{"record":{"id":"624a7cfea9d1d84d","repo":"istio/istio","slug":"failed-to-list-elements-from-ipv6-set-s-w","errorCode":null,"errorMessage":"failed to list elements from IPv6 set %s: %w","messagePattern":"failed to list elements from IPv6 set (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cni/pkg/nftables/host_sets.go","lineNumber":330,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to list elements from IPv4 set %s: %w\", h.v4SetName, err)\n\t}\n\n\tfor _, elem := range v4Elements {\n\t\tif len(elem.Key) > 0 {\n\t\t\tif ip, err := netip.ParseAddr(elem.Key[0]); err == nil {\n\t\t\t\tallIPs = append(allIPs, ip)\n\t\t\t} else {\n\t\t\t\tlog.Warnf(\"Failed to parse IPv4 address %s: %v\", elem.Key[0], err)\n\t\t\t}\n\t\t}\n\t}\n\n\t// List elements from IPv6 set if enabled\n\tif h.enableIPv6 {\n\t\tv6Elements, err := nft.ListElements(context.TODO(), \"set\", h.v6SetName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to list elements from IPv6 set %s: %w\", h.v6SetName, err)\n\t\t}\n\n\t\tfor _, elem := range v6Elements {\n\t\t\tif len(elem.Key) > 0 {\n\t\t\t\tif ip, err := netip.ParseAddr(elem.Key[0]); err == nil {\n\t\t\t\t\tallIPs = append(allIPs, ip)\n\t\t\t\t} else {\n\t\t\t\t\tlog.Warnf(\"Failed to parse IPv6 address %s: %v\", elem.Key[0], err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn allIPs, nil\n}\n\n// clearEntriesFromSetWithComment is a helper function to clear entries with a specific comment from a set\nfunc (h *HostNftSetManager) clearEntriesFromSetWithComment(nft builder.NftablesAPI, setName, comment string) error {","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/cni/pkg/nftables/host_sets.go#L312-L348","documentation":"This error is the IPv6 counterpart of the v4 list failure: while collecting all set members in ListEntriesByIP, the dump of the v6 set (only attempted when h.enableIPv6 is true) failed. The %w carries the nft error. It aborts the whole inventory call even if the v4 dump succeeded, because the function returns nil, err.","triggerScenarios":"With enableIPv6=true, nft.ListElements on h.v6SetName errors — v6 set never created (init transaction partially failed), IPv6 disabled at kernel level (ipv6.disable=0 but nf_tables ipv6 family blocked), or concurrent destruction of the table","commonSituations":"Nodes with partial IPv6 support (kernel module blacklisted) while ambient config requests dual stack; init succeeded for v4 but silently failed v6; mixed-capability node pools in one cluster","solutions":["Verify the v6 set exists (nft list sets); if missing, re-run Init with correct enableIPv6","Ensure the node truly supports IPv6 (net.ipv6.conf.all.disable_ipv6=0, nf_tables ipv6 available) and align EnableIPv6 accordingly","If the node is effectively v4-only, disable IPv6 in ambient config to skip the v6 dump","Restart the istio-cni node agent to rebuild both sets consistently"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Skip v6 inventory when the node cannot support it\nfunc v6NftUsable() bool {\n\tb, _ := os.ReadFile(\"/proc/sys/net/ipv6/conf/all/disable_ipv6\")\n\treturn strings.TrimSpace(string(b)) != \"1\"\n}","typeGuard":"func shouldListV6(enableIPv6, kernelV6 bool) bool { return enableIPv6 && kernelV6 }","tryCatchPattern":"// Degrade to v4-only inventory with a warning instead of failing the call\nips, err := mgr.ListEntriesByIP()\nif err != nil && strings.Contains(err.Error(), \"IPv6 set\") {\n\tlog.Warn(\"v6 set unavailable; falling back to v4 inventory\")\n\tips, err = mgr.listV4Only()\n}","preventionTips":["Gate EnableIPv6 on verified per-node IPv6 capability","Node-label pools by IP family capability and schedule ambient accordingly"],"tags":["nftables","ipv6","read-path","istio-cni"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}