{"record":{"id":"64f13331077d0e74","repo":"cilium/cilium","slug":"failed-to-flush-ip6tables-chain-s-w","errorCode":null,"errorMessage":"failed to flush ip6tables chain %s: %w","messagePattern":"failed to flush ip6tables chain (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ztunnel/iptables/inpod.go","lineNumber":507,"sourceCode":"\t\t\t\t_ = ipt6.Delete(table, mainChain, \"-j\", customChain)\n\t\t\t}\n\t\t}\n\t}\n\n\t// Then flush and delete the custom chains\n\tfor _, table := range []string{\"mangle\", \"nat\"} {\n\t\tfor _, chain := range []string{InpodPreroutingChain, InpodOutputChain} {\n\t\t\tif ipv4Enabled {\n\t\t\t\tif err := ipt4.ClearChain(table, chain); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to flush iptables chain %s: %w\", chain, err)\n\t\t\t\t}\n\t\t\t\tif err := ipt4.DeleteChain(table, chain); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to delete iptables chain %s: %w\", chain, err)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif ipv6Enabled {\n\t\t\t\tif err := ipt6.ClearChain(table, chain); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to flush ip6tables chain %s: %w\", chain, err)\n\t\t\t\t}\n\t\t\t\tif err := ipt6.DeleteChain(table, chain); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to delete ip6tables chain %s: %w\", chain, err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":489,"sourceCodeEnd":517,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ztunnel/iptables/inpod.go#L489-L517","documentation":"Returned by deleteInPodChains when iptables.ClearChain (flush) fails for an ip6tables chain (InpodPreroutingChain or InpodOutputChain) while tearing down ztunnel in-pod rules. Flushing precedes chain deletion so the kernel allows removal; this error means the flush itself failed, and the wrap preserves the underlying ip6tables error.","triggerScenarios":"Calling DeleteInPodRules with IPv6 enabled when the IPv6 iptables subsystem is unavailable (kernel without CONFIG_IP6_NF_* modules), ip6tables binary missing from the image, or permission denied (missing CAP_NET_ADMIN) during the ClearChain call.","commonSituations":"Hosts with IPv6 disabled in sysctl but Cilium's IPv6 inpod interception enabled; container images missing the ip6tables binary; minimal kernels (e.g. some GKE/Bottlerocket variants) without ip6tables filter-table support; pods dropped NET_ADMIN.","solutions":["Verify IPv6 is actually usable on the node (ip -6 addr, 'ip6tables -L' works) or disable IPv6 in the Cilium/ztunnel config so this branch is skipped.","Install the ip6tables package in the agent container image.","Grant NET_ADMIN capability to the istio-cni/ztunnel pod.","Load required kernel modules (ip6_tables, ip6table_filter, nf_conntrack) on the host.","Check 'dmesg' for module load failures if the underlying error mentions permission/module issues."],"exampleFix":"// before: teardown hard-fails when ip6tables is unusable\nif err := ipt6.ClearChain(table, chain); err != nil {\n    return fmt.Errorf(\"failed to flush ip6tables chain %s: %w\", chain, err)\n}\n// after: skip IPv6 chains when IPv6 is disabled/unavailable on the host\nif !ipv6Enabled || !ipv6Supported() {\n    continue\n}\nif err := ipt6.ClearChain(table, chain); err != nil {\n    return fmt.Errorf(\"failed to flush ip6tables chain %s: %w\", chain, err)\n}","handlingStrategy":"validation","validationCode":"// confirm ip6tables works before enabling IPv6 inpod rules\nfunc ipv6Supported() bool {\n    if err := exec.Command(\"ip6tables\", \"-L\", \"-n\").Run(); err != nil {\n        return false\n    }\n    if b, err := os.ReadFile(\"/proc/sys/net/ipv6/conf/all/disable_ipv6\"); err == nil {\n        return strings.TrimSpace(string(b)) == \"0\"\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"err := ztunnel.DeleteInPodRules(podNetns, cfg)\nif err != nil && strings.Contains(err.Error(), \"failed to flush ip6tables chain\") {\n    log.Warnw(\"ip6tables flush failed; IPv6 rules may be stale\", \"err\", err)\n    // degrade: continue with IPv4-only cleanup or retry with backoff\n    return retryWithBackoff(deleteV6Chains)\n}","preventionTips":["Check /proc/sys/net/ipv6/conf/all/disable_ipv6 and ip6tables availability before enabling IPv6 inpod mode.","Load ip6_tables/ip6table_filter modules on the host via node init.","Include the ip6tables binary in the agent image.","Grant NET_ADMIN to the cleanup pod."],"tags":["ip6tables","network","go","ipv6","cleanup"],"backgroundTag":"ip6tables-flush-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}