{"record":{"id":"5eaa72d4d1d9120e","repo":"kubernetes/kops","slug":"error-checking-for-sys-fs-bpf-v","errorCode":null,"errorMessage":"error checking for /sys/fs/bpf: %v","messagePattern":"error checking for /sys/fs/bpf: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/networking/cilium.go","lineNumber":79,"sourceCode":"\tdisableManageForeignRoutes(c, b.Distribution)\n\tdisableCloudInitNetworkHotplug(c, b.Distribution)\n\n\tif b.NodeupConfig.Networking.Cilium.IPAM == kops.CiliumIpamEni {\n\t\tmaskEC2NetUtilsUdevRules(c, b.Distribution)\n\t\tsetMACAddressPolicyNone(c, b.Distribution)\n\t\tif err := markSecondaryENIsUnmanaged(c, b.Distribution); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (b *CiliumBuilder) buildBPFMount(c *fi.NodeupModelBuilderContext) error {\n\tvar fsdata unix.Statfs_t\n\terr := unix.Statfs(\"/sys/fs/bpf\", &fsdata)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error checking for /sys/fs/bpf: %v\", err)\n\t}\n\n\t// equivalent to unix.BPF_FS_MAGIC in golang.org/x/sys/unix\n\tBPF_FS_MAGIC := uint32(0xcafe4a11)\n\n\t// systemd v238 includes the bpffs mount by default; and gives an error \"has a bad unit file setting\" if we try to mount it again (see mount_point_is_api)\n\talreadyMounted := uint32(fsdata.Type) == BPF_FS_MAGIC\n\n\tif !alreadyMounted {\n\t\tunit := `\n[Unit]\nDescription=Cilium BPF mounts\nDocumentation=http://docs.cilium.io/\nDefaultDependencies=no\nBefore=local-fs.target umount.target kubelet.service\n\n[Mount]\nWhat=bpffs","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/networking/cilium.go#L61-L97","documentation":"buildBPFMount calls unix.Statfs(\"/sys/fs/bpf\") to determine whether bpffs is already mounted; any Statfs error (other than the magic-check flow) is wrapped in this error. It means nodeup could not even probe the BPF filesystem, usually because /sys/fs/bpf does not exist or the kernel lacks bpf support.","triggerScenarios":"unix.Statfs(\"/sys/fs/bpf\", &fsdata) returns an error during nodeup Build on a Cilium-enabled node — missing bpffs mount point, kernel without CONFIG_BPF_FS, or /sys not mounted.","commonSituations":"Minimal/custom AMIs or Linode images lacking the bpf mount; containers without /sys passthrough; very old kernels (<4.x); hardened kernels with bpf disabled.","solutions":["Mount bpffs on the host: mount -t bpf bpf /sys/fs/bpf (and persist in the image)","Use a kernel image with BPF filesystem support (CONFIG_BPF_FS=y)","Ensure /sys is mounted before nodeup runs","Upgrade the OS image to a distribution with modern kernel/systemd that auto-provides the bpffs mount"],"exampleFix":"// before\n$ ls /sys/fs/bpf\nls: cannot access '/sys/fs/bpf': No such file or directory\n// after\n$ mount -t bpf bpf /sys/fs/bpf","handlingStrategy":"fallback","validationCode":"var fsdata unix.Statfs_t\nif err := unix.Statfs(\"/sys/fs/bpf\", &fsdata); err != nil {\n    klog.Warningf(\"/sys/fs/bpf not statable; mount bpffs before enabling Cilium: %v\", err)\n}\nif _, err := os.Stat(\"/proc/filesystems\"); err == nil {\n    if b, _ := os.ReadFile(\"/proc/filesystems\"); !strings.Contains(string(b), \"bpf\") {\n        klog.Warning(\"kernel lacks bpf filesystem support\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := unix.Statfs(\"/sys/fs/bpf\", &fsdata); err != nil {\n    return fmt.Errorf(\"error checking for /sys/fs/bpf: %v\", err) // caller may fall back to explicit mount\n}","preventionTips":["Add 'mount -t bpf bpf /sys/fs/bpf' to image bootstrap","Select kernels with CONFIG_BPF_FS=y","Keep /sys mounted and unmasked in the nodeup execution environment"],"tags":["nodeup","cilium","bpf","statfs","kernel"],"backgroundTag":"bpf-mount-unit-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}