{"record":{"id":"86fdeed81c2e3497","repo":"istio/istio","slug":"istio-owned-cni-config-does-not-exist-or-is-not-th","errorCode":null,"errorMessage":"istio owned CNI config does not exist or is not the highest priority. Got %s instead","messagePattern":"istio owned CNI config does not exist or is not the highest priority\\. Got (.+?) instead","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cni/pkg/install/install.go","lineNumber":299,"sourceCode":"\n\t\t// if Istio owned CNI config is enabled, the first CNI config file must be the Istio owned CNI config\n\t\tif firstCNIConfigFilename != cfg.IstioOwnedCNIConfigFilename {\n\t\t\t// if the default or specified CNI config file doesn't exist or is not the highest priority return\n\t\t\t// an error\n\n\t\t\t// check the priority of the IstioOwnedCNIConfigFilename compared to the first CNI config file\n\t\t\t// warn if the istio owned CNI config is not the highest priority - this is undefined behavior\n\t\t\tif strings.Compare(firstCNIConfigFilename, cfg.IstioOwnedCNIConfigFilename) <= 0 {\n\t\t\t\tlog.Warnf(\"Istio owned CNI config %s has lower priority than %s. \"+\n\t\t\t\t\t\" This will lead to undefined behavior and potential bypass of the service mesh.\",\n\t\t\t\t\tcfg.IstioOwnedCNIConfigFilename, firstCNIConfigFilename)\n\t\t\t}\n\t\t\tif len(cfg.CNIConfName) == 0 {\n\t\t\t\t// We found the primary CNI config file (or the highest priority config file).\n\t\t\t\t// Set the filename to the CNIConfName if it isn't set\n\t\t\t\tcfg.CNIConfName = firstCNIConfigFilename\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"istio owned CNI config does not exist or is not the highest priority. Got %s instead\", firstCNIConfigFilename)\n\t\t}\n\t\tlog.Debugf(\"istio owned CNI config is the highest priority: %s\", firstCNIConfigFilename)\n\t}\n\n\t// filepath for the highest priority, valid config\n\tdefaultCNIConfigFilepath := filepath.Join(cfg.MountedCNINetDir, firstCNIConfigFilename)\n\n\t// cniConfigFilepath is only set once the CNI config file has been validated or created at least once\n\t// so even if the CNI config file is valid, it will not be equal to the cniConfigFilepath during the\n\t// first call of checkValidCNIConfig and we will return an error so the cni config file can be\n\t// created or rewritten\n\tif defaultCNIConfigFilepath != cniConfigFilepath {\n\t\tlog.Debugf(\"cniConfigFilePath mismatch: expected %s but found %s\", defaultCNIConfigFilepath, cniConfigFilepath)\n\t\tif len(cfg.CNIConfName) > 0 || !cfg.ChainedCNIPlugin {\n\t\t\t// Install was run with overridden CNI config file so don't error out on preempt check\n\t\t\t// Likely the only use for this is testing the script\n\t\t\tinstallLog.Warnf(\"CNI config file %q preempted by %q\", cniConfigFilepath, defaultCNIConfigFilepath)\n\t\t} else {","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/cni/pkg/install/install.go#L281-L317","documentation":"checkValidCNIConfig enforces that when the Istio-owned CNI config feature is enabled, the Istio-owned file (values.cni.istioOwnedCNIConfigFilename, e.g. 00-istio-cni.conf) must be the highest-priority (lexicographically first) config in the netdir. The error reports which file currently sorts first instead; a preceding log warning explains the priority mismatch and the mesh-bypass risk.","triggerScenarios":"useIstioOwnedCNIConfig(cfg) is true and firstCNIConfigFilename != cfg.IstioOwnedCNIConfigFilename — another CNI config file (e.g., 05-cilium.conflist vs 10-istio-cni.conf naming) sorts before the Istio-owned filename, or the Istio-owned file does not exist yet in the directory.","commonSituations":"Platform CNIs (Cilium on EKS/GKE, OVN) install configs prefixed such that they outrank the Istio-owned name; the Istio-owned file was deleted by another agent; the feature value values.cni.istioOwnedCNIConfigFilename was customized to a name that does not sort first; fresh nodes where ordering is nondeterministic.","solutions":["Set values.cni.istioOwnedCNIConfigFilename (or REPAIR_CNI_NETDIR/related values) to a filename that sorts before all others, e.g. '00-istio-cni.conf'.","Alternatively disable the Istio-owned config feature (values.cni.ambient or the dedicated flag per your chart version) so Istio chains into the primary CNI's own file.","Remove or rename the file that is outranking the Istio-owned config if it is stale.","Restart the istio-cni-node pod after fixing names so checkValidCNIConfig re-evaluates priority."],"exampleFix":"# before\nistioctl install --set values.cni.istioOwnedCNIConfigFilename=10-istio-cni.conf  # '05-cilium.conflist' wins\n# after\nistioctl install --set values.cni.istioOwnedCNIConfigFilename=00-istio-cni.conf","handlingStrategy":"validation","validationCode":"// Before enabling Istio-owned CNI config, assert its filename sorts first in the netdir.\nfunc istioOwnedFileHasPriority(netDir, istioFile string) (bool, string, error) {\n\tentries, err := os.ReadDir(netDir)\n\tif err != nil {\n\t\treturn false, \"\", err\n\t}\n\tfirst := \"\"\n\tfor _, e := range entries {\n\t\tif e.IsDir() {\n\t\t\tcontinue\n\t\t}\n\t\tif first == \"\" || e.Name() < first {\n\t\t\tfirst = e.Name()\n\t\t}\n\t}\n\treturn first == istioFile, first, nil\n}","typeGuard":null,"tryCatchPattern":"if err := checkValidCNIConfig(ctx, cfg, path); err != nil {\n    if strings.Contains(err.Error(), \"istio owned CNI config does not exist or is not the highest priority\") {\n        // deterministic: fix the filename ordering, then retry — do not loop on the same values\n        return fmt.Errorf(\"rename %s so it sorts before all other CNI configs (e.g. 00-istio-cni.conf)\", cfg.IstioOwnedCNIConfigFilename)\n    }\n    return err\n}","preventionTips":["Name the Istio-owned config 00-istio-cni.conf so nothing can outrank it lexicographically.","Check which filenames your platform CNI writes before choosing the Istio-owned name.","Never delete the Istio-owned file while the feature is enabled; alert on its absence."],"tags":["istio","cni","priority","config","ordering","ambient"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}