{"record":{"id":"895911a36229f714","repo":"kubernetes/kops","slug":"failed-to-create-cgroupv2-mount-unit-w","errorCode":null,"errorMessage":"failed to create cgroupv2 mount unit: %w","messagePattern":"failed to create cgroupv2 mount unit: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/networking/cilium.go","lineNumber":58,"sourceCode":"// Build is responsible for configuring the network cni\nfunc (b *CiliumBuilder) Build(c *fi.NodeupModelBuilderContext) error {\n\t// As long as the Cilium Etcd cluster exists, we should do this\n\tif b.NodeupConfig.UseCiliumEtcd {\n\t\tif err := b.buildCiliumEtcdSecrets(c); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tif b.NodeupConfig.Networking.Cilium == nil {\n\t\treturn nil\n\t}\n\n\tif err := b.buildBPFMount(c); err != nil {\n\t\treturn fmt.Errorf(\"failed to create bpf mount unit: %w\", err)\n\t}\n\n\tif err := b.buildCgroup2Mount(c); err != nil {\n\t\treturn fmt.Errorf(\"failed to create cgroupv2 mount unit: %w\", err)\n\t}\n\n\tdisableManageForeignRoutes(c, b.Distribution)\n\tdisableCloudInitNetworkHotplug(c, b.Distribution)\n\n\tif b.NodeupConfig.Networking.Cilium.IPAM == kops.CiliumIpamEni {\n\t\tmaskEC2NetUtilsUdevRules(c, b.Distribution)\n\t\tsetMACAddressPolicyNone(c, b.Distribution)\n\t\tif err := markSecondaryENIsUnmanaged(c, b.Distribution); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (b *CiliumBuilder) buildBPFMount(c *fi.NodeupModelBuilderContext) error {\n\tvar fsdata unix.Statfs_t","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/networking/cilium.go#L40-L76","documentation":"CiliumBuilder.Build also creates a cgroupv2 mount unit for /run/cilium/cgroupv2 via buildCgroup2Mount; failures are wrapped in this error. Cilium needs a writable cgroupv2 hierarchy for its datapath, so nodeup stops building the Cilium model if this unit cannot be created.","triggerScenarios":"buildCgroup2Mount(c) returns an error during nodeup Build with Cilium enabled — practically unix.Statfs on the cgroup path failing with an error other than NotExist (see error 718), or a task-add failure.","commonSituations":"cgroupfs2 misconfigured on the host image; permission problems creating /run/cilium/cgroupv2; unusual distributions where /run is read-only at nodeup time.","solutions":["Inspect the wrapped error to see whether Statfs failed for reasons other than ENOENT","Ensure the node has cgroup v2 enabled (kernel ≥ 4.x, systemd with cgroup2) or the path can be auto-created by systemd","Check /run is writable when nodeup runs","Verify the generated systemd mount unit has valid settings"],"exampleFix":"// before (grub)\nGRUB_CMDLINE_LINUX=\"... systemd.unified_cgroup_hierarchy=0\"\n// after\nGRUB_CMDLINE_LINUX=\"... systemd.unified_cgroup_hierarchy=1\"","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(\"/run/cilium\"); err != nil {\n    if mkErr := os.MkdirAll(\"/run/cilium\", 0755); mkErr != nil {\n        return fmt.Errorf(\"/run/cilium not creatable, cgroupv2 unit build would fail: %v\", mkErr)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := b.buildCgroup2Mount(c); err != nil {\n    klog.Errorf(\"cgroupv2 mount unit creation failed: %v\", err)\n    return fmt.Errorf(\"failed to create cgroupv2 mount unit: %w\", err)\n}","preventionTips":["Enable cgroup v2 on node images","Keep /run writable tmpfs during bootstrap","Verify generated systemd units with systemd-analyze verify"],"tags":["nodeup","cilium","cgroupv2","systemd","mount"],"backgroundTag":"cgroupv2-mount-unit-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}