{"record":{"id":"3b1b00c2b45f79c8","repo":"cilium/cilium","slug":"failed-to-render-cni-configuration-file-w","errorCode":null,"errorMessage":"failed to render CNI configuration file: %w","messagePattern":"failed to render CNI configuration file: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"daemon/cmd/cni/config.go","lineNumber":328,"sourceCode":"\t\t\t})\n\t\t}\n\t}()\n\n\t// generate CNI config, either by reading a user-supplied\n\t// template file or rendering our own.\n\tif c.config.ReadCNIConf != \"\" {\n\t\tcontents, err = os.ReadFile(c.config.ReadCNIConf)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read source CNI config file at %s: %w\", c.config.ReadCNIConf, err)\n\t\t}\n\t\tc.logger.Info(\n\t\t\t\"Reading CNI configuration file source\",\n\t\t\tlogfields.ConfigPath, c.config.ReadCNIConf,\n\t\t)\n\t} else {\n\t\tcontents, err = c.renderCNIConf()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to render CNI configuration file: %w\", err)\n\t\t}\n\t}\n\n\terr = ensureDirExists(c.cniConfDir)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create the dir %s of the CNI configuration file: %w\", c.cniConfDir, err)\n\t}\n\n\t// Check to see if existing file is the same; if so, do nothing\n\texistingContents, err := os.ReadFile(dest)\n\tif err == nil && bytes.Equal(existingContents, contents) {\n\t\tc.logger.Debug(\n\t\t\t\"Existing CNI configuration file unchanged\",\n\t\t\tlogfields.Destination, dest,\n\t\t)\n\t} else {\n\t\tif err != nil && !os.IsNotExist(err) {\n\t\t\tc.logger.Info(","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/daemon/cmd/cni/config.go#L310-L346","documentation":"When no user-supplied CNI config file is given, setupCNIConfFile renders the CNI conflist itself via c.renderCNIConf(). If rendering fails, the error is wrapped with this message. Render failures come from the internal config assembly (e.g. malformed IPAM/flannel settings or unsupported configuration combinations).","triggerScenarios":"c.renderCNIConf() returns an error while generating the default CNI configuration — typically invalid daemon flags (bad IPAM mode, missing network config) that make the rendered JSON/patch impossible.","commonSituations":"Invalid combination of cilium-agent CNI flags; broken cni-custom-conf templating; misconfigured --cip / IPAM values producing invalid netconf.","solutions":["Inspect the wrapped `%w` cause to see which render step failed","Review and correct the CNI-related agent flags (--cni-* and IPAM settings)","Alternatively supply a valid static file via --read-cni-conf to bypass rendering"],"exampleFix":"// before\n//   --write-cni-conf-when-ready=true --read-cni-conf=\"\"\n// after (bypass render)\n//   --read-cni-conf=/etc/cni/net.d/05-cilium.conflist","handlingStrategy":"fallback","validationCode":"// validate the flags that feed renderCNIConf before starting:\n// e.g. ensure IPAM mode and --cni-conf-dir values are supported combinations","typeGuard":null,"tryCatchPattern":"contents, err := renderCNIConf()\nif err != nil {\n    if userConf != \"\" {\n        contents, err = os.ReadFile(userConf) // fallback to user template\n    }\n    if err != nil { log.Fatalf(\"CNI config unavailable: %v\", err) }\n}","preventionTips":["Keep CNI-related agent flags within documented valid combinations","Test agent startup with your flag set in CI (Helm values lint / smoke test)","Provide an explicit --read-cni-conf template to bypass rendering when customization is heavy"],"tags":["cilium","cni","config","rendering"],"backgroundTag":"cni-config-render-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}