cilium/cilium · error

invalid gateway address: %s

Error message

invalid gateway address: %s

What it means

prepareIP builds the CNI IPConfig for an allocated IP. If the caller supplied a non-empty gateway string that net.ParseIP cannot parse, the plugin rejects it with 'invalid gateway address'. This is a configuration/data validation error, not a kernel error.

Source

Thrown at plugins/cilium-cni/cmd/cmd.go:439

		if state.HostAddr != nil {
			if routes, err = connector.IPv4Routes(state.HostAddr, mtu); err != nil {
				return nil, nil, err
			}
			state.IP4routes = append(state.IP4routes, routes...)
			gw = connector.IPv4Gateway(state.HostAddr)
		}
	}

	rt := make([]*cniTypes.Route, 0, len(routes))
	for _, r := range routes {
		rt = append(rt, newCNIRoute(r))
	}

	var gwIP net.IP
	if gw != "" {
		gwIP = net.ParseIP(gw)
		if gwIP == nil {
			return nil, nil, fmt.Errorf("invalid gateway address: %s", gw)
		}
	}

	return &cniTypesV1.IPConfig{
		Address: *netipx.AddrIPNet(ip),
		Gateway: gwIP,
	}, rt, nil
}

func (cmd *Cmd) setupLogging(n *types.NetConf) error {
	f := n.LogFormat
	if f == "" {
		f = string(logging.DefaultLogFormatTimestamp)
	}
	logOptions := logging.LogOptions{
		logging.FormatOpt: f,
		logging.WriterOpt: logging.StdErrOpt,
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the CNI config / IPAM response and correct the gateway to a valid dotted-quad or IPv6 literal
2. Remove the custom gateway field so Cilium derives it from the node CIDR
3. Check cilium-agent logs for the IPAMResponse being handed to the plugin
4. If from a custom IPAM plugin, fix its gateway formatting (no prefix length, no hostnames)

Example fix

// before (CNI config)
"gateway": "10.0.0.1/24"
// after
"gateway": "10.0.0.1"

if gw != "" && net.ParseIP(strings.TrimSpace(gw)) == nil {
    return fmt.Errorf("gateway %q is not a valid IP literal", gw)
}

ipCfg, routes, rules, err := prepareIP(ipam, ...)
if err != nil && strings.Contains(err.Error(), "invalid gateway address") {
    return fmt.Errorf("fix gateway in CNI/IPAM config: %w", err)
}

When it happens

Trigger: prepareIP is called with a gw string that is non-empty but not a valid IP literal (net.ParseIP returns nil) during CNI ADD.

Common situations: Custom CNI config with a malformed gateway (hostname, CIDR with prefix, trailing whitespace, IPv4-mapped typos), or a buggy IPAM/ciliate agent response carrying a bad .IPAM.gateway value.

Related errors

• failed to set reserved ranges for CIDR %s: %w
• invalid custom ip %s for %s.
• unable to parse CNI configuration %q: %w
• not ready
• no cilium agent pods found

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/3511c51087c40d8d. Report an issue: GitHub.