{"record":{"id":"7cc2562445c85f43","repo":"cilium/cilium","slug":"unable-to-parse-min-port-value-s-for-ephemeral-ra","errorCode":null,"errorMessage":"Unable to parse min port value %s for ephemeral range: %w","messagePattern":"Unable to parse min port value (.+?) for ephemeral range: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kpr/initializer/kube_proxy_replacement.go","lineNumber":380,"sourceCode":"// the same as a nodeport service.\n//\n// If it clashes, check whether the nodeport range is listed in ip_local_reserved_ports.\n// If it isn't and EnableAutoProtectNodePortRange == false, then return an error\n// making cilium-agent to stop.\n// Otherwise, if EnableAutoProtectNodePortRange == true, then append the nodeport\n// range to ip_local_reserved_ports.\nfunc checkNodePortAndEphemeralPortRanges(lbConfig loadbalancer.Config, sysctl sysctl.Sysctl) error {\n\tephemeralPortRangeStr, err := sysctl.Read([]string{\"net\", \"ipv4\", \"ip_local_port_range\"})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Unable to read net.ipv4.ip_local_port_range: %w\", err)\n\t}\n\tephemeralPortRange := strings.Split(ephemeralPortRangeStr, \"\\t\")\n\tif len(ephemeralPortRange) != 2 {\n\t\treturn fmt.Errorf(\"Invalid ephemeral port range: %s\", ephemeralPortRangeStr)\n\t}\n\tephemeralPortMin, err := strconv.Atoi(ephemeralPortRange[0])\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Unable to parse min port value %s for ephemeral range: %w\",\n\t\t\tephemeralPortRange[0], err)\n\t}\n\tephemeralPortMax, err := strconv.Atoi(ephemeralPortRange[1])\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Unable to parse max port value %s for ephemeral range: %w\",\n\t\t\tephemeralPortRange[1], err)\n\t}\n\n\tif lbConfig.NodePortMax < uint16(ephemeralPortMin) {\n\t\t// ephemeral port range does not clash with nodeport range\n\t\treturn nil\n\t}\n\n\tnodePortRangeStr := fmt.Sprintf(\"%d-%d\", lbConfig.NodePortMin,\n\t\tlbConfig.NodePortMax)\n\n\tif lbConfig.NodePortMin > uint16(ephemeralPortMax) {\n\t\treturn fmt.Errorf(\"NodePort port range (%s) is not allowed to be after ephemeral port range (%s)\",","sourceCodeStart":362,"sourceCodeEnd":398,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/kpr/initializer/kube_proxy_replacement.go#L362-L398","documentation":"The first token of net.ipv4.ip_local_port_range (the ephemeral range minimum) could not be converted to an integer with strconv.Atoi. The message includes the offending token and the underlying parse error. This protects the NodePort-range-vs-ephemeral-range overlap logic from garbage input.","triggerScenarios":"checkNodePortAndEphemeralPortRanges where ephemeralPortRange[0] contains non-numeric characters after the tab-split succeeded (e.g. leftover text, a digit-prefixed annotation, or locale-formatted number).","commonSituations":"Administrators manually editing ip_local_port_range with stray characters; scripted sysctl manipulation appending comments or units; kernels/shims exposing decorated sysctl values.","solutions":["Fix the sysctl value to be two plain integers, e.g. sysctl -w net.ipv4.ip_local_port_range='32768 60999'","Verify with cat /proc/sys/net/ipv4/ip_local_port_range that only two numbers appear","Search the node's sysctl init scripts/configs (sysctl.d) for a malformed override and correct it"],"exampleFix":"# before\n$ cat /etc/sysctl.d/99-ports.conf\nnet.ipv4.ip_local_port_range = 1024 65535 # keep low ports free\n# after (comment must not be inline-parsed on some setups)\nnet.ipv4.ip_local_port_range = 1024 65535","handlingStrategy":"validation","validationCode":"fields := strings.Fields(portRangeStr)\nif len(fields) == 2 {\n    if _, err := strconv.Atoi(fields[0]); err != nil {\n        return fmt.Errorf(\"ephemeral min %q invalid\", fields[0])\n    }\n    if _, err := strconv.Atoi(fields[1]); err != nil {\n        return fmt.Errorf(\"ephemeral max %q invalid\", fields[1])\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := agent.InitKubeProxyReplacementOptions(ctx); err != nil {\n    if strings.Contains(err.Error(), \"Unable to parse\") && strings.Contains(err.Error(), \"ephemeral range\") {\n        return fmt.Errorf(\"repair net.ipv4.ip_local_port_range (must be two integers) and restart agent: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate sysctl.d files for stray comments/characters after values","Use configuration management that writes canonical 'min max' lines","Diff /proc/sys values against expected baselines during node onboarding"],"tags":["cilium","sysctl","parsing","linux"],"backgroundTag":"sysctl-read-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}