Operator IPAM Allocation Starvation

critical

Resource ContentionUpdated Feb 23, 2026

When cilium_operator_ipam_needed_ips exceeds cilium_operator_ipam_ips, pods cannot be scheduled due to IP exhaustion. This is exacerbated by high cilium_operator_ipam_deficit_resolver_time_seconds, indicating the operator is struggling to provision new IPs from the cloud provider.

Sources

Troubleshooting — Cilium 1.19.1 documentationdocs.cilium.io

Technologies:

CiliumSymptoms of this issue are visible in Cilium metrics and logs

Azure MonitorThe root cause of this issue originates in Azure Monitor

How to detect:

Monitor cilium_operator_ipam_needed_ips and cilium_operator_ipam_ips. When needed exceeds available, new pod scheduling will fail. High cilium_operator_ipam_deficit_resolver_time_seconds or cilium_operator_ipam_allocation_time_seconds_datadog indicates slow IP provisioning from cloud APIs.

Recommended action:

Pre-allocate IPs by increasing IPAM pool size. Monitor cilium_operator_ipam_empty_interface_slots to ensure ENI/interface capacity. Check cloud provider API rate limits with cilium_operator_ec2_api_rate_limit_time_seconds_datadog (AWS) or cilium_operator_azure_api_rate_limit_time_seconds. Increase IPAM pre-allocation settings to buffer against pod scaling events.