{"record":{"id":"012816939039f392","repo":"cilium/cilium","slug":"failed-to-add-internal-ip-address-to-s-w","errorCode":null,"errorMessage":"failed to add internal IP address to %s: %w","messagePattern":"failed to add internal IP address to (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/datapath/loader/base.go","lineNumber":374,"sourceCode":"\n\tif option.Config.IPAM == ipamOption.IPAMENI {\n\t\tvar err error\n\t\tif sysSettings, err = addIPv4ENIRules(l.logger, sysSettings); err != nil {\n\t\t\treturn fmt.Errorf(\"unable to install ip rule for ENI multi-node NodePort: %w\", err)\n\t\t}\n\t\tif err = addIPv6ENIRules(); err != nil {\n\t\t\treturn fmt.Errorf(\"unable to install ipv6 ip rule for ENI multi-node NodePort: %w\", err)\n\t\t}\n\t}\n\n\t// Any code that relies on sysctl settings being applied needs to be called after this.\n\tif err := l.sysctl.ApplySettings(sysSettings); err != nil {\n\t\treturn err\n\t}\n\n\t// add internal ipv4 and ipv6 addresses to cilium_host\n\tif err := addHostDeviceAddr(hostDev1, internalIPv4, internalIPv6); err != nil {\n\t\treturn fmt.Errorf(\"failed to add internal IP address to %s: %w\", hostDev1.Attrs().Name, err)\n\t}\n\n\tdevices := lnc.DeviceNames()\n\tif err := cleanIngressQdisc(l.logger, devices); err != nil {\n\t\tl.logger.Warn(\"Unable to clean up ingress qdiscs\", logfields.Error, err)\n\t\treturn err\n\t}\n\n\tif err := l.writeNodeConfigHeader(lnc); err != nil {\n\t\tl.logger.Error(\"Unable to write node config header\", logfields.Error, err)\n\t\treturn err\n\t}\n\n\tif err := l.writeNetdevHeader(\"./\"); err != nil {\n\t\tl.logger.Warn(\"Unable to write netdev header\", logfields.Error, err)\n\t\treturn err\n\t}\n","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/loader/base.go#L356-L392","documentation":"After sysctls are applied, Reinitialize assigns the node's internal IPv4/IPv6 addresses (router IPs) to the cilium_host device via addHostDeviceAddr. Failure to add either address is wrapped with the device name. Without the internal IPs on cilium_host, host-originated and routed pod traffic cannot work.","triggerScenarios":"Reinitialize runs and addHostDeviceAddr fails adding internalIPv4 or internalIPv6 to cilium_host: netlink.AddrAdd returns an error such as permission denied, address already assigned with different scope, or the IP is invalid/duplicated on the link.","commonSituations":"Stale cilium_host from a prior run holding a conflicting address (RTNETLINK answers: File exists); agent missing CAP_NET_ADMIN; node IP changed after IPAM reallocation so the old internal IP conflicts; restart loops leaving the device half-configured.","solutions":["Check the wrapped inner error: 'File exists' indicates a conflicting address on cilium_host","Inspect 'ip addr show cilium_host' and remove stale/incorrect addresses ('ip addr del <ip> dev cilium_host')","Restart the agent so Reinitialize re-runs with current IPAM-allocated internal IPs","Ensure the agent runs with CAP_NET_ADMIN in the host netns","Verify the node's CiliumInternalIP from 'cilium status' matches the address being assigned"],"exampleFix":"# before: stale address conflicts\n$ ip addr show cilium_host\n  inet 10.0.0.99/32 scope global (stale)\n# after\n$ ip addr del 10.0.0.99/32 dev cilium_host\n$ kubectl -n kube-system rollout restart ds/cilium","handlingStrategy":"validation","validationCode":"func checkCiliumHostAddrs(internalIPv4 net.IP) error {\n\tlink, err := netlink.LinkByName(\"cilium_host\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cilium_host missing: %w\", err)\n\t}\n\taddrs, err := netlink.AddrList(link, netlink.FAMILY_V4)\n\tif err != nil {\n\t\treturn err\n\t}\n\tfor _, a := range addrs {\n\t\tif a.IP.Equal(internalIPv4) && a.IPNet.String() != internalIPv4.String()+\"/32\" {\n\t\t\treturn fmt.Errorf(\"conflicting address %s on cilium_host; delete stale address\", a.IP)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := loader.Reinitialize(ctx, lnc, tc, iptMgr, p, bt); err != nil {\n\tif strings.Contains(err.Error(), \"failed to add internal IP address to\") {\n\t\t// name the device from the message and clean conflicting addrs\n\t\treturn fmt.Errorf(\"clean stale cilium_host addresses and restart: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Inspect cilium_host addresses for stale/conflicting entries before restarts","Ensure CAP_NET_ADMIN so AddrAdd can succeed","Keep node identity/internal IPs consistent with IPAM allocation","Full agent restart (not partial reinit) after IPAM reallocation events"],"tags":["network","netlink","ip-address","datapath","cilium"],"backgroundTag":"ip-address-assignment-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}