What causes "delete endpoint %d: %v" in cilium/cilium?

Read the aggregated %v error list to find the underlying cause, then retry the delete.

delete endpoint %d: %v

Error message

delete endpoint %d: %v

What it means

When the requested deletion via epm.RemoveEndpoint returns one or more errors, the script command aggregates them into `delete endpoint %d: %v`. The lookup succeeded but the actual teardown (datapath cleanup, state removal, etc.) failed.

Source

Thrown at pkg/endpointmanager/script_cmds.go:96

			script.CmdUsage{
				Summary: "Delete an Endpoint",
				Args:    "id",
			},
			func(s *script.State, args ...string) (script.WaitFunc, error) {
				if len(args) != 1 {
					return nil, fmt.Errorf("expected one arg but got %v, see usage details", len(args))
				}
				id, err := strconv.ParseUint(args[0], 10, 16)
				if err != nil {
					return nil, fmt.Errorf("parse id: %w", err)
				}
				ep := epm.LookupCiliumID(uint16(id))
				if ep == nil {
					return nil, fmt.Errorf("endpoint %d not found", id)
				}
				return func(s *script.State) (stdout string, stderr string, err error) {
					if errs := epm.RemoveEndpoint(ep, endpoint.DeleteConfig{}); len(errs) > 0 {
						return "", "", fmt.Errorf("delete endpoint %d: %v", id, errs)
					}
					return "", "", nil
				}, nil
			},
		),
		"endpoint/list": script.Command(
			script.CmdUsage{
				Summary: "List all Endpoints",
			},
			func(s *script.State, args ...string) (script.WaitFunc, error) {
				return func(s *script.State) (stdout string, stderr string, err error) {
					var sb strings.Builder
					sb.WriteRune('[')
					for _, ep := range epm.GetEndpointList(endpointapi.GetEndpointParams{}) {
						sb.WriteRune('{')
						sb.WriteString(spew.Sdump(
							"id", ep.ID,
							"identity", ep.Status.Identity,

View on GitHub (pinned to ac7b90affa)

Solutions

Read the aggregated %v error list to find the underlying cause, then retry the delete.
Check the endpoint state with `endpoint list` — wait for it to leave 'disconnecting' state.
Check agent logs for datapath/identity errors during deletion.
As a last resort restart the agent, which triggers endpoint state recovery.

Defensive patterns

Strategy: retry

Validate before calling

ep := epm.LookupCiliumID(uint16(id))
if ep == nil {
    return fmt.Errorf("cannot delete: endpoint %d not found", id)
}
// optionally check ep.State() is in a deletable state before calling RemoveEndpoint

Try / catch

for attempt := 0; attempt < 3; attempt++ {
    _, _, err := run("endpoint delete", id)
    if err == nil {
        break
    }
    log.Printf("delete attempt %d failed: %v; retrying", attempt+1, err)
    time.Sleep(2 * time.Second)
}

Prevention

Wait for endpoints to be in a stable state before deleting.
Avoid concurrent deletes of the same endpoint.
Check agent logs for the underlying datapath error in the aggregated list.

When it happens

Trigger: `endpoint delete <id>` where RemoveEndpoint returns a non-empty error slice — e.g. failures removing the endpoint's datapath state or releasing its identity.

Common situations: Endpoint in a bad state (mid-regeneration, already disconnecting); underlying networking/link removal failures in the environment; concurrent delete of the same endpoint.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/9a8f8680f2a3c284. Report an issue: GitHub.