<p>regarding to below logs which I used describe pod, my pods stuck in pending state due to “FailedCreatePodSandBox”</p>

<p>there is some key note:
-I use calico as CNI.
-this log repeat multple time, I just past here this one as sample.
-the ip 192.168.90.152 belong to ingress and 129 belong to tiller in the munitoring NS of k8s and I do not know why k8s try to bind it to another pod.</p>

<p>I google this issue and got nothing here I’m.</p>

<pre><code>  Warning  FailedCreatePodSandBox  2m56s                   kubelet, worker-dev  Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container "2abca59b55efb476723ec9c4402ede6e3a6ee9aed67ecd19c3ef5c7719ae51f1" network for pod "service-stg-8d9d68475-2h4b8": NetworkPlugin cni failed to set up pod "service-stg-8d9d68475-2h4b8_stg" network: error adding host side routes for interface: cali670b0a20d66, error: route (Ifindex: 10688, Dst: 192.168.90.152/32, Scope: 253) already exists for an interface other than 'cali670b0a20d66'
  Warning  FailedCreatePodSandBox  2m53s                   kubelet, worker-dev  Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container "ec155fd442c0ea09b282a13c4399ae25b97d5c3786f90f1a045449b52ced4cb7" network for pod "service-stg-8d9d68475-2h4b8": NetworkPlugin cni failed to set up pod "service-stg-8d9d68475-2h4b8_stg" network: error adding host side routes for interface: cali670b0a20d66, error: route (Ifindex: 10691, Dst: 192.168.90.129/32, Scope: 253) already exists for an interface other than 'cali670b0a20d66'
</code></pre>

<p>can any one help on this issue?</p>

<p>As per design of CNI network plugins and according to Kubernetes network <a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/" rel="nofollow noreferrer">model</a>, Calico defines special IP pool <a href="https://www.keycdn.com/support/what-is-cidr" rel="nofollow noreferrer">CIDR</a> <code>CALICO_IPV4POOL_CIDR</code> to determine what IP ranges are valid to use for allocating pod IP addresses across k8s cluster.</p>

<p>When you spin up a new Pod on a particular K8s node Calico plugin will do the following:</p>

<ul>
<li>Check whether the Pod exists on this node;</li>
<li>Allocates IP address for this Pod from within defined <a href="https://www.projectcalico.org/calico-ipam-explained-and-enhanced/" rel="nofollow noreferrer">IPAM</a>
range;</li>
<li>Creates an virtual interface on the node's host and appropriate
routing rules in order to bridge network traffic between Pod and
container;</li>
<li>Register Pod IP in K8s API server.</li>
</ul>

<p>You can fetch the data about Calico virtual interfaces on the relevant node, i.e.:  </p>

<pre><code>$ ip link | grep cali

 cali80d3ff89956@if4: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1440 qdisc noqueue state UP mode DEFAULT group default 
 calie58f9d521fb@if4: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1440 qdisc noqueue state UP mode DEFAULT group default
</code></pre>

<p>In order to estimate the current issue , you can consider to query Calico <code>install-cni</code> Pod's container logs and retrieve the data about the certain Pod <code>service-stg-8d9d68475-2h4b8</code>, searching for the existing virtual interface mapping:</p>

<pre><code>kubectl logs $(kubectl get po -l k8s-app=calico-node -o jsonpath='{.items[0].metadata.name}' -n kube-system) -c calico-node -n kube-system| grep service-stg-8d9d68475-2h4b8_stg
</code></pre>
