cilium/cilium · error

missing node IP for node %q

Error message

missing node IP for node %q

What it means

updatePeer needs at least one usable node IP (IPv4 or IPv6, per agent config) to build the WireGuard peer endpoint. If neither family is present — or the family present is disabled in the agent config — the peer cannot be programmed and this error is returned. It is a data-validation error on the CiliumNode's IP addresses.

Source

Thrown at pkg/wireguard/agent/agent.go:608

	if a.config.EnableIPv6 && nodeIPv6 != nil {
		ipn := net.IPNet{
			IP:   nodeIPv6,
			Mask: net.CIDRMask(net.IPv6len*8, net.IPv6len*8),
		}
		if !peer.hasAllowedIP(ipn) {
			peer.queueAllowedIPsInsert(ipn)
		}
	}

	ep := ""
	if a.config.TunnelingEnabled && a.config.UnderlayProtocol == tunnel.IPv6 && a.config.EnableIPv6 && nodeIPv6 != nil {
		ep = net.JoinHostPort(nodeIPv6.String(), strconv.Itoa(types.ListenPort))
	} else if a.config.EnableIPv4 && nodeIPv4 != nil {
		ep = net.JoinHostPort(nodeIPv4.String(), strconv.Itoa(types.ListenPort))
	} else if a.config.EnableIPv6 && nodeIPv6 != nil {
		ep = net.JoinHostPort(nodeIPv6.String(), strconv.Itoa(types.ListenPort))
	} else {
		return fmt.Errorf("missing node IP for node %q", nodeName)
	}

	epAddr, err := net.ResolveUDPAddr("udp", ep)
	if err != nil {
		return fmt.Errorf("failed to resolve peer endpoint address: %w", err)
	}

	peer.pubKey = pubKey
	peer.endpoint = epAddr
	peer.nodeIPv4 = nodeIPv4
	peer.nodeIPv6 = nodeIPv6

	a.logger.Debug(
		"Updating peer",
		logfields.NodeName, nodeName,
		logfields.PubKey, pubKeyHex,
		logfields.NodeIPv4, nodeIPv4,
		logfields.NodeIPv6, nodeIPv6,

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the CiliumNode resource has valid addresses (kubectl get ciliumnode <name> -o yaml)
2. Ensure the K8s node has a PodCIDR (kube-controller-manager not in a mode that omits it) or configure cilium CIDRs explicitly
3. Align agent IP family flags (enable-ipv4/enable-ipv6) with actual node addresses
4. Wait for/restart the node's IPAM allocation so addresses are published before WireGuard sync

Example fix

// before (agent: enable-ipv6 only, node has only IPv4)
// error: missing node IP
// after
// enable the family matching node addresses:
cilium-agent --enable-ipv4=true --enable-ipv6=false

func nodeHasUsableIP(node *CiliumNode, ipv4, ipv6 bool) error {
    for _, a := range node.Spec.Addresses {
        ip := net.ParseIP(a.IP)
        if ip == nil { continue }
        if ipv4 && ip.To4() != nil { return nil }
        if ipv6 && ip.To4() == nil { return nil }
    }
    return errors.New("no node IP matching enabled address families")
}

if err := nodeHasUsableIP(ciliumNode, cfg.EnableIPv4, cfg.EnableIPv6); err != nil {
    // defer WireGuard sync until IPAM publishes an address
    return backoff(err)
}

When it happens

Trigger: Update -> updatePeer with nodeIPv4 == nil and nodeIPv6 == nil (or the only available IP family is disabled via EnableIPv4/EnableIPv6), so the endpoint cannot be constructed.

Common situations: CiliumNode resource missing .spec.addresses entries, node not yet allocated pod/node CIDRs, agent running IPv6-only while node only has an IPv4 address (or vice versa), or K8s node reporting no PodCIDR.

Related errors

• not ready
• Bad connection mode
• no cilium agent pods found
• unable to detect minimum Cilium version
• failed to get security group ids

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/c2c7c7cdc87c4648. Report an issue: GitHub.