{"record":{"id":"6f4d3b32397184d5","repo":"istio/istio","slug":"failed-to-run-detection-in-host-namespace-w","errorCode":null,"errorMessage":"failed to run detection in host namespace: %w","messagePattern":"failed to run detection in host namespace: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cni/pkg/nodeagent/detect_artifacts_linux.go","lineNumber":78,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\tlog.Debugf(\"failed to check for v6 IPset %s: %v\", v6Name, err)\n\t\t\t\tif detectionErr != nil {\n\t\t\t\t\tdetectionErr = fmt.Errorf(\"%w; v6 IPset detection failed: %w\", detectionErr, err)\n\t\t\t\t} else {\n\t\t\t\t\tdetectionErr = fmt.Errorf(\"v6 IPset detection failed: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif v6Exists {\n\t\t\t\tlog.Infof(\"detected iptables artifact: IPset %s exists\", v6Name)\n\t\t\t\tdetected = true\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t})\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"failed to run detection in host namespace: %w\", err)\n\t}\n\n\treturn detected, detectionErr\n}\n\n// ipsetExists checks if an IPset with the given name exists on the host.\n// Returns:\n//   - true, nil if the IPset exists\n//   - false, nil if the IPset does not exist (expected for clean/fresh setup)\n//   - false, error for any errors\nfunc ipsetExists(name string) (bool, error) {\n\t_, err := netlink.IpsetList(name)\n\tif err == nil {\n\t\t// IPset exists\n\t\treturn true, nil\n\t}\n\n\tif strings.Contains(err.Error(), \"no such file\") {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/cni/pkg/nodeagent/detect_artifacts_linux.go#L60-L96","documentation":"util.RunAsHost failed — the detection closure could not be executed inside the host network namespace, so artifact detection did not run at all. Distinct from [249]-[251]: those ran and probed ipsets; this never got there.","triggerScenarios":"EnterHostNamespace/nsenter-style switch fails: host /proc not mounted (no hostPID), missing CAP_SYS_ADMIN to setns, or the host netns reference cannot be resolved from the container.","commonSituations":"istio-cni agent deployed without hostPID/hostNetwork or without the /proc host mount; security policy (PSP/PSA/restricted SCC) blocking setns; running the agent as a plain unprivileged pod.","solutions":["Deploy the agent with hostNetwork: true (and hostPID / host /proc mount as the chart requires)","Grant CAP_SYS_ADMIN / CAP_NET_ADMIN or run privileged as documented for istio-cni","Relax the PodSecurity restricted policy on the istio-system namespace to privileged for the cni-node DaemonSet"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify host netns reachability before running host-side detection\nif _, err := os.Stat(\"/proc/1/ns/net\"); err != nil {\n    return errors.New(\"host /proc not mounted; cannot run as host\")\n}","typeGuard":null,"tryCatchPattern":"if err := util.RunAsHost(func() error { ... }); err != nil {\n    // capability/mount problem: fail loudly rather than silently skipping host cleanup\n    return fmt.Errorf(\"host-ns detection failed (check hostPID/CAP_SYS_ADMIN): %w\", err)\n}","preventionTips":["Deploy istio-cni with hostPID and privileged/CAP_SYS_ADMIN as the helm chart defines","Add a startup probe that exercises RunAsHost once and fails fast","Keep restricted PodSecurity labels away from the cni-node DaemonSet"],"tags":["namespaces","privileges","detection","istio-cni","linux"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}