{"record":{"id":"42feb84bcca9b875","repo":"cilium/cilium","slug":"native-routing-cidr-must-be-configured-with-option-42feb8","errorCode":null,"errorMessage":"native routing cidr must be configured with option --%s in combination with --%s=true --%s=true --%s=false --%s=%s","messagePattern":"native routing cidr must be configured with option --(.+?) in combination with --(.+?)=true --(.+?)=true --(.+?)=false --(.+?)=(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/option/config.go","lineNumber":2998,"sourceCode":"\t\tEnableIPMasqAgent,\n\t\tRoutingMode, RoutingModeNative,\n\t\tIPAM, c.IPAMMode())\n}\n\nfunc (c *DaemonConfig) checkIPv6NativeRoutingCIDR() error {\n\tif c.IPv6NativeRoutingCIDR.IsValid() {\n\t\treturn nil\n\t}\n\tif !c.EnableIPv6 || !c.EnableIPv6Masquerade {\n\t\treturn nil\n\t}\n\tif c.EnableIPMasqAgent {\n\t\treturn nil\n\t}\n\tif !c.RequiresNativeRouting() {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\n\t\t\"native routing cidr must be configured with option --%s \"+\n\t\t\t\"in combination with --%s=true --%s=true --%s=false --%s=%s\",\n\t\tIPv6NativeRoutingCIDR,\n\t\tEnableIPv6Name, EnableIPv6Masquerade,\n\t\tEnableIPMasqAgent,\n\t\tRoutingMode, RoutingModeNative)\n}\n\nfunc (c *DaemonConfig) checkIPAMDelegatedPlugin() error {\n\tif c.IPAM == ipamOption.IPAMDelegatedPlugin {\n\t\t// When using IPAM delegated plugin, IP addresses are allocated by the CNI binary,\n\t\t// not the daemon. Therefore, features which require the daemon to allocate IPs for itself\n\t\t// must be disabled.\n\t\tif c.EnableIPv4 && c.LocalRouterIPv4 == \"\" {\n\t\t\treturn fmt.Errorf(\"--%s must be provided when IPv4 is enabled with --%s=%s\", LocalRouterIPv4, IPAM, ipamOption.IPAMDelegatedPlugin)\n\t\t}\n\t\tif c.EnableIPv6 && c.LocalRouterIPv6 == \"\" {\n\t\t\treturn fmt.Errorf(\"--%s must be provided when IPv6 is enabled with --%s=%s\", LocalRouterIPv6, IPAM, ipamOption.IPAMDelegatedPlugin)","sourceCodeStart":2980,"sourceCodeEnd":3016,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/option/config.go#L2980-L3016","documentation":"The IPv6 counterpart of the native-routing CIDR validation: when IPv6 masquerade is enabled in native routing mode, Cilium requires --ipv6-native-routing-cidr so the datapath can exclude in-cluster destinations from masquerade. Validation fails when it is unset under the RequiresNativeRouting conditions.","triggerScenarios":"DaemonConfig.Validate() runs with EnableIPv6=true, EnableIPv6Masquerade=true, EnableIPMasqAgent=false, RoutingMode=native, RequiresNativeRouting() true, and IPv6NativeRoutingCIDR empty — e.g. agent started with --enable-ipv6 --routing-mode=native but no --ipv6-native-routing-cidr.","commonSituations":"Dual-stack clusters switching to native routing mode without adding the IPv6 CIDR; Helm values updated for IPv6NativeRoutingCIDR missing; operators who set only the IPv4 CIDR.","solutions":["Set --ipv6-native-routing-cidr=<IPv6 pod CIDR> matching the cluster's IPv6 pod CIDR","In Helm, set ipv6NativeRoutingCIDR in values","Set --routing-mode=tunnel if native routing is not intended","Or enable --enable-ip-masq-agent, which bypasses this requirement","If IPv6 is not used, disable it with --enable-ipv6=false"],"exampleFix":"# before\ncilium-agent --enable-ipv6=true --routing-mode=native --enable-ipv6-masquerade=true\n# after\ncilium-agent --enable-ipv6=true --routing-mode=native --enable-ipv6-masquerade=true --ipv6-native-routing-cidr=fd00::/64","handlingStrategy":"validation","validationCode":"function validateNativeRoutingV6(cfg) {\n  const nativeRequired = cfg.routingMode === 'native' && cfg.enableIPv6 && cfg.enableIPv6Masquerade && !cfg.enableIPMasqAgent;\n  if (nativeRequired && !cfg.ipv6NativeRoutingCIDR) {\n    throw new Error('ipv6-native-routing-cidr must be set in native routing mode with IPv6 masquerade');\n  }\n  return true;\n}","typeGuard":"function needsIPv6NativeCIDR(c) { return c.EnableIPv6 && c.EnableIPv6Masquerade && !c.EnableIPMasqAgent && c.RoutingMode === 'native'; }","tryCatchPattern":null,"preventionTips":["In dual-stack native-routing deployments set both ipv4NativeRoutingCIDR and ipv6NativeRoutingCIDR","Set ipv6NativeRoutingCIDR in Helm values for IPv6 clusters","Disable IPv6 explicitly if unused so the check is skipped","Add a dual-stack config lint to CI"],"tags":["cilium","networking","ipv6","masquerade"],"backgroundTag":"missing-required-config-option","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}