{"record":{"id":"6d84b6036e2090d7","repo":"cilium/cilium","slug":"invalid-mac-address-q-reported-for-eni-s-w","errorCode":null,"errorMessage":"invalid MAC address %q reported for ENI %s: %w","messagePattern":"invalid MAC address %q reported for ENI (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ipam/crd.go","lineNumber":776,"sourceCode":"\t\t\t\t//\n\t\t\t\t// TODO: Once https://github.com/cilium/cilium/issues/14705 is\n\t\t\t\t// resolved, then we don't need to hardcode this anymore.\n\t\t\t\tresult.InterfaceNumber = \"0\"\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\t\treturn nil, fmt.Errorf(\"unable to find ENI %s\", ipInfo.Resource)\n\n\t// In AlibabaCloud mode, the Resource points to the ENI so we can derive the\n\t// master interface and all CIDRs of the VPC\n\tcase ipamOption.IPAMAlibabaCloud:\n\t\tfor _, eni := range a.store.ownNode.Status.AlibabaCloud.ENIs {\n\t\t\tif eni.NetworkInterfaceID != ipInfo.Resource {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tresult.PrimaryMAC, err = mac.ParseMACOrUnset(eni.MACAddress)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid MAC address %q reported for ENI %s: %w\", eni.MACAddress, eni.NetworkInterfaceID, err)\n\t\t\t}\n\t\t\tif eni.VSwitch.CIDRBlock.IsValid() {\n\t\t\t\tp := eni.VSwitch.CIDRBlock.Prefix\n\t\t\t\tresult.CIDRs = []netip.Prefix{p}\n\n\t\t\t\t// AlibabaCloud reserves the third-to-last IP of the subnet for the gateway.\n\t\t\t\t// Ref: https://www.alibabacloud.com/help/doc-detail/65398.html\n\t\t\t\tresult.GatewayIP = netipx.PrefixLastIP(p).Prev().Prev()\n\t\t\t}\n\t\t\tresult.InterfaceNumber = strconv.Itoa(alibabaCloudTypes.GetENIIndexFromTags(a.logger, eni.Tags))\n\t\t\treturn\n\t\t}\n\t\treturn nil, fmt.Errorf(\"unable to find ENI %s\", ipInfo.Resource)\n\t}\n\n\treturn\n}\n","sourceCodeStart":758,"sourceCodeEnd":794,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ipam/crd.go#L758-L794","documentation":"Analogous to the Azure MAC error but in AlibabaCloud CRD mode: after matching the ENI by NetworkInterfaceID, the ENI's MACAddress is parsed with mac.ParseMACOrUnset to set result.PrimaryMAC. A malformed (non-empty, unparseable) MAC reported in Status.AlibabaCloud.ENIs aborts buildAllocationResult with this wrapped error.","triggerScenarios":"buildAllocationResult in ipamOption.IPAMAlibabaCloud mode: the matching ENI in a.store.ownNode.Status.AlibabaCloud.ENIs has a MACAddress that ParseMACOrUnset rejects (corrupted or placeholder string).","commonSituations":"Stale CiliumNode status from version-skewed operator/agent; AlibabaCloud API metadata anomalies; CRD status edited or patched by external tooling with invalid MAC text.","solutions":["Check status.alibabacloud.enis[].macAddress on the CiliumNode and correct/remove invalid values.","Delete the CiliumNode CR and let cilium-operator recreate it with freshly fetched ENI metadata.","Align cilium-agent and cilium-operator versions to avoid status format mismatches.","Validate against AlibabaCloud API (DescribeNetworkInterfaces) that the MAC is genuinely valid; file a Cilium issue if it is."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cn, _ := ciliumClientset.CiliumV2().CiliumNodes().Get(ctx, nodeName, metav1.GetOptions{})\nfor _, eni := range cn.Status.AlibabaCloud.ENIs {\n    if eni.MACAddress != \"\" {\n        if _, err := net.ParseMAC(eni.MACAddress); err != nil {\n            return fmt.Errorf(\"CiliumNode %s has invalid MAC %q for ENI %s\", nodeName, eni.MACAddress, eni.NetworkInterfaceID)\n        }\n    }\n}","typeGuard":"func validAlibabaMACs(cn *ciliumv2.CiliumNode) bool {\n    for _, eni := range cn.Status.AlibabaCloud.ENIs {\n        if eni.MACAddress == \"\" {\n            continue\n        }\n        if _, err := net.ParseMAC(eni.MACAddress); err != nil {\n            return false\n        }\n    }\n    return true\n}","tryCatchPattern":"result, err := allocator.Allocate(ctx, ip, owner)\nif err != nil && strings.Contains(err.Error(), \"invalid MAC address\") {\n    // recreate CiliumNode to refetch ENI metadata from AlibabaCloud\n    return refreshCiliumNode(ctx, nodeName)\n}","preventionTips":["Avoid hand-editing CiliumNode status fields such as macAddress.","Match agent/operator versions to prevent status serialization differences.","Recreate CiliumNodes with corrupted status rather than patching them in place."],"tags":["ipam","alibabacloud","crd","mac-address","cilium"],"backgroundTag":"invalid-mac-address-in-node-status","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}