{"record":{"id":"c2c7c7cdc87c4648","repo":"cilium/cilium","slug":"missing-node-ip-for-node-q","errorCode":null,"errorMessage":"missing node IP for node %q","messagePattern":"missing node IP for node %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/wireguard/agent/agent.go","lineNumber":608,"sourceCode":"\tif a.config.EnableIPv6 && nodeIPv6 != nil {\n\t\tipn := net.IPNet{\n\t\t\tIP:   nodeIPv6,\n\t\t\tMask: net.CIDRMask(net.IPv6len*8, net.IPv6len*8),\n\t\t}\n\t\tif !peer.hasAllowedIP(ipn) {\n\t\t\tpeer.queueAllowedIPsInsert(ipn)\n\t\t}\n\t}\n\n\tep := \"\"\n\tif a.config.TunnelingEnabled && a.config.UnderlayProtocol == tunnel.IPv6 && a.config.EnableIPv6 && nodeIPv6 != nil {\n\t\tep = net.JoinHostPort(nodeIPv6.String(), strconv.Itoa(types.ListenPort))\n\t} else if a.config.EnableIPv4 && nodeIPv4 != nil {\n\t\tep = net.JoinHostPort(nodeIPv4.String(), strconv.Itoa(types.ListenPort))\n\t} else if a.config.EnableIPv6 && nodeIPv6 != nil {\n\t\tep = net.JoinHostPort(nodeIPv6.String(), strconv.Itoa(types.ListenPort))\n\t} else {\n\t\treturn fmt.Errorf(\"missing node IP for node %q\", nodeName)\n\t}\n\n\tepAddr, err := net.ResolveUDPAddr(\"udp\", ep)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to resolve peer endpoint address: %w\", err)\n\t}\n\n\tpeer.pubKey = pubKey\n\tpeer.endpoint = epAddr\n\tpeer.nodeIPv4 = nodeIPv4\n\tpeer.nodeIPv6 = nodeIPv6\n\n\ta.logger.Debug(\n\t\t\"Updating peer\",\n\t\tlogfields.NodeName, nodeName,\n\t\tlogfields.PubKey, pubKeyHex,\n\t\tlogfields.NodeIPv4, nodeIPv4,\n\t\tlogfields.NodeIPv6, nodeIPv6,","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/wireguard/agent/agent.go#L590-L626","documentation":"updatePeer needs at least one usable node IP (IPv4 or IPv6, per agent config) to build the WireGuard peer endpoint. If neither family is present — or the family present is disabled in the agent config — the peer cannot be programmed and this error is returned. It is a data-validation error on the CiliumNode's IP addresses.","triggerScenarios":"Update -> updatePeer with nodeIPv4 == nil and nodeIPv6 == nil (or the only available IP family is disabled via EnableIPv4/EnableIPv6), so the endpoint cannot be constructed.","commonSituations":"CiliumNode resource missing .spec.addresses entries, node not yet allocated pod/node CIDRs, agent running IPv6-only while node only has an IPv4 address (or vice versa), or K8s node reporting no PodCIDR.","solutions":["Check the CiliumNode resource has valid addresses (kubectl get ciliumnode <name> -o yaml)","Ensure the K8s node has a PodCIDR (kube-controller-manager not in a mode that omits it) or configure cilium CIDRs explicitly","Align agent IP family flags (enable-ipv4/enable-ipv6) with actual node addresses","Wait for/restart the node's IPAM allocation so addresses are published before WireGuard sync"],"exampleFix":"// before (agent: enable-ipv6 only, node has only IPv4)\n// error: missing node IP\n// after\n// enable the family matching node addresses:\ncilium-agent --enable-ipv4=true --enable-ipv6=false","handlingStrategy":"validation","validationCode":"func nodeHasUsableIP(node *CiliumNode, ipv4, ipv6 bool) error {\n    for _, a := range node.Spec.Addresses {\n        ip := net.ParseIP(a.IP)\n        if ip == nil { continue }\n        if ipv4 && ip.To4() != nil { return nil }\n        if ipv6 && ip.To4() == nil { return nil }\n    }\n    return errors.New(\"no node IP matching enabled address families\")\n}","typeGuard":null,"tryCatchPattern":"if err := nodeHasUsableIP(ciliumNode, cfg.EnableIPv4, cfg.EnableIPv6); err != nil {\n    // defer WireGuard sync until IPAM publishes an address\n    return backoff(err)\n}","preventionTips":["Verify CiliumNode .spec.addresses before enabling WireGuard","Ensure kube-controller-manager assigns PodCIDRs","Match enable-ipv4/enable-ipv6 flags to node addressing","Delay WireGuard peer programming until IPAM is ready"],"tags":["wireguard","ipam","missing-node-ip","cilium"],"backgroundTag":"missing-node-ip","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}