{"record":{"id":"92a672ddf43c9459","repo":"cilium/cilium","slug":"failed-to-get-valid-endpoint-ips","errorCode":null,"errorMessage":"failed to get valid endpoint IPs","messagePattern":"failed to get valid endpoint IPs","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/egressgateway/endpoint.go","lineNumber":45,"sourceCode":"}\n\n// endpointID is based on endpoint's UID\ntype endpointID = types.UID\n\nfunc getEndpointMetadata(endpoint *k8sTypes.CiliumEndpoint, identityLabels labels.Labels) (*endpointMetadata, error) {\n\tvar addrs []netip.Addr\n\n\tif endpoint.UID == \"\" {\n\t\t// this can happen when CiliumEndpointSlices are in use - which is not supported in the EGW yet\n\t\treturn nil, fmt.Errorf(\"endpoint has empty UID\")\n\t}\n\n\tif endpoint.Networking == nil {\n\t\treturn nil, fmt.Errorf(\"endpoint has no networking metadata\")\n\t}\n\n\tif len(endpoint.Networking.Addressing) == 0 {\n\t\treturn nil, fmt.Errorf(\"failed to get valid endpoint IPs\")\n\t}\n\n\tfor _, pair := range endpoint.Networking.Addressing {\n\t\tif pair.IPV4 != \"\" {\n\t\t\taddr, err := netip.ParseAddr(pair.IPV4)\n\t\t\tif err != nil || !addr.Is4() {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\taddrs = append(addrs, addr)\n\t\t}\n\t\tif pair.IPV6 != \"\" {\n\t\t\taddr, err := netip.ParseAddr(pair.IPV6)\n\t\t\tif err != nil || !addr.Is6() {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\taddrs = append(addrs, addr)\n\t\t}\n\t}","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/egressgateway/endpoint.go#L27-L63","documentation":"The endpoint has networking metadata but the Addressing list is empty, so no usable IP (IPv4 or IPv6) can be extracted for egress policy matching.","triggerScenarios":"getEndpointMetadata (via addEndpoint) sees endpoint.Networking.Addressing with length 0 — a CiliumEndpoint with a networking section but no assigned addresses.","commonSituations":"IPAM has not allocated a pod IP yet; IPAM pool exhaustion; misconfigured IPAM mode; endpoint restored from a snapshot lacking address data.","solutions":["Check IPAM health (cilium status) and confirm the pod received an IP from the pool","Free/extend the IPAM allocation pool if exhausted","Verify IPAM mode configuration matches the CNI setup","Delete and recreate the endpoint/pod so IP allocation is redone"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// ensure at least one address exists before processing\nif len(ep.Networking.Addressing) == 0 {\n    return fmt.Errorf(\"endpoint %s has no IPs allocated yet\", ep.Name)\n}","typeGuard":null,"tryCatchPattern":"meta, err := getEndpointMetadata(ep, lbls)\nif err != nil {\n    if strings.Contains(err.Error(), \"valid endpoint IPs\") {\n        logger.Warn(\"endpoint has no IPs; check IPAM\", \"ep\", ep.Name)\n        return nil // retry on next reconcile\n    }\n    return err\n}","preventionTips":["Monitor IPAM pool utilization and alert before exhaustion","Verify cilium status IPAM is healthy in the cluster","Recreate pods stuck without addresses instead of letting stale endpoints accumulate"],"tags":["kubernetes","cilium","ipam"],"backgroundTag":"missing-pod-ip","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}