cilium/cilium · warning

Kubernetes pod %s/%s is not owned by this agent

Error message

Kubernetes pod %s/%s is not owned by this agent

What it means

Cilium only restores endpoints for pods that are scheduled on the local node. When the cached Pod object exists but its Spec.NodeName differs from this node's name, the endpoint is deemed owned by another agent and restore is refused. This typically means the pod was rescheduled elsewhere while this node's endpoint state persisted.

Source

Thrown at daemon/cmd/endpoint_restore.go:365

		}
	}

	return true, false, nil
}

func (r *endpointRestorer) getPodForEndpoint(ep *endpoint.Endpoint) error {
	var (
		pod *slim_corev1.Pod
		err error
	)
	r.k8sWatcher.WaitForCacheSync(resources.K8sAPIGroupPodV1Core)
	pod, err = r.k8sWatcher.GetCachedPod(ep.K8sNamespace, ep.K8sPodName)
	if err != nil && k8serrors.IsNotFound(err) {
		return fmt.Errorf("Kubernetes pod %s/%s does not exist", ep.K8sNamespace, ep.K8sPodName)
	} else if err == nil && pod.Spec.NodeName != nodeTypes.GetName() {
		// if flag CiliumEndpointCRD is disabled,
		// `GetCachedPod` may return endpoint has moved to another node.
		return fmt.Errorf("Kubernetes pod %s/%s is not owned by this agent", ep.K8sNamespace, ep.K8sPodName)
	}
	return nil
}

// readOldEndpointsFromDisk reads the list of existing endpoints previously managed by Cilium when it was
// last run and associated it with container workloads. This function performs the first step in
// restoring the endpoint structure.  It needs to be followed by a call to restoreOldEndpoints()
// once k8s has been initialized and regenerateRestoredEndpoints() once the endpoint builder is
// ready. In summary:
//
// 1. readOldEndpointFromDisk(): read old endpoints from disk
//   - used to start DNS proxy with restored DNS history and rules
//
// 2. restoreOldEndpoints(): validate endpoint data after k8s has been configured
//   - IP allocation
//   - some endpoints may be rejected and not regenerated in the 3rd step
//
// 3. regenerateRestoredEndpoints(): Regenerate the restored endpoints

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the pod's current node (kubectl get pod -o wide); the endpoint will simply not be restored here, which is correct
2. If the node name changed (hostname/VM clone), correct the node identity or wipe stale endpoint state (/var/run/cilium state) on this node
3. Enable/verify CiliumEndpoint (CRD) mode so endpoint ownership is tracked reliably across rescheduling
4. Delete stale endpoint state files if the pod genuinely runs here but node identity is wrong

Example fix

// before: node hostname changed after VM restore
// endpoint skipped: pod ns/pod is not owned by this agent
// after: reset stale state so Cilium re-derives node identity
# systemctl stop cilium
# rm -rf /var/run/cilium/state/overrides /var/lib/cilium/endpoints  # wipe stale endpoints
# systemctl start cilium

// confirm pod placement and node identity before restart
# kubectl get pod <ns>/<name> -o jsonpath='{.spec.nodeName}'
# kubectl get node -l kubernetes.io/hostname=<current-hostname>

When it happens

Trigger: RestoreOldEndpoints -> validateEndpoint -> getPodForEndpoint: GetCachedPod succeeds but pod.Spec.NodeName != nodeTypes.GetName(); common when CiliumEndpointCRD is disabled and pod rescheduling is only visible via the pod cache.

Common situations: Pod evicted/rescheduled to another node while the agent was down; node renamed (hostname change) so its own node name no longer matches; stale endpoint state left after node replacement/clone.

Related errors

• Kubernetes pod %s/%s does not exist
• failed to wait for endpoint restoration: %w
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• pod store outdated
• unable to update some endpoints with new namespace labels

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/8c33f55bd71a4711. Report an issue: GitHub.