{"record":{"id":"259dbb9dbd51c947","repo":"cilium/cilium","slug":"remove-default-local-ipv6-rule-w","errorCode":null,"errorMessage":"remove default local ipv6 rule: %w","messagePattern":"remove default local ipv6 rule: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/node.go","lineNumber":849,"sourceCode":"\t}\n\n\tif option.Config.EnableIPv4 {\n\t\tif err := route.ReplaceRule(r); err != nil {\n\t\t\treturn fmt.Errorf(\"replace local ipv4 rule: %w\", err)\n\t\t}\n\n\t\tif err := deleteDefaultLocalRule(netlink.FAMILY_V4); err != nil {\n\t\t\treturn fmt.Errorf(\"remove default local ipv4 rule: %w\", err)\n\t\t}\n\t}\n\n\tif option.Config.EnableIPv6 {\n\t\tif err := route.ReplaceRuleIPv6(r); err != nil {\n\t\t\treturn fmt.Errorf(\"replace local ipv6 rule: %w\", err)\n\t\t}\n\n\t\tif err := deleteDefaultLocalRule(netlink.FAMILY_V6); err != nil {\n\t\t\treturn fmt.Errorf(\"remove default local ipv6 rule: %w\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// deleteDefaultLocalRule removes a rule with pref 0 pointing to routing table\n// 255 (local). Returns nil if the rule is not present.\nfunc deleteDefaultLocalRule(family int) error {\n\trule := route.Rule{\n\t\tTable:    unix.RT_TABLE_LOCAL,\n\t\tPriority: 0,\n\t}\n\n\terr := route.DeleteRule(family, rule)\n\tif errors.Is(err, syscall.ENOENT) {\n\t\treturn nil\n\t}","sourceCodeStart":831,"sourceCodeEnd":867,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/node.go#L831-L867","documentation":"Mirrors the IPv4 case: after replacing the cilium IPv6 local-lookup rule, NodeEnsureLocalRoutingRule deletes the default IPv6 'local' rule. Any netlink error besides ENOENT from deleteDefaultLocalRule(FAMILY_V6) is wrapped and returned.","triggerScenarios":"EnableIPv6=true and the RTM_DELRULE for the IPv6 priority-0 local rule fails with EPERM/EOPNOTSUPP or another non-ENOENT netlink error.","commonSituations":"Sandboxed runtimes refusing deletion of the default local rule; kernels lacking IPv6 policy-routing support; concurrent rule modification by other CNI components.","solutions":["Run the agent with CAP_NET_ADMIN in the host netns","Confirm the kernel allows deleting IPv6 local rules (test manually: 'ip -6 rule del pref 0 local') — if the kernel forbids it, this environment cannot run Cilium IPv6 local-rule mode","Check for competing agents/CNI plugins toggling ip rules concurrently","Collect the wrapped errno to guide kernel/environment troubleshooting"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight in a test netns\nif err := testDeleteIPv6LocalRule(); err != nil {\n    return fmt.Errorf(\"cannot delete ipv6 local rule in this environment: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := h.NodeEnsureLocalRoutingRule(); err != nil {\n    if strings.Contains(err.Error(), \"remove default local ipv6 rule\") {\n        // fall back to alerting + skip half-configured state\n        return fmt.Errorf(\"node unusable for ipv6 datapath: %w\", err)\n    }\n    return err\n}","preventionTips":["Test node images against Cilium preflight checks (cilium preflight) before rollout","Avoid sandboxed runtimes that block rule deletion","Keep node kernel versions within Cilium's supported matrix","Detect ENOENT-vs-real-error distinction in custom wrappers"],"tags":["routing","ip-rule","netlink","ipv6","cilium"],"backgroundTag":"ip-rule-delete-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}