{"record":{"id":"4b96f08197e1c4b0","repo":"cilium/cilium","slug":"adding-specified-prefixes-would-result-in-too-many","errorCode":null,"errorMessage":"adding specified prefixes would result in too many prefix lengths (current: %d, result: %d, max: %d)","messagePattern":"adding specified prefixes would result in too many prefix lengths \\(current: (.+?), result: (.+?), max: (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/counter/prefixes.go","lineNumber":81,"sourceCode":"\t\tcreateIPNet(net.IPv4len*8, net.IPv4len*8), // hosts\n\n\t\t// IPv6\n\t\tcreateIPNet(0, net.IPv6len*8),             // world\n\t\tcreateIPNet(net.IPv6len*8, net.IPv6len*8), // hosts\n\t}\n\tif _, err := counter.Add(defaultPrefixes); err != nil {\n\t\tpanic(fmt.Errorf(\"Failed to create default prefix lengths: %w\", err))\n\t}\n\n\treturn counter\n}\n\n// checkLimits checks whether the specified new count of prefixes would exceed\n// the specified limit on the maximum number of unique keys, and returns an\n// error if it would exceed the limit.\nfunc checkLimits(current, newCount, max int) error {\n\tif newCount > max {\n\t\treturn fmt.Errorf(\"adding specified prefixes would result in too many prefix lengths (current: %d, result: %d, max: %d)\",\n\t\t\tcurrent, newCount, max)\n\t}\n\treturn nil\n}\n\n// Add increments references to prefix lengths for the specified IPNets to the\n// counter. If the maximum number of unique prefix lengths would be exceeded,\n// returns an error.\n//\n// Returns true if adding these prefixes results in an increase in the total\n// number of unique prefix lengths in the counter.\nfunc (p *PrefixLengthCounter) Add(prefixes []netip.Prefix) (bool, error) {\n\tp.Lock()\n\tdefer p.Unlock()\n\n\t// Assemble a map of references that need to be added\n\tnewV4Counter := p.v4.DeepCopy()\n\tnewV6Counter := p.v6.DeepCopy()","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/counter/prefixes.go#L63-L99","documentation":"pkg/counter tracks unique IP prefix lengths (per IPCache-style counting). checkLimits enforces the configured maximum number of unique prefix lengths; adding prefixes whose resulting count exceeds the limit returns this error with current, resulting, and max counts. It exists to bound BPF map memory used by prefix-length counters.","triggerScenarios":"Calling prefixes.Add(...) with new /N lengths such that the total distinct prefix lengths in v4 or v6 counters would exceed maxUniquePrefixes4/6; typically from ipcache injecting many differently-sized CIDRs (e.g. pod CIDRs, host IPs of mixed mask lengths).","commonSituations":"Clusters with many disjoint node pod CIDRs of varying mask lengths (max is 32 for v4 / 128 conceptually but limit configured lower); restoring ipcache state after config change that lowered the limit; erroneous routes/bgp announcements injecting unusual masks like /9, /17.","solutions":["Increase the prefix-length limit via the relevant Cilium configuration (e.g. max-custom-counters / ipcache-related limits) if memory allows","Normalize CIDRs to a smaller set of common mask lengths before adding (aggregate routes)","Identify the source injecting unusual prefix lengths (ipcache dump / route dump) and correct it","Reduce the number of distinct CIDRs announced to the cluster"],"exampleFix":"// before\n// injecting 40 distinct v4 prefix lengths with limit 32\ncounter.Add(cidrs) // fails\n// after: aggregate CIDRs so only <=32 distinct lengths remain, or raise the limit in configuration","handlingStrategy":"validation","validationCode":"// count distinct prefix lengths before adding\nlens := map[int]struct{}{}\nfor _, n := range ipnets {\n    ones, _ := n.Mask.Size()\n    lens[ones] = struct{}{}\n}\nif len(lens) > maxUniquePrefixes { return errors.New(\"too many distinct prefix lengths\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Aggregate CIDRs to minimize distinct mask lengths before injection","Set the prefix-length limit consciously per cluster scale and memory budget","Watch for unusual masks (/9, /17) coming from routes/BGP sources","Log near-limit counts so you raise the limit before hitting the error"],"tags":["go","ipcache","memory-limit","prefixes","cilium"],"backgroundTag":"prefix-limit-exceeded","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}