cilium/cilium · warning

IPv6 allocation disabled

Error message

IPv6 allocation disabled

What it means

ErrIPv6Disabled is returned by the IPAM allocator when an IPv6 allocation or release is attempted while IPv6 allocation is disabled. It mirrors ErrIPv4Disabled for the IPv6 family.

Source

Thrown at pkg/ipam/allocator.go:31

	ipamOption "github.com/cilium/cilium/pkg/ipam/option"
	"github.com/cilium/cilium/pkg/logging/logfields"
	"github.com/cilium/cilium/pkg/metrics"
	"github.com/cilium/cilium/pkg/time"
)

const (
	metricAllocate = "allocate"
	metricRelease  = "release"
)

// Error definitions
var (
	// ErrIPv4Disabled is returned when IPv4 allocation is disabled
	ErrIPv4Disabled = errors.New("IPv4 allocation disabled")

	// ErrIPv6Disabled is returned when Ipv6 allocation is disabled
	ErrIPv6Disabled = errors.New("IPv6 allocation disabled")
)

func (ipam *IPAM) determineIPAMPool(owner string, family Family) (Pool, error) {
	pool, err := ipam.metadata.GetIPPoolForPod(owner, family)
	if err != nil {
		return "", fmt.Errorf("unable to determine IPAM pool for owner %q: %w", owner, err)
	}

	return Pool(pool), nil
}

// AllocateIP allocates an IP address.
func (ipam *IPAM) AllocateIP(ip netip.Addr, owner string, pool Pool) error {
	needSyncUpstream := true
	_, err := ipam.allocateIP(ip, owner, pool, needSyncUpstream)
	return err
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Enable IPv6 (configure --ipv6 / IPv6 pod CIDR, dual-stack) if IPv6 addresses are needed
2. If IPv6 is intentionally off, restrict requests to the IPv4 family
3. Handle ErrIPv6Disabled explicitly so pod allocation falls back to IPv4 instead of erroring

Example fix

// before
ip, err := ipam.AllocateNext(IPv6) // ErrIPv6Disabled on ipv4-only node
// after
if errors.Is(err, ErrIPv6Disabled) {
    ip, err = ipam.AllocateNext(IPv4)
}

if !ipamConfig.IPv6Enabled && family == ipam.IPv6 {
    // skip IPv6 request entirely
}

func isIPv6Disabled(err error) bool { return errors.Is(err, ipam.ErrIPv6Disabled) }

ip, err := ipam.AllocateNext(fam)
if errors.Is(err, ipam.ErrIPv6Disabled) {
    // feature off: fall back to IPv4 or skip cleanly
}

When it happens

Trigger: allocateIP or releaseIPLocked invoked with family IPv6 when IPAM has no IPv6 pool configured (e.g. --ipv6 not enabled or no IPv6 CIDR).

Common situations: Default single-stack IPv4 clusters where a workload or CNI plugin requests an IPv6 address; dual-stack flag missing at install time.

Related errors

• not ready
• no cilium agent pods found
• cluster-pool-ipv4-cidr must not be set if IPv4 is disabled
• cluster-pool-ipv6-cidr must be provided when using ClusterPo
• cluster-pool-ipv6-cidr must not be set if IPv6 is disabled

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/535c6eb9747e3e9d. Report an issue: GitHub.