cilium/cilium · error

invalid node IP %s: %w

Error message

invalid node IP %s: %w

What it means

mapNodeID parses the node IP string before writing the ip/id/SPI tuple into the node_map BPF map. A string that netip.ParseAddr cannot parse (e.g. empty, hostname, or malformed IPv4/IPv6) is rejected with this wrapped parse error instead of corrupting the BPF map.

Source

Thrown at pkg/datapath/linux/node_ids.go:222

		}
	}

	if !n.nodeIDs.Insert(idpool.ID(nodeID)) {
		n.log.Warn("Attempted to deallocate a node ID that wasn't allocated",
			logfields.NodeID, nodeID,
		)
	}
	n.log.Debug("Deallocated node ID", logfields.NodeID, nodeID)
	return errs
}

// mapNodeID adds a node ID <> IP mapping into the local in-memory map of the
// Node Manager and in the corresponding BPF map. If any of those map updates
// fail, both are cancelled and the function returns an error.
func (n *linuxNodeHandler) mapNodeID(ip string, id uint16, SPI uint8) error {
	nodeIP, err := netip.ParseAddr(ip)
	if err != nil {
		return fmt.Errorf("invalid node IP %s: %w", ip, err)
	}

	if err := n.nodeMap.Update(nodeIP, id, SPI); err != nil {
		return err
	}

	// We only add the IP <> ID mapping in memory once we are sure it was
	// successfully added to the BPF map.
	n.nodeIDsByIPs[ip] = id
	setIPsByIDsMapping(n.nodeIPsByIDs, id, ip)

	return nil
}

// unmapNodeID removes a node ID <> IP mapping from the local in-memory map of
// the Node Manager and from the corresponding BPF map. If any of those map
// updates fail, it returns an error; in such a case, both are cancelled.
func (n *linuxNodeHandler) unmapNodeID(ip string) error {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the offending node's addresses (kubectl get node -o jsonpath='{.status.addresses}') and fix any malformed/misconfigured node IP
2. Ensure the node has a valid InternalIP; fix kubelet/cloud-provider node address reporting
3. If a custom integration feeds Cilium node objects, validate IPs with netip.ParseAddr before publishing
4. Upgrade Cilium if the node-discovery path produced the bad string from otherwise-valid state

Example fix

// before (custom node publisher feeding Cilium)
publishNode(name, rawIP)
// after
if _, err := netip.ParseAddr(rawIP); err != nil {
    log.Warn("skipping invalid node IP", "ip", rawIP, "err", err)
    return
}
publishNode(name, rawIP)

func validNodeIP(s string) bool {
    return netip.ParseAddr(s) == nil == false && func() bool { _, err := netip.ParseAddr(s); return err == nil }()
}
// call before publishing node data to the node manager

func isIPString(s string) bool {
    _, err := netip.ParseAddr(s)
    return err == nil
}

if err := mapNodeID(ip, id, spi); err != nil {
    var perr *net.ParseError
    if errors.As(err, &perr) {
        log.Warn("skipping node update with invalid IP", "ip", ip)
        return nil // skip rather than abort the whole node update
    }
    return err
}

When it happens

Trigger: allocateIDForNode iterating a node's IP strings and calling mapNodeID with a value that netip.ParseAddr fails on — empty string, an FQDN, 'localhost', or a truncated/malformed address from node discovery.

Common situations: Misconfigured node IP sources (KUBE_ROUTER/NodeIP discovery returning garbage), custom node manager integrations feeding non-IP identifiers, or nodes carrying odd addresses in annotations/labels consumed by Cilium.

Related errors

• failed to map IP %s with node ID %d: %w
• IP not compatible
• unsupported IP address format
• invalid IP address format: %w
• invalid multicast IP: %s

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/980fdcef707e6529. Report an issue: GitHub.