{"record":{"id":"980fdcef707e6529","repo":"cilium/cilium","slug":"invalid-node-ip-s-w","errorCode":null,"errorMessage":"invalid node IP %s: %w","messagePattern":"invalid node IP (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/node_ids.go","lineNumber":222,"sourceCode":"\t\t}\n\t}\n\n\tif !n.nodeIDs.Insert(idpool.ID(nodeID)) {\n\t\tn.log.Warn(\"Attempted to deallocate a node ID that wasn't allocated\",\n\t\t\tlogfields.NodeID, nodeID,\n\t\t)\n\t}\n\tn.log.Debug(\"Deallocated node ID\", logfields.NodeID, nodeID)\n\treturn errs\n}\n\n// mapNodeID adds a node ID <> IP mapping into the local in-memory map of the\n// Node Manager and in the corresponding BPF map. If any of those map updates\n// fail, both are cancelled and the function returns an error.\nfunc (n *linuxNodeHandler) mapNodeID(ip string, id uint16, SPI uint8) error {\n\tnodeIP, err := netip.ParseAddr(ip)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid node IP %s: %w\", ip, err)\n\t}\n\n\tif err := n.nodeMap.Update(nodeIP, id, SPI); err != nil {\n\t\treturn err\n\t}\n\n\t// We only add the IP <> ID mapping in memory once we are sure it was\n\t// successfully added to the BPF map.\n\tn.nodeIDsByIPs[ip] = id\n\tsetIPsByIDsMapping(n.nodeIPsByIDs, id, ip)\n\n\treturn nil\n}\n\n// unmapNodeID removes a node ID <> IP mapping from the local in-memory map of\n// the Node Manager and from the corresponding BPF map. If any of those map\n// updates fail, it returns an error; in such a case, both are cancelled.\nfunc (n *linuxNodeHandler) unmapNodeID(ip string) error {","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/node_ids.go#L204-L240","documentation":"mapNodeID parses the node IP string before writing the ip/id/SPI tuple into the node_map BPF map. A string that netip.ParseAddr cannot parse (e.g. empty, hostname, or malformed IPv4/IPv6) is rejected with this wrapped parse error instead of corrupting the BPF map.","triggerScenarios":"allocateIDForNode iterating a node's IP strings and calling mapNodeID with a value that netip.ParseAddr fails on — empty string, an FQDN, 'localhost', or a truncated/malformed address from node discovery.","commonSituations":"Misconfigured node IP sources (KUBE_ROUTER/NodeIP discovery returning garbage), custom node manager integrations feeding non-IP identifiers, or nodes carrying odd addresses in annotations/labels consumed by Cilium.","solutions":["Inspect the offending node's addresses (kubectl get node -o jsonpath='{.status.addresses}') and fix any malformed/misconfigured node IP","Ensure the node has a valid InternalIP; fix kubelet/cloud-provider node address reporting","If a custom integration feeds Cilium node objects, validate IPs with netip.ParseAddr before publishing","Upgrade Cilium if the node-discovery path produced the bad string from otherwise-valid state"],"exampleFix":"// before (custom node publisher feeding Cilium)\npublishNode(name, rawIP)\n// after\nif _, err := netip.ParseAddr(rawIP); err != nil {\n    log.Warn(\"skipping invalid node IP\", \"ip\", rawIP, \"err\", err)\n    return\n}\npublishNode(name, rawIP)","handlingStrategy":"validation","validationCode":"func validNodeIP(s string) bool {\n    return netip.ParseAddr(s) == nil == false && func() bool { _, err := netip.ParseAddr(s); return err == nil }()\n}\n// call before publishing node data to the node manager","typeGuard":"func isIPString(s string) bool {\n    _, err := netip.ParseAddr(s)\n    return err == nil\n}","tryCatchPattern":"if err := mapNodeID(ip, id, spi); err != nil {\n    var perr *net.ParseError\n    if errors.As(err, &perr) {\n        log.Warn(\"skipping node update with invalid IP\", \"ip\", ip)\n        return nil // skip rather than abort the whole node update\n    }\n    return err\n}","preventionTips":["Validate node addresses with netip.ParseAddr before feeding node manager integrations","Ensure kubelet/cloud provider reports valid InternalIP addresses","Never publish hostnames or empty strings as node IPs","Alert on 'invalid node IP' log lines to catch discovery regressions early"],"tags":["node-id","ip-validation","netip","bpf-map","cilium"],"backgroundTag":"invalid-node-ip","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}