What causes "invalid local-router-ip: %s" in cilium/cilium?

Fix the --local-router-ipv4 flag/config value to a valid dotted-quad IPv4 address (e.g. 10.0.0.1)

invalid local-router-ip: %s

Error message

invalid local-router-ip: %s

What it means

Returned by allocateRouterIPv4 when the local-router-ip4 daemon config value cannot be parsed by net.ParseIP. It is a configuration validation error — the user-supplied router IPv4 string is malformed.

Source

Thrown at daemon/infraendpoints/infra_ip_allocation.go:127

		localNodeStore: params.LocalNodeStore,
		mtuManager:     params.MTU,
		ipAllocator:    params.IPAM,
	}
}

const (
	mismatchRouterIPsMsg = "Mismatch of router IPs found during restoration. The Kubernetes resource contained %s, while the filesystem contained %s. Using the router IP from the filesystem. To change the router IP, specify --%s and/or --%s."
)

func (r *infraIPAllocator) GetHealthEndpointRouting() (ipv4, ipv6 *linuxrouting.RoutingInfo) {
	return r.healthEndpointRouting, r.healthEndpointRoutingV6
}

func (r *infraIPAllocator) allocateRouterIPv4(ctx context.Context, family node.AddressingFamily, fromK8s, fromFS net.IP) (net.IP, error) {
	if r.daemonConfig.LocalRouterIPv4 != "" {
		routerIP := net.ParseIP(r.daemonConfig.LocalRouterIPv4)
		if routerIP == nil {
			return nil, fmt.Errorf("invalid local-router-ip: %s", r.daemonConfig.LocalRouterIPv4)
		}
		if r.nodeAddressing.IPv4().AllocationCIDR().Contains(iputil.AddrFromIP(routerIP)) {
			r.logger.Warn("Specified router IP is within IPv4 podCIDR.")
		}
		return routerIP, nil
	}

	return r.reallocateRouterIPs(ctx, family, fromK8s, fromFS)
}

func (r *infraIPAllocator) allocateRouterIPv6(ctx context.Context, family node.AddressingFamily, fromK8s, fromFS net.IP) (net.IP, error) {
	if r.daemonConfig.LocalRouterIPv6 != "" {
		routerIP := net.ParseIP(r.daemonConfig.LocalRouterIPv6)
		if routerIP == nil {
			return nil, fmt.Errorf("invalid local-router-ip: %s", r.daemonConfig.LocalRouterIPv6)
		}
		if r.nodeAddressing.IPv6().AllocationCIDR().Contains(iputil.AddrFromIP(routerIP)) {
			r.logger.Warn("Specified router IP is within IPv6 podCIDR.")

View on GitHub (pinned to ac7b90affa)

Solutions

Fix the --local-router-ipv4 flag/config value to a valid dotted-quad IPv4 address (e.g. 10.0.0.1)
If an IPv6 was intended, set local-router-ipv6 instead
Unset the option to let the IPAM pool allocate the router IP automatically

Example fix

// before
local-router-ipv4: "cilium-router"
// after
local-router-ipv4: "10.0.0.1"

Defensive patterns

Strategy: validation

Validate before calling

func validRouterIPv4(s string) error {
    if s == "" { return nil }
    ip := net.ParseIP(s)
    if ip == nil || ip.To4() == nil {
        return fmt.Errorf("local-router-ipv4 must be a valid IPv4 address, got %q", s)
    }
    return nil
}
// call before starting the daemon

Type guard

func isInvalidRouterIPErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "invalid local-router-ip")
}

Try / catch

if err := validRouterIPv4(cfg.LocalRouterIPv4); err != nil {
    // fail fast at config-load time instead of during IP allocation
    return fmt.Errorf("bad config: %w", err)
}

Prevention

Validate IP-typed config values at flag/ConfigMap load time
Never pass hostnames or DNS names where an IP literal is expected
Add schema validation (e.g. CEL/JSON schema) to Helm values

When it happens

Trigger: daemonConfig.LocalRouterIPv4 is set to a string net.ParseIP rejects (wrong format, hostname, empty whitespace, IPv6 in the IPv4 field).

Common situations: Typo or extra characters in the agent config/CLI flag --local-router-ipv4; passing a hostname instead of an IP; Helm values with a bad quoted string.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/de3d8e6b2b2afc96. Report an issue: GitHub.