{"record":{"id":"8c33f55bd71a4711","repo":"cilium/cilium","slug":"kubernetes-pod-s-s-is-not-owned-by-this-agent","errorCode":null,"errorMessage":"Kubernetes pod %s/%s is not owned by this agent","messagePattern":"Kubernetes pod (.+?)/(.+?) is not owned by this agent","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"daemon/cmd/endpoint_restore.go","lineNumber":365,"sourceCode":"\t\t}\n\t}\n\n\treturn true, false, nil\n}\n\nfunc (r *endpointRestorer) getPodForEndpoint(ep *endpoint.Endpoint) error {\n\tvar (\n\t\tpod *slim_corev1.Pod\n\t\terr error\n\t)\n\tr.k8sWatcher.WaitForCacheSync(resources.K8sAPIGroupPodV1Core)\n\tpod, err = r.k8sWatcher.GetCachedPod(ep.K8sNamespace, ep.K8sPodName)\n\tif err != nil && k8serrors.IsNotFound(err) {\n\t\treturn fmt.Errorf(\"Kubernetes pod %s/%s does not exist\", ep.K8sNamespace, ep.K8sPodName)\n\t} else if err == nil && pod.Spec.NodeName != nodeTypes.GetName() {\n\t\t// if flag CiliumEndpointCRD is disabled,\n\t\t// `GetCachedPod` may return endpoint has moved to another node.\n\t\treturn fmt.Errorf(\"Kubernetes pod %s/%s is not owned by this agent\", ep.K8sNamespace, ep.K8sPodName)\n\t}\n\treturn nil\n}\n\n// readOldEndpointsFromDisk reads the list of existing endpoints previously managed by Cilium when it was\n// last run and associated it with container workloads. This function performs the first step in\n// restoring the endpoint structure.  It needs to be followed by a call to restoreOldEndpoints()\n// once k8s has been initialized and regenerateRestoredEndpoints() once the endpoint builder is\n// ready. In summary:\n//\n// 1. readOldEndpointFromDisk(): read old endpoints from disk\n//   - used to start DNS proxy with restored DNS history and rules\n//\n// 2. restoreOldEndpoints(): validate endpoint data after k8s has been configured\n//   - IP allocation\n//   - some endpoints may be rejected and not regenerated in the 3rd step\n//\n// 3. regenerateRestoredEndpoints(): Regenerate the restored endpoints","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/daemon/cmd/endpoint_restore.go#L347-L383","documentation":"Cilium only restores endpoints for pods that are scheduled on the local node. When the cached Pod object exists but its Spec.NodeName differs from this node's name, the endpoint is deemed owned by another agent and restore is refused. This typically means the pod was rescheduled elsewhere while this node's endpoint state persisted.","triggerScenarios":"RestoreOldEndpoints -> validateEndpoint -> getPodForEndpoint: GetCachedPod succeeds but pod.Spec.NodeName != nodeTypes.GetName(); common when CiliumEndpointCRD is disabled and pod rescheduling is only visible via the pod cache.","commonSituations":"Pod evicted/rescheduled to another node while the agent was down; node renamed (hostname change) so its own node name no longer matches; stale endpoint state left after node replacement/clone.","solutions":["Verify the pod's current node (kubectl get pod -o wide); the endpoint will simply not be restored here, which is correct","If the node name changed (hostname/VM clone), correct the node identity or wipe stale endpoint state (/var/run/cilium state) on this node","Enable/verify CiliumEndpoint (CRD) mode so endpoint ownership is tracked reliably across rescheduling","Delete stale endpoint state files if the pod genuinely runs here but node identity is wrong"],"exampleFix":"// before: node hostname changed after VM restore\n// endpoint skipped: pod ns/pod is not owned by this agent\n// after: reset stale state so Cilium re-derives node identity\n# systemctl stop cilium\n# rm -rf /var/run/cilium/state/overrides /var/lib/cilium/endpoints  # wipe stale endpoints\n# systemctl start cilium","handlingStrategy":"validation","validationCode":"// confirm pod placement and node identity before restart\n# kubectl get pod <ns>/<name> -o jsonpath='{.spec.nodeName}'\n# kubectl get node -l kubernetes.io/hostname=<current-hostname>","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep node hostnames stable; avoid renaming nodes or cloning VM images with stale state","Prefer CiliumEndpoint (CRD) mode for reliable endpoint ownership tracking","Wipe /var/lib/cilium/endpoints state when reprovisioning a node","Verify pod scheduling (kubectl get pod -o wide) after evictions before debugging restore skips"],"tags":["kubernetes","endpoint-restore","node-ownership","cilium"],"backgroundTag":"endpoint-node-ownership-mismatch","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}