{"record":{"id":"028feedf8006f949","repo":"cilium/cilium","slug":"ipsec-requires-a-valid-bootid","errorCode":null,"errorMessage":"IPSec requires a valid BootID","messagePattern":"IPSec requires a valid BootID","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/node/sync/local_node_sync.go","lineNumber":86,"sourceCode":"\told node.LocalNode\n}\n\nfunc (ini *localNodeSynchronizer) InitLocalNode(ctx context.Context, n *node.LocalNode) error {\n\tn.Source = source.Local\n\n\tif err := ini.initFromConfig(n); err != nil {\n\t\treturn err\n\t}\n\n\tn.Local.UnderlayProtocol = ini.TunnelConfig.UnderlayProtocol()\n\n\tif err := ini.initFromK8s(ctx, n); err != nil {\n\t\treturn err\n\t}\n\n\tn.BootID = node.GetBootID(ini.Logger)\n\tif ini.IPsecConfig.Enabled() && n.BootID == \"\" {\n\t\treturn fmt.Errorf(\"IPSec requires a valid BootID\")\n\t}\n\n\tfor _, fn := range ini.ExtraInitFuncs {\n\t\tif err := fn(ctx, n); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (ini *localNodeSynchronizer) SyncLocalNode(ctx context.Context, store *node.LocalNodeStore) {\n\tif ini.K8sLocalNode == nil {\n\t\treturn\n\t}\n\n\tfor ev := range ini.K8sLocalNode.Events(ctx) {\n\t\tif ev.Kind == resource.Upsert {","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/node/sync/local_node_sync.go#L68-L104","documentation":"During InitLocalNode, after populating the local node from config and Kubernetes, the agent reads the node's BootID (derived from the machine boot / system information). If IPSec (transparent encryption) is enabled but the BootID is empty, initialization aborts, because IPSec key material is keyed per boot and a missing BootID would make SPI/XFRM state unsafe.","triggerScenarios":"IPsecConfig.Enabled() is true (encryption enabled, e.g. --enable-ipsec=true) and node.GetBootID() returns an empty string during local node initialization, causing InitLocalNode (the public LocalNodeSynchronizer entry point) to return this error and agent startup to fail.","commonSituations":"Containers or VMs lacking /proc/sys/kernel/random/boot_id or equivalent boot identification; running in environments (some sandboxed/container runtimes) where the boot ID file is unreadable; unusual platforms where GetBootID cannot determine a stable boot identifier.","solutions":["Verify /proc/sys/kernel/random/boot_id exists and is readable inside the agent's environment; mount it if the runtime hides it.","Check node.GetBootID() fallback paths and logs to see why it returned empty (e.g. missing procfs mount).","Run the agent with proper privileges/host mounts (hostPID/proc access) so kernel files are visible.","If IPsec is not actually needed, disable transparent encryption (--enable-ipsec=false) to bypass the requirement."],"exampleFix":"// before: container without boot_id visible\n//   docker run cilium/...   (no /proc/sys/kernel/random/boot_id)\n// after: expose host proc\n   docker run -v /proc/sys/kernel/random/boot_id:/proc/sys/kernel/random/boot_id:ro cilium/...","handlingStrategy":"validation","validationCode":"bootID, err := os.ReadFile(\"/proc/sys/kernel/random/boot_id\")\nif err != nil || len(strings.TrimSpace(string(bootID))) == 0 {\n    return errors.New(\"boot id unavailable: IPsec cannot be enabled\")\n}\nif ipsecEnabled && node.GetBootID(logger) == \"\" {\n    return errors.New(\"IPSec requires a valid BootID\")\n}","typeGuard":"func hasBootID(n *node.LocalNode) bool {\n    return n.BootID != \"\"\n}","tryCatchPattern":"if err := synchronizer.InitLocalNode(ctx, n); err != nil {\n    if strings.Contains(err.Error(), \"BootID\") {\n        log.Error(\"IPsec enabled but boot ID unavailable; aborting with encryption disabled rather than unsafe state\")\n    }\n    return err\n}","preventionTips":["Mount /proc/sys/kernel/random/boot_id into agent containers.","Pre-check the environment for boot ID availability before enabling IPsec.","Pin to runtimes/VMs that expose a stable boot ID.","Gate --enable-ipsec on an environment readiness check in deployment tooling."],"tags":["go","ipsec","encryption","bootid","startup"],"backgroundTag":"missing-boot-id","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}