{"record":{"id":"76f5a054dd48abc5","repo":"cilium/cilium","slug":"specified-nat-table-size-d-must-be-greater-or-equ","errorCode":null,"errorMessage":"specified NAT table size %d must be greater or equal to %d","messagePattern":"specified NAT table size (.+?) must be greater or equal to (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/option/config.go","lineNumber":2929,"sourceCode":"func (c *DaemonConfig) checkMapSizeLimits() error {\n\tif c.AuthMapEntries < AuthMapEntriesMin {\n\t\treturn fmt.Errorf(\"specified AuthMap max entries %d must be greater or equal to %d\", c.AuthMapEntries, AuthMapEntriesMin)\n\t}\n\tif c.AuthMapEntries > AuthMapEntriesMax {\n\t\treturn fmt.Errorf(\"specified AuthMap max entries %d must not exceed maximum %d\", c.AuthMapEntries, AuthMapEntriesMax)\n\t}\n\n\tif c.CTMapEntriesGlobalTCP < LimitTableMin || c.CTMapEntriesGlobalAny < LimitTableMin {\n\t\treturn fmt.Errorf(\"specified CT tables values %d/%d must be greater or equal to %d\",\n\t\t\tc.CTMapEntriesGlobalTCP, c.CTMapEntriesGlobalAny, LimitTableMin)\n\t}\n\tif c.CTMapEntriesGlobalTCP > LimitTableMax || c.CTMapEntriesGlobalAny > LimitTableMax {\n\t\treturn fmt.Errorf(\"specified CT tables values %d/%d must not exceed maximum %d\",\n\t\t\tc.CTMapEntriesGlobalTCP, c.CTMapEntriesGlobalAny, LimitTableMax)\n\t}\n\n\tif c.NATMapEntriesGlobal < LimitTableMin {\n\t\treturn fmt.Errorf(\"specified NAT table size %d must be greater or equal to %d\",\n\t\t\tc.NATMapEntriesGlobal, LimitTableMin)\n\t}\n\tif c.NATMapEntriesGlobal > LimitTableMax {\n\t\treturn fmt.Errorf(\"specified NAT tables size %d must not exceed maximum %d\",\n\t\t\tc.NATMapEntriesGlobal, LimitTableMax)\n\t}\n\tif c.NATMapEntriesGlobal > c.CTMapEntriesGlobalTCP+c.CTMapEntriesGlobalAny {\n\t\tif c.NATMapEntriesGlobal == NATMapEntriesGlobalDefault {\n\t\t\t// Auto-size for the case where CT table size was adapted but NAT still on default\n\t\t\tc.NATMapEntriesGlobal = int((c.CTMapEntriesGlobalTCP + c.CTMapEntriesGlobalAny) * 2 / 3)\n\t\t} else {\n\t\t\treturn fmt.Errorf(\"specified NAT tables size %d must not exceed maximum CT table size %d\",\n\t\t\t\tc.NATMapEntriesGlobal, c.CTMapEntriesGlobalTCP+c.CTMapEntriesGlobalAny)\n\t\t}\n\t}\n\n\tif c.FragmentsMapEntries < FragmentsMapMin {\n\t\treturn fmt.Errorf(\"specified max entries %d for fragment-tracking map must be greater or equal to %d\",","sourceCodeStart":2911,"sourceCodeEnd":2947,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/option/config.go#L2911-L2947","documentation":"DaemonConfig validation rejects a NAT map size (--bpf-nat-global-max) below LimitTableMin (1<<10 = 1024 entries). Cilium requires the global NAT table to hold at least 1024 entries; smaller values are treated as invalid configuration and abort agent startup.","triggerScenarios":"option.Config.Validate() runs with DaemonConfig.NATMapEntriesGlobal < 1024, e.g. --bpf-nat-global-max=512 or a computed value that rounded/underflowed to a tiny number.","commonSituations":"Hand-tuned small clusters set NAT entries too low; a script divides total memory by a large constant; someone confuses this limit with per-CPU or policy map minimums (PolicyMapMin=256).","solutions":["Set --bpf-nat-global-max to at least 1024 (LimitTableMin)","Remove the flag entirely to use the default NATMapEntriesGlobalDefault (2/3 of combined CT defaults, auto-sized)","Fix any calculating script so the value cannot drop below 1024","Also keep NAT size <= LimitTableMax and <= CT TCP+Any total to avoid the companion maximum/NAT-vs-CT errors"],"exampleFix":"# before\n--bpf-nat-global-max=512\n# after\n--bpf-nat-global-max=1024","handlingStrategy":"validation","validationCode":"const LimitTableMin = 1 << 10\nfunction validateNATMin(nat) {\n  if (!Number.isInteger(nat)) throw new TypeError('NAT entries must be an integer');\n  if (nat < LimitTableMin) throw new RangeError(`NAT table size ${nat} must be >= ${LimitTableMin}`);\n  return true;\n}","typeGuard":"function hasValidNATMin(c) { return Number.isInteger(c.NATMapEntriesGlobal) && c.NATMapEntriesGlobal >= 1024; }","tryCatchPattern":null,"preventionTips":["Never set --bpf-nat-global-max below 1024; omit the flag to use defaults","Ensure sizing formulas have a Math.max(value, 1024) floor","Do not reuse policy-map minimums (256) for NAT sizing","Validate generated agent flags in CI before rollout"],"tags":["cilium","bpf","nat","configuration"],"backgroundTag":"bpf-map-size-limit-exceeded","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}