = mgr.policyMapPressure
	ep.Start(newID)
	mgr.mcastManager.AddAddress(ep.IPv6)
	mgr.updateIDReferenceLocked(ep)
	mgr.updateReferencesLocked(ep, identifiers)
	mgr.mutex.Unlock()

	ep.InitEndpointHealth(mgr.health)
	mgr.RunK8sCiliumEndpointSync(ep, ep.GetReporter("cep-k8s-sync"))

	return nil
}