cilium/cilium · error

local node has not been initialized yet: %w

Error message

local node has not been initialized yet: %w

What it means

LookupRegisteredEndpoint resolves an IP to a Cilium endpoint. Before doing a full lookup it fetches the local node from localNodeStore; if that store cannot yet produce a node (context wait failed/timed out), the whole lookup fails with this wrapped error. The second return value is true, indicating the caller may retry since this is a transient initialization condition.

Source

Thrown at pkg/fqdn/lookup/endpoint.go:48

	LookupRegisteredEndpoint(endpointAddr netip.Addr) (endpoint *endpoint.Endpoint, isHost bool, err error)
}

type proxyLookupHandler struct {
	ipCache         *ipcache.IPCache
	localNodeStore  *node.LocalNodeStore
	endpointManager endpointmanager.EndpointManager
}

var _ ProxyLookupHandler = &proxyLookupHandler{}

func (p *proxyLookupHandler) LookupRegisteredEndpoint(endpointAddr netip.Addr) (endpoint *endpoint.Endpoint, isHost bool, err error) {
	if e := p.endpointManager.LookupIP(endpointAddr); e != nil {
		return e, e.IsHost(), nil
	}

	localNode, err := p.localNodeStore.Get(context.Background())
	if err != nil {
		return nil, true, fmt.Errorf("local node has not been initialized yet: %w", err)
	}

	if localNode.IsNodeIP(endpointAddr) != "" {
		if e := p.endpointManager.GetHostEndpoint(); e != nil {
			return e, true, nil
		} else {
			return nil, true, errors.New("host endpoint has not been created yet")
		}
	}

	return nil, false, fmt.Errorf("cannot find endpoint with IP %s", endpointAddr.String())
}

func (p *proxyLookupHandler) LookupSecIDByIP(ip netip.Addr) (secID ipcache.Identity, exists bool) {
	return p.ipCache.LookupSecIDByIP(ip)
}

func (p *proxyLookupHandler) LookupByIdentity(nid identity.NumericIdentity) []string {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Retry the lookup after a short delay — the local node registers shortly after agent startup
2. Check agent logs for localNodeStore initialization errors or shutdown in progress
3. Wait for the agent to reach a ready/healthy state before sending traffic through it
4. Inspect the wrapped %w error for context deadline/cancellation causes

// Only proceed once the agent is healthy/ready
// e.g. wait for cilium 'ready' state before doing endpoint lookups

ep, retryable, err := lookup.LookupRegisteredEndpoint(ip)
if err != nil {
    if retryable {
        time.AfterFunc(200*time.Millisecond, func() { retryLookup(ip) })
        return
    }
    log.Error("permanent lookup failure", "err", err)
}

When it happens

Trigger: Calling LookupRegisteredEndpoint (used during FQDN/IP lookups in policy evaluation) before the local node has been registered in localNodeStore, or when the underlying Get context call errors (deadline, shutdown).

Common situations: Cilium agent still starting up while DNS requests or policy lookups arrive; agent restarting and local node not yet synced from cluster store; heavy load delaying node initialization.

Related errors

• failed to finalise LB initialization: %w
• pod store is not initialized
• %s reconciler initialization failed: %w
• failed to get local node: %w
• failed to get local node: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b35c1fce2bfa3c57. Report an issue: GitHub.