Antrea-agent log flooding: "Can't find matching interface for entity, skipping"

Products

• VMware NSX

Issue/Introduction

High log volume in antrea-agent pods, specifically within the kube-system namespace.

• Error Message: "Can't find matching interface for entity, skipping" entity="<namespace>/<pod_name>"

Environment

VMware NSX 4.x
Container Networking for Antrea 4.2.x

Cause

The error is triggered by a race condition or transitional state within the Antrea pod_reconciler. When a Pod (typically from a CronJob) completes its task and is automatically deleted by the Kubernetes controller, the Antrea agent may still attempt to reconcile the entity. Because the Pod has already been removed from the CNI cache or the underlying Open vSwitch (OVS) port has been destroyed, the reconciler cannot map the entity to a valid interface, resulting in the "skipping" log entry.

This message is diagnostic and indicates that the agent is correctly skipping an entity that no longer requires network policy or flow computation.

Resolution

This error is considered harmless and does not impact network connectivity, security policy enforcement, or the stability of active Pods.To verify the health of the environment, ensure that the Pods mentioned in the logs are indeed short-lived jobs that have completed successfully:

1. Check the status of Pods in the affected namespace:

   kubectl get pods -n <namespace>

2. Verify if the Pod name mentioned in the log still exists. If the Pod is missing, it confirms the entity was cleaned up before reconciliation.

Additional Information

Engineering is aware of the log verbosity and adjust the log level for these transient states in Antrea 2.1 release and later.