{"record":{"id":"2d3d9810817c5f2f","repo":"istio/istio","slug":"failed-to-add-ip-s-to-ipset-s-w","errorCode":null,"errorMessage":"failed to add IP %s to ipset %s: %w","messagePattern":"failed to add IP (.+?) to ipset (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cni/pkg/ipset/nldeps_linux.go","lineNumber":72,"sourceCode":"\t\treturn nil\n\t}\n\treturn err\n}\n\nfunc (m *realDeps) destroySet(name string) error {\n\terr := netlink.IpsetDestroy(name)\n\treturn err\n}\n\nfunc (m *realDeps) addIP(name string, ip netip.Addr, ipProto uint8, comment string, replace bool) error {\n\terr := netlink.IpsetAdd(name, &netlink.IPSetEntry{\n\t\tComment:  comment,\n\t\tIP:       net.IP(ip.AsSlice()),\n\t\tProtocol: &ipProto,\n\t\tReplace:  replace,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to add IP %s to ipset %s: %w\", ip, name, err)\n\t}\n\treturn nil\n}\n\nfunc (m *realDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {\n\terr := netlink.IpsetDel(name, &netlink.IPSetEntry{\n\t\tIP:       net.IP(ip.AsSlice()),\n\t\tProtocol: &ipProto,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to delete IP %s from ipset %s: %w\", ip, name, err)\n\t}\n\treturn nil\n}\n\nfunc (m *realDeps) flush(name string) error {\n\terr := netlink.IpsetFlush(name)\n\tif err != nil {","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/cni/pkg/ipset/nldeps_linux.go#L54-L90","documentation":"A thin wrapper around netlink.IpsetAdd: adding an IP entry to a kernel ipset failed. '%s'/'%s' are the IP and set name; '%w' carries the netlink error. In istio-cni these sets (e.g. istio-in-pod/istio-out-pod for ambient interception) drive pod traffic redirect, so failures degrade traffic capture.","triggerScenarios":"realDeps.addIP is called (e.g. when a pod is added to an ambient mesh and its IP must be inserted) and the kernel rejects the netlink IPSET_CMD_ADD: set does not exist, entry already exists without replace, protocol mismatch (IPv4 entry into IPv6 set), or permission/netlink communication failure.","commonSituations":"ipsetCreate was skipped or the set was destroyed concurrently by another agent (iptables-legacy tools, a node cleanup job); kernel ipset revision too old for the 'comment' feature (see the Alpine note in the same file); running without CAP_NET_ADMIN; race between pod deletion and re-add where replace=false and the entry already exists.","solutions":["Inspect the wrapped netlink error: 'Set cannot be added to' / 'already exists' points to ordering; recreate the set (ipset destroy istio-in-pod; the node agent recreates it).","If 'already exists', ensure callers pass replace=true where re-adding is expected, or clear stale entries first (the wrapper supports comment-based clearing).","Verify the ipset exists before adding: ipset list istio-in-pod.","Check capabilities: the pod needs CAP_NET_ADMIN; on old kernels upgrade or drop the comment feature."],"exampleFix":"// before\nerr := m.addIP(setName, ip, 0x06, comment, false)\n// after: tolerate re-adds during pod churn\nerr := m.addIP(setName, ip, 0x06, comment, true)","handlingStrategy":"retry","validationCode":"ipset list istio-in-pod >/dev/null 2>&1 || echo \"set missing; create before adding entries\"","typeGuard":null,"tryCatchPattern":"// Retry once after recreating the set, idempotently.\nif err := deps.AddIP(set, ip, proto, comment, true); err != nil {\n    if isNotExist(err) {\n        _ = deps.Create(set) // recreate then retry once\n        err = deps.AddIP(set, ip, proto, comment, true)\n    }\n    if err != nil { /* log and surface */ }\n}","preventionTips":["Always create the ipset before adding entries (create-then-add ordering).","Pass replace=true for idempotent re-adds during pod churn.","Keep CAP_NET_ADMIN on the node agent and protect sets from external destroy."],"tags":["istio","ambient","ipset","netlink","linux"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}