How to fix endpoint not ready in Kubernetes

KubernetesADVANCEDHIGHUpdated Dec 6, 2025· 146 views

Cilium endpoint not ready errors occur when pods fail to establish network connectivity. Fix by checking node networking, verifying pod IP allocation, and investigating eBPF program issues.

Quick fix

Fixes endpoint not ready

kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg endpoint list
kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg endpoint get <endpoint-id>
  1. Check Cilium endpoint status
  2. Verify pod received IP address
  3. Monitor network traffic with Cilium monitor
  4. Verify IP forwarding is enabled
kubernetes — error
kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg endpoint list
kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg endpoint get <endpoint-id>
endpoint not ready

What this error means

In Cilium, an endpoint represents a pod's network interface state. When endpoints are not ready, pods cannot communicate with other pods, services, or external networks. This typically indicates issues with IP allocation, routing configuration, or eBPF program enforcement on the node.

Typical symptoms

  • Pods unable to communicate across nodes
  • Cilium endpoint list shows unhealthy endpoints
  • Network connectivity working on some nodes but not others
  • Pods on same node communicate, but cross-node fails
  • cilium-dbg endpoint list shows endpoints in Failed state
  • Packet drops visible in cilium monitor
  • Pods cannot reach services or external networks
  • DNS queries fail or timeout

Common causes

  1. IP address not properly allocated to pod
  2. eBPF programs not loaded or enforcing incorrectly
  3. Network routing not configured between nodes
  4. Node-to-node connectivity blocked by firewall
  5. Pod network namespace not properly initialized
  6. Cilium node selector not matching all nodes
  7. IP forwarding disabled on host
  8. Conflicting network policies or firewall rules

How to fix "endpoint not ready"

1Check Cilium endpoint status

List and examine endpoint states:

bash
kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg endpoint list
kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg endpoint get <endpoint-id>
2Verify pod received IP address

Check if pod has valid IP assigned:

bash
kubectl get pod <pod-name> -o wide
kubectl exec -it <pod-name> -- ip addr
kubectl exec -it <pod-name> -- ip route

If no IP, the IPAM system failed allocation.

3Monitor network traffic with Cilium monitor

Observe packet flow and drops:

bash
kubectl exec -it -n kube-system ds/cilium -- \
  cilium monitor -t drop
kubectl exec -it -n kube-system ds/cilium -- \
  cilium monitor --type=trace

Look for packet drops and their reason codes.

4Verify IP forwarding is enabled

Check host kernel forwarding configuration:

bash
sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding
# Enable if needed:
sudo sysctl -w net.ipv4.ip_forward=1
5Check node-to-node network connectivity

Verify direct connectivity between nodes:

bash
# From one node
ping <other-node-ip>
# Test from pod
kubectl exec -it <pod-name> -- ping <pod-on-other-node>
6Review eBPF program loading status

Check if eBPF programs are properly loaded:

bash
kubectl exec -it -n kube-system ds/cilium -- \
  cilium-dbg bpf list

If programs are missing, agent may not have started properly.

7Check if packet drops are due to policies

Identify if network policies are causing drops:

bash
kubectl get networkpolicy --all-namespaces
kubectl describe networkpolicy <policy-name>

Verify policies allow traffic between pods.

8Restart Cilium agent on problematic node

Force reinit of Cilium on node:

bash
kubectl delete pod -n kube-system -l app=cilium \
  --field-selector spec.nodeName=<node-name>
kubectl wait --for=condition=Ready pod \
  -n kube-system -l app=cilium --timeout=300s

Advanced notes

For production, use Cilium Hubble for continuous network monitoring. Test connectivity between every pair of nodes during cluster setup. Enable debug logging on Cilium agent for endpoint state machine tracking. For large clusters, use node selectors to limit Cilium deployment. Monitor endpoint creation/deletion metrics for high churn indicating instability.

Frequently asked questions

What does "endpoint not ready" mean?
In Cilium, an endpoint represents a pod's network interface state. When endpoints are not ready, pods cannot communicate with other pods, services, or external networks. This typically indicates issues with IP allocation, routing configuration, or eBPF program enforcement on the node.
How do I fix "endpoint not ready"?
Cilium endpoint not ready errors occur when pods fail to establish network connectivity. Fix by checking node networking, verifying pod IP allocation, and investigating eBPF program issues.
What causes "endpoint not ready"?
IP address not properly allocated to pod eBPF programs not loaded or enforcing incorrectly Network routing not configured between nodes
Is the "endpoint not ready" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading