cilium/cilium · error

device %s is already allocated for pod %s by another claim

Error message

device %s is already allocated for pod %s by another claim

What it means

During DRA PrepareResourceClaims, the driver checks via conflictingDeviceForPod whether any device requested by this claim is already allocated to the same pod by a *different* ResourceClaim. If so, preparation is rejected because one pod cannot receive the same network device/interface through two competing claims. This protects the pod's network namespace from double-attachment and conflicting interface names.

Source

Thrown at pkg/networkdriver/dra.go:230

			errs = append(errs, err)
		}
	}
	return errors.Join(errs...)
}

func (driver *Driver) prepareResourceClaim(ctx context.Context, claim *resourceapi.ResourceClaim) kubeletplugin.PrepareResult {
	if len(claim.Status.ReservedFor) != 1 {
		return kubeletplugin.PrepareResult{
			Err: fmt.Errorf("%w: Status.ReservedFor field has more than one entry", errUnexpectedInput),
		}
	}

	pod := claim.Status.ReservedFor[0]

	// Reject devices that are already claimed by a *different* claim for this pod.
	if dev := driver.conflictingDeviceForPod(pod.UID, claim.UID, claim.Status.Allocation.Devices.Results); dev != "" {
		return kubeletplugin.PrepareResult{
			Err: fmt.Errorf("device %s is already allocated for pod %s by another claim", dev, pod.Name),
		}
	}

	deviceClaimConfigs, err := driver.deviceClaimConfigs(ctx, claim)
	if err != nil {
		return kubeletplugin.PrepareResult{Err: err}
	}

	if err := validatePodIfNames(claim, deviceClaimConfigs); err != nil {
		return kubeletplugin.PrepareResult{Err: err}
	}

	// Precompute what is already done so retries skip completed work.
	state := driver.newClaimPrepState(pod, claim)

	var (
		alloc         []allocation
		devicesStatus []resourceapi.AllocatedDeviceStatus

View on GitHub (pinned to ac7b90affa)

Solutions

1. Ensure each pod requests each device through only one claim; remove the overlapping device request from the duplicate claim.
2. Unprepare/delete the stale claim holding the device for this pod so the conflict clears, then retry preparation.
3. Tighten the driver's Allocation/ResourceSlice filters (or CEL allocatedDeviceSelectors) so the scheduler cannot allocate the same device to two claims of one pod.
4. If the pod was recreated (same name, new UID), delete the leftover claim referencing the old UID so the device table entry is freed.

Example fix

// before: pod references two claims that both request net-device eth0
resources:
  claims:
    - name: net-a  # requests device0
    - name: net-b  # also requests device0
// after: make requests disjoint
resources:
  claims:
    - name: net-a  # requests device0
    - name: net-b  # requests device1

// Before submitting claims for a pod, assert no device is requested twice:
func noOverlappingDevices(claims []*resourceapi.ResourceClaim) error {
  seen := map[string]string{} // device -> claim name
  for _, c := range claims {
    if c.Status.Allocation == nil { continue }
    for _, r := range c.Status.Allocation.Devices.Results {
      if prev, dup := seen[r.Device]; dup {
        return fmt.Errorf("device %s requested by claims %s and %s", r.Device, prev, c.Name)
      }
      seen[r.Device] = c.Name
    }
  }
  return nil
}

if res := driver.PrepareResourceClaims(...); res.Err != nil {
  if strings.Contains(res.Err.Error(), "already allocated for pod") {
    // inspect claims ReservedFor this pod, unprepare the stale claim, retry once
  }
}

When it happens

Trigger: Two ResourceClaims allocated by this DRA driver both request the same device and are both reserved for the same pod UID; prepareResourceClaim runs for the second claim and conflictingDeviceForPod returns the conflicting device name.

Common situations: A pod spec references two claims that overlap in requested devices (e.g. duplicated device requests in two DeviceClasses/claims); an old claim was not unprepared and a replacement claim for the same pod re-requests the same device; scheduler allocated overlapping claims because ResourceSlice filters were too permissive.

Related errors

• device not found
• failed to update k8s network policy %T %q: %w
• failed to update CiliumEnvoyConfig for service: %w
• failed to write Ingress status: %w
• markPoolConflicting: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4d2fb2f28e902cb1. Report an issue: GitHub.