{"record":{"id":"619ba17d21d47bc9","repo":"cilium/cilium","slug":"specified-socket-reverse-nat-tables-size-d-must-n","errorCode":null,"errorMessage":"specified Socket Reverse NAT tables size %d must not exceed maximum %d","messagePattern":"specified Socket Reverse NAT tables size (.+?) must not exceed maximum (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/loadbalancer/config.go","lineNumber":441,"sourceCode":"\n\t// Dynamically size the SockRevNat map if not set by the user.\n\tif cfg.LBSockRevNatEntries == 0 {\n\t\tgetEntries := dcfg.GetDynamicSizeCalculator(log)\n\t\tcfg.LBSockRevNatEntries = getEntries(option.SockRevNATMapEntriesDefault, option.LimitTableAutoSockRevNatMin, option.LimitTableMax)\n\t\tlog.Info(\"Option set by dynamic sizing\",\n\t\t\tlogfields.Option, LBSockRevNatEntriesName,\n\t\t\tlogfields.Value, cfg.LBSockRevNatEntries,\n\t\t)\n\t}\n\n\tcfg.LBSockRevNatEntries = dcfg.AlignMapSizeForLRU(log, LBSockRevNatEntriesName, cfg.LBSockRevNatEntries)\n\n\tif cfg.LBSockRevNatEntries < option.LimitTableMin {\n\t\treturn Config{}, fmt.Errorf(\"specified Socket Reverse NAT table size %d must be greater or equal to %d\",\n\t\t\tcfg.LBSockRevNatEntries, option.LimitTableMin)\n\t}\n\tif cfg.LBSockRevNatEntries > option.LimitTableMax {\n\t\treturn Config{}, fmt.Errorf(\"specified Socket Reverse NAT tables size %d must not exceed maximum %d\",\n\t\t\tcfg.LBSockRevNatEntries, option.LimitTableMax)\n\t}\n\n\t// Use [cfg.LBMapEntries] for map size if not overridden.\n\topts := []*int{\n\t\t&cfg.LBServiceMapEntries,\n\t\t&cfg.LBBackendMapEntries,\n\t\t&cfg.LBRevNatEntries,\n\t\t&cfg.LBAffinityMapEntries,\n\t\t&cfg.LBSourceRangeMapEntries,\n\t\t&cfg.LBMaglevMapEntries,\n\t}\n\tfor _, opt := range opts {\n\t\tif *opt == 0 {\n\t\t\t*opt = cfg.LBMapEntries\n\t\t}\n\t}\n","sourceCodeStart":423,"sourceCodeEnd":459,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/loadbalancer/config.go#L423-L459","documentation":"After the lower-bound check, NewConfig rejects a socket reverse NAT table size above option.LimitTableMax with this error (note the slightly different wording 'tables size'). BPF LRU hash maps have an upper bound the datapath relies on, so oversized values abort startup. Like its sibling check, it runs only once during NewConfig.","triggerScenarios":"Calling NewConfig with LBSockRevNatEntries greater than option.LimitTableMax, e.g. --sock-revnat-maxEntries=100000000, or automation computing a huge size from host memory.","commonSituations":"Setting map sizes 'to be safe' with very large numbers; scripts sizing tables proportional to node memory without an upper clamp; confusing maxEntries units (entries vs bytes) leading to enormous values.","solutions":["Lower --sock-revnat-maxEntries to at most option.LimitTableMax (the second %d in the message shows the cap)","Pick a size within [LimitTableMin, LimitTableMax]; the error prints both bounds across the two checks","Remove any memory-based multiplier that inflates the value, or clamp it in your provisioning script","Verify the rendered ConfigMap value before restarting the agent"],"exampleFix":"// before\nsock-revnat-maxEntries: \"100000000\"\n// after\nsock-revnat-maxEntries: \"65536\"","handlingStrategy":"validation","validationCode":"if v := cfg.LBSockRevNatEntries; v > option.LimitTableMax {\n\treturn fmt.Errorf(\"sock rev NAT entries %d exceeds maximum %d\", v, option.LimitTableMax)\n}\n// run after AlignMapSizeForLRU semantics are considered","typeGuard":null,"tryCatchPattern":"if _, err := loadbalancer.NewConfig(log, uc, dcfg); err != nil {\n\tif strings.Contains(err.Error(), \"must not exceed maximum\") {\n\t\tlog.Fatalf(\"lower --sock-revnat-maxEntries to <= the cap in the message: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Cap memory-derived map sizing scripts at LimitTableMax","Do not confuse entries with bytes when sizing the socket rev NAT table","Clamp provisioning templates to the documented min/max range","Validate the rendered ConfigMap value before rollout"],"tags":["go","loadbalancer","config","socket-lb","map-size"],"backgroundTag":"invalid-map-size-config","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}