cilium/cilium · error

invalid MAC address %q reported for ENI %s: %w

Error message

invalid MAC address %q reported for ENI %s: %w

What it means

Analogous to the Azure MAC error but in AlibabaCloud CRD mode: after matching the ENI by NetworkInterfaceID, the ENI's MACAddress is parsed with mac.ParseMACOrUnset to set result.PrimaryMAC. A malformed (non-empty, unparseable) MAC reported in Status.AlibabaCloud.ENIs aborts buildAllocationResult with this wrapped error.

Source

Thrown at pkg/ipam/crd.go:776

				//
				// TODO: Once https://github.com/cilium/cilium/issues/14705 is
				// resolved, then we don't need to hardcode this anymore.
				result.InterfaceNumber = "0"
				return
			}
		}
		return nil, fmt.Errorf("unable to find ENI %s", ipInfo.Resource)

	// In AlibabaCloud mode, the Resource points to the ENI so we can derive the
	// master interface and all CIDRs of the VPC
	case ipamOption.IPAMAlibabaCloud:
		for _, eni := range a.store.ownNode.Status.AlibabaCloud.ENIs {
			if eni.NetworkInterfaceID != ipInfo.Resource {
				continue
			}
			result.PrimaryMAC, err = mac.ParseMACOrUnset(eni.MACAddress)
			if err != nil {
				return nil, fmt.Errorf("invalid MAC address %q reported for ENI %s: %w", eni.MACAddress, eni.NetworkInterfaceID, err)
			}
			if eni.VSwitch.CIDRBlock.IsValid() {
				p := eni.VSwitch.CIDRBlock.Prefix
				result.CIDRs = []netip.Prefix{p}

				// AlibabaCloud reserves the third-to-last IP of the subnet for the gateway.
				// Ref: https://www.alibabacloud.com/help/doc-detail/65398.html
				result.GatewayIP = netipx.PrefixLastIP(p).Prev().Prev()
			}
			result.InterfaceNumber = strconv.Itoa(alibabaCloudTypes.GetENIIndexFromTags(a.logger, eni.Tags))
			return
		}
		return nil, fmt.Errorf("unable to find ENI %s", ipInfo.Resource)
	}

	return
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check status.alibabacloud.enis[].macAddress on the CiliumNode and correct/remove invalid values.
2. Delete the CiliumNode CR and let cilium-operator recreate it with freshly fetched ENI metadata.
3. Align cilium-agent and cilium-operator versions to avoid status format mismatches.
4. Validate against AlibabaCloud API (DescribeNetworkInterfaces) that the MAC is genuinely valid; file a Cilium issue if it is.

cn, _ := ciliumClientset.CiliumV2().CiliumNodes().Get(ctx, nodeName, metav1.GetOptions{})
for _, eni := range cn.Status.AlibabaCloud.ENIs {
    if eni.MACAddress != "" {
        if _, err := net.ParseMAC(eni.MACAddress); err != nil {
            return fmt.Errorf("CiliumNode %s has invalid MAC %q for ENI %s", nodeName, eni.MACAddress, eni.NetworkInterfaceID)
        }
    }
}

func validAlibabaMACs(cn *ciliumv2.CiliumNode) bool {
    for _, eni := range cn.Status.AlibabaCloud.ENIs {
        if eni.MACAddress == "" {
            continue
        }
        if _, err := net.ParseMAC(eni.MACAddress); err != nil {
            return false
        }
    }
    return true
}

result, err := allocator.Allocate(ctx, ip, owner)
if err != nil && strings.Contains(err.Error(), "invalid MAC address") {
    // recreate CiliumNode to refetch ENI metadata from AlibabaCloud
    return refreshCiliumNode(ctx, nodeName)
}

When it happens

Trigger: buildAllocationResult in ipamOption.IPAMAlibabaCloud mode: the matching ENI in a.store.ownNode.Status.AlibabaCloud.ENIs has a MACAddress that ParseMACOrUnset rejects (corrupted or placeholder string).

Common situations: Stale CiliumNode status from version-skewed operator/agent; AlibabaCloud API metadata anomalies; CRD status edited or patched by external tooling with invalid MAC text.

Related errors

• invalid MAC address %q reported for Azure interface %s: %w
• CiliumNode for own node is not available
• No IPs available
• IP not available, marked or ready for release
• invalid custom ip %s for %s.

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/6d84b6036e2090d7. Report an issue: GitHub.