Duplicate IP assignment after calico-node restart during pod sandbox recreation.

Environment

• Calico Version: v3.32.0
• Kubernetes Version: v1.35.6+rke2r1
• Orchestrator: RKE2
• Container Runtime: containerd
• Cluster Type: typha, kdd, k8s, operator, bgp

Description

After a node restart and subsequent calico-node pod restart (exit code 137), two pods on the same node were assigned the same IP address, causing one pod to fail with network connectivity errors.

Symptoms

• Pod fails with: dial tcp 10.43.0.1:443: connect: no route to host
• Two pods have identical status.podIP but different CNI annotations
• Host routing table has only one route entry for the duplicate IP (pointing to the wrong pod)

Evidence

Pod State showing duplicate IP

Network Namespace Verification

Both containers have the same IP (10.42.200.136) configured on their eth0 interface:

NFD Worker Pod:

2: eth0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    inet 10.42.200.136/32 scope global eth0

CoreDNS Pod:

2: eth0@if35: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    inet 10.42.200.136/32 scope global eth0

Host Routing Table

Only one route exists for the duplicate IP, pointing to CoreDNS veth:

10.42.200.136 dev calic64492632e4 scope link metric 1024

The NFD Worker's veth (cali29d604bb495) has no route entry.

Timeline of Events

CNI Log Evidence

At 09:18:19, NFD Worker sandbox was assigned 10.42.200.136:

2026-09-08 09:18:19.781 [INFO] cni-plugin/k8s.go 458: Added Mac, interface name, and active container ID to endpoint
  IPNetworks:[]string{"10.42.200.136/32"}

At 09:40:58, CoreDNS was also assigned 10.42.200.136:

2026-09-08 09:40:58.384 [INFO] ipam/ipam.go 1438: Successfully claimed IPs: [10.42.200.136/26]
  handle="k8s-pod-network.f15665446fd7919aae248340ab55e2691058a93a9c98c24eea4c3baa5e98acd4"

Steps to Reproduce

1. Have a multi-node cluster with Calico v3.32.0
2. Restart a worker node
3. During pod sandbox recreation, trigger calico-node restart (e.g., OOM kill, exit 137)
4. Schedule new pods on the same node
5. Observe duplicate IP assignment

Workaround

Delete the affected pod to force sandbox recreation with fresh IP allocation:

kubectl delete pod <pod-name> -n <namespace>

Attachments

Diagnostic logs are attached:

calico-minimal-logs-20260910-123305.tar.gz

Contents:

• CNI logs filtered for affected pods
• IPAM block state
• Network namespace state
• Host routing table
• Felix configuration
• Event timeline