cilium/cilium · error

failed to get valid endpoint IPs

Error message

failed to get valid endpoint IPs

What it means

The endpoint has networking metadata but the Addressing list is empty, so no usable IP (IPv4 or IPv6) can be extracted for egress policy matching.

Source

Thrown at pkg/egressgateway/endpoint.go:45

}

// endpointID is based on endpoint's UID
type endpointID = types.UID

func getEndpointMetadata(endpoint *k8sTypes.CiliumEndpoint, identityLabels labels.Labels) (*endpointMetadata, error) {
	var addrs []netip.Addr

	if endpoint.UID == "" {
		// this can happen when CiliumEndpointSlices are in use - which is not supported in the EGW yet
		return nil, fmt.Errorf("endpoint has empty UID")
	}

	if endpoint.Networking == nil {
		return nil, fmt.Errorf("endpoint has no networking metadata")
	}

	if len(endpoint.Networking.Addressing) == 0 {
		return nil, fmt.Errorf("failed to get valid endpoint IPs")
	}

	for _, pair := range endpoint.Networking.Addressing {
		if pair.IPV4 != "" {
			addr, err := netip.ParseAddr(pair.IPV4)
			if err != nil || !addr.Is4() {
				continue
			}
			addrs = append(addrs, addr)
		}
		if pair.IPV6 != "" {
			addr, err := netip.ParseAddr(pair.IPV6)
			if err != nil || !addr.Is6() {
				continue
			}
			addrs = append(addrs, addr)
		}
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check IPAM health (cilium status) and confirm the pod received an IP from the pool
2. Free/extend the IPAM allocation pool if exhausted
3. Verify IPAM mode configuration matches the CNI setup
4. Delete and recreate the endpoint/pod so IP allocation is redone

// ensure at least one address exists before processing
if len(ep.Networking.Addressing) == 0 {
    return fmt.Errorf("endpoint %s has no IPs allocated yet", ep.Name)
}

meta, err := getEndpointMetadata(ep, lbls)
if err != nil {
    if strings.Contains(err.Error(), "valid endpoint IPs") {
        logger.Warn("endpoint has no IPs; check IPAM", "ep", ep.Name)
        return nil // retry on next reconcile
    }
    return err
}

When it happens

Trigger: getEndpointMetadata (via addEndpoint) sees endpoint.Networking.Addressing with length 0 — a CiliumEndpoint with a networking section but no assigned addresses.

Common situations: IPAM has not allocated a pod IP yet; IPAM pool exhaustion; misconfigured IPAM mode; endpoint restored from a snapshot lacking address data.

Related errors

• unable to allocate health IPv4: %w, see https://cilium.link/
• unable to allocate health IPv6: %w, see https://cilium.link/
• cluster-pool-ipv4-cidr must be provided when using ClusterPo
• failed to get CiliumNode store, migration to multi-pool IPAM
• failed to migrate node %q: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/92a672ddf43c9459. Report an issue: GitHub.