Environment 环境A Rancher-provisioned or standalone RKE2 cluster with the Calico CNI一个由 Rancher 配置或独立 RKE2 集群配备 Calico CNISituation 地理位置Creating new Pods is failing with a FailedCreatePodSandBox event containing a message of the following format:创建新 Pods 失败FailedCreatePodSandBox 事件包含以下格式的消息span stylecolor:#000000span stylebackground-color:#ffffffspan stylebackground-color:#efefefcodefailed to setup network for sandbox hash: plugin typecalico failed (add): cannot allocate new block due to per host block limit /code/span/span/spanResolution 结局Check for and release any leaked IP addresses in the cluster by following the procedure in How to use calicoctl to query for and release leaked addresses in an RKE2 cluster.按照 《如何使用 calicoctl 查询并释放 RKE2 集群中泄露地址 》中的步骤检查并释放集群中泄露的 IP 地址。Cause 病因This issue occurs when the Calico IP Address Management (IPAM) cannot allocate an IP address for the pod, as there are no available addresses in the block(s) assigned to the node, and the node cannot be assigned a new block, due to themaxBlocksPerHostsetting (default 20). This is indicative of an IPAM resource leak.当 Calico IP 地址管理IPAM无法为 Pod 分配 IP 地址时就会出现这个问题因为分配给节点的块中没有可用的地址且由于maxBlocksPerHost设置 默认 20节点也无法被分配新的块。这表明存在 IPAM 资源泄漏。Over time, cluster events such as improper node shutdowns or failed pod deletions can lead to leaked IP addresses. These addresses remain marked as allocated in the Calico datastore but are not associated with any active workload or node, eventually exhausting the available pool.随着时间推移集群事件如节点关闭不当或 pod 删除失败可能导致“泄露”的 IP 地址。这些地址在 Calico 数据存储中仍标记为“已分配”但不关联任何活跃工作负载或节点最终会耗尽可用资源池。访问Rancher-K8S解决方案博主企业合作伙伴 https://blog.csdn.net/lidw2009