cilium/cilium · warning

failed to find proxy port %s

Error message

failed to find proxy port %s

What it means

releaseProxyPort looks up the named redirect in the proxyPorts map and returns this error if no entry exists. Release of an unknown proxy name is a bookkeeping error indicating state divergence between the caller and the ProxyPorts registry.

Source

Thrown at pkg/proxy/proxyports/proxyports.go:419

			logfields.ProxyPort, pp.ProxyPort,
		)
		p.datapathUpdater.InstallProxyRules(pp.ProxyPort, name)
		pp.rulesPort = pp.ProxyPort

		// trigger writing proxy ports to file
		p.Trigger.Trigger()
	}
	pp.acknowledged = true
	scopedLog.Debug("AckProxyPort: acked proxy port", logfields.ProxyPort, pp.ProxyPort)
	return nil
}

// releaseProxyPort() decreases the use count and frees the port if no users remain
// Must be called with mutex held!
func (p *ProxyPorts) releaseProxyPort(name string, portReuseWait time.Duration) error {
	pp := p.proxyPorts[name]
	if pp == nil {
		return fmt.Errorf("failed to find proxy port %s", name)
	}

	if pp.nRedirects <= 0 {
		nRedirects := pp.nRedirects
		pp.nRedirects = 0
		return fmt.Errorf("failed to release proxy port with has non-positive reference count: %d", nRedirects)
	}

	pp.nRedirects--

	// Static proxy port is not released, dynamic proxy ports are released after a delay if
	// still on last reference count
	if !pp.isStatic && pp.nRedirects == 0 && pp.releaseCancel == nil {
		ctx, cancel := context.WithCancel(context.Background())
		pp.releaseCancel = cancel

		go func() {
			select {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check for double-release paths in the caller; release only once per successful creation
2. Verify the redirect name matches the one used at creation/allocation
3. Ignore or downgrade this error in callers where release-on-failure is best-effort
4. If state is permanently diverged, restart the agent to rebuild the registry

Example fix

// before
proxyPorts.ReleaseProxyPort(name)
proxyPorts.ReleaseProxyPort(name) // second call errors
// after
if err := proxyPorts.ReleaseProxyPort(name); err != nil {
    log.Debug("proxy port already released", "name", name, "err", err)
}

// Check the redirect exists before releasing
if _, err := proxyPorts.GetProxyPort(name); err != nil {
    return nil // nothing to release
}

func isProxyPortNotFound(err error) bool {
    return err != nil && strings.Contains(err.Error(), "failed to find proxy port")
}

err := proxyPorts.ReleaseProxyPort(name)
if isProxyPortNotFound(err) {
    log.Debug("proxy port already released", "name", name)
    // idempotent-release: treat as success
}

When it happens

Trigger: ReleaseProxyPort (or releaseProxyPortWithWait) is called with a redirect name that was never added, was already fully released and removed, or whose entry was removed by restore/reset logic.

Common situations: Double-release of the same redirect, releasing a redirect whose creation failed earlier (see error 3710's release-on-failure path), or name mismatches after agent restart/restore.

Related errors

• cannot release from non-existing pool: %s
• failed to ack DNS proxy port: %w
• no IPAM pool provided for IP release of %s
• no available proxy ports
• ackProxyPort: zero port on %s not allowed

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/90baa0adba16d3c5. Report an issue: GitHub.