{"record":{"id":"772b679d3005ca36","repo":"cilium/cilium","slug":"failed-to-start-kubeproxy-healthz-server-w","errorCode":null,"errorMessage":"failed to start kubeproxy healthz server: %w","messagePattern":"failed to start kubeproxy healthz server: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"daemon/healthz/kube_proxy_healthz.go","lineNumber":95,"sourceCode":"// status HTTP endpoint exposed on addr.\n// This endpoint reports the agent health status with the timestamp.\nfunc registerKubeProxyHealthzHTTPService(params kubeProxyHealthParams) error {\n\tif params.Config.KubeProxyReplacementHealthzBindAddress == \"\" || !params.KPRConfig.KubeProxyReplacement {\n\t\treturn nil\n\t}\n\n\tparams.JobGroup.Add(job.OneShot(\"kube-proxy-healthz-server\", func(ctx context.Context, health cell.Health) error {\n\t\taddr := params.Config.KubeProxyReplacementHealthzBindAddress\n\t\tlc := net.ListenConfig{Control: setsockoptReuseAddrAndPort}\n\t\tln, err := lc.Listen(ctx, \"tcp\", addr)\n\t\tif errors.Is(err, unix.EADDRNOTAVAIL) {\n\t\t\tparams.Logger.Info(\"KubeProxy healthz server not available\", logfields.Address, addr)\n\t\t} else if err != nil {\n\t\t\tparams.Logger.Error(\"hint: kube-proxy should not be running nor listening on the same healthz-bind-address.\",\n\t\t\t\tlogfields.Address, addr,\n\t\t\t\tlogfields.Error, err,\n\t\t\t)\n\t\t\treturn fmt.Errorf(\"failed to start kubeproxy healthz server: %w\", err)\n\t\t}\n\n\t\tmux := http.NewServeMux()\n\t\tmux.Handle(\"/healthz\", kubeproxyHealthzHandler{\n\t\t\tstatusCollector: params.StatusCollector,\n\t\t\tlastUpdateAter:  params.BPFOps,\n\t\t\tlocalNode:       params.NodeLocalStore,\n\t\t})\n\n\t\tsrv := &http.Server{\n\t\t\tAddr:    addr,\n\t\t\tHandler: mux,\n\t\t}\n\n\t\tparams.Logger.Info(\"Starting kube-proxy healthz server\", logfields.Address, addr)\n\n\t\tctx, cancel := context.WithCancel(ctx)\n\t\tdefer cancel()","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/daemon/healthz/kube_proxy_healthz.go#L77-L113","documentation":"The kube-proxy healthz compatibility server (which mimics kube-proxy's /healthz endpoint) fails to bind its TCP listener for reasons other than the expected 'address not available' case. The hint logged indicates kube-proxy itself is usually the conflicting listener; this error wraps the raw listen error.","triggerScenarios":"Listening on the kube-proxy healthz-bind-address (default 0.0.0.0:10256) fails with an unexpected error such as EACCES, EPERM, or invalid address — distinct from the tolerated case where kube-proxy already owns the port.","commonSituations":"Running cilium in kube-proxy-replacement mode while a leftover kube-proxy still runs and SO_REUSEPORT handling differs; binding a privileged port without capabilities; SELinux policies blocking the bind; hostNetworking restrictions in the agent pod.","solutions":["Stop any real kube-proxy instance running alongside Cilium (kube-proxy replacement) or align the healthz-bind-address","Run the agent pod with hostNetwork: true and the required capabilities (NET_BIND_SERVICE) so it can bind 10256","Change healthz-bind-address to a free, unprivileged port if the default is unusable","Check LSM/firewall policies that block listening on the address"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"addr := fmt.Sprintf(\"%s:%d\", bindAddr, 10256)\nif ln, err := net.Listen(\"tcp\", addr); err == nil { ln.Close() } else if !errors.Is(err, unix.EADDRINUSE) {\n\tlog.WithError(err).Warnf(\"cannot bind kube-proxy healthz address %s\", addr)\n}","typeGuard":null,"tryCatchPattern":"if err := startKubeProxyHealthzServer(...); err != nil {\n\tif errors.Is(err, unix.EADDRINUSE) {\n\t\tlog.Warn(\"kube-proxy already owns the healthz port; disable kube-proxy or change bind address\")\n\t}\n\treturn err\n}","preventionTips":["When using kube-proxy replacement, remove the standalone kube-proxy DaemonSet","Grant hostNetwork + NET_BIND_SERVICE to the cilium agent pod","Customize healthz-bind-address if 10256 conflicts","Verify seccomp policies allow listen on the host network"],"tags":["kube-proxy","healthz","bind","port-conflict"],"backgroundTag":"port-already-in-use","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}