What causes "CiliumNode for own node is not available" in cilium/cilium?

Retry the allocation once the agent finishes startup; the error is typically transient until the CiliumNode is cached.

CiliumNode for own node is not available

Error message

CiliumNode for own node is not available

What it means

In CRD-backed IPAM modes (crd, aws-crd, azure-crd, alibabacloud-crd), the nodeStore keeps the node's own CiliumNode custom resource in n.ownNode. IP allocation requests are answered from that resource; if the local CiliumNode object has not been fetched/populated yet, allocate() cannot validate the requested IP and returns this error. It is a startup/propagation condition, not a data problem with the IP itself.

Source

Thrown at pkg/ipam/crd.go:555

	_, err = n.clientset.CiliumV2().CiliumNodes().UpdateStatus(context.TODO(), node, metav1.UpdateOptions{})

	return err
}

// addAllocator adds a new CRD allocator to the node store
func (n *nodeStore) addAllocator(allocator *crdAllocator) {
	n.mutex.Lock()
	n.allocators = append(n.allocators, allocator)
	n.mutex.Unlock()
}

// allocate checks if a particular IP can be allocated or return an error
func (n *nodeStore) allocate(addr netip.Addr) (*ipamTypes.AllocationIP, error) {
	n.mutex.RLock()
	defer n.mutex.RUnlock()

	if n.ownNode == nil {
		return nil, fmt.Errorf("CiliumNode for own node is not available")
	}

	if n.ownNode.Spec.IPAM.Pool == nil {
		return nil, fmt.Errorf("No IPs available")
	}

	if n.isIPInReleaseHandshake(addr.String()) {
		return nil, fmt.Errorf("IP not available, marked or ready for release")
	}

	ipInfo, ok := n.ownNode.Spec.IPAM.Pool[addr.String()]
	if !ok {
		return nil, NewIPNotAvailableInPoolError(addr)
	}

	return &ipInfo, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

Retry the allocation once the agent finishes startup; the error is typically transient until the CiliumNode is cached.
Verify a CiliumNode resource exists for this node: kubectl get ciliumnode <node-name> -n kube-system.
Check cilium-operator logs/RBAC: it must have permission to create and update CiliumNode resources.
Confirm the CRD 'ciliumnodes.cilium.io' is registered in the cluster (kubectl get crd | grep ciliumnode).

Defensive patterns

Strategy: retry

Validate before calling

// check the CiliumNode exists before issuing allocations
_, err := ciliumClientset.CiliumV2().CiliumNodes().Get(ctx, nodeName, metav1.GetOptions{})
if apierrors.IsNotFound(err) {
    return fmt.Errorf("CiliumNode %s missing; allocations will fail until created", nodeName)
}

Type guard

func ownNodeReady(s *nodeStore) bool {
    s.mutex.RLock()
    defer s.mutex.RUnlock()
    return s.ownNode != nil
}

Try / catch

alloc, err := ipam.Allocate(ip, owner)
if err != nil && strings.Contains(err.Error(), "CiliumNode for own node is not available") {
    // transient during startup: backoff and retry after CRD cache sync
    return retryAfterSync(err)
}

Prevention

Ensure cilium-operator is running and has RBAC for CiliumNode resources.
Verify the ciliumnodes CRD is installed before rolling out agents.
Delay workload scheduling until Cilium reports its local CiliumNode as ready.

When it happens

Trigger: Any call path reaching nodeStore.allocate (e.g. ipam.Allocate / endpoint restore) before the CiliumNode CR for this node has been listed/watched from the Kubernetes API, leaving n.ownNode nil.

Common situations: Cilium agent just started and CRD informer cache is not synced yet; the CiliumNode CR for the node does not exist (operator disabled or RBAC blocks reading CiliumNode resources); CRD custom-resource discovery fails so the store never populates.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/d35a5fa3a0408c22. Report an issue: GitHub.