{"record":{"id":"8f95634403120b89","repo":"cilium/cilium","slug":"unable-to-lookup-link-d-w","errorCode":null,"errorMessage":"unable to lookup link %d: %w","messagePattern":"unable to lookup link (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/cilium-cni/chaining/generic-veth/generic-veth.go","lineNumber":180,"sourceCode":"\t\t\t\tif rt.MTU != int(pluginCtx.CiliumConf.RouteMTU) {\n\t\t\t\t\trt.MTU = int(pluginCtx.CiliumConf.RouteMTU)\n\t\t\t\t\terr = netlink.RouteReplace(&rt)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\terr = fmt.Errorf(\"unable to replace the mtu %d for the route %s: %s\", rt.MTU, rt.String(), err.Error())\n\t\t\t\t\t\treturn err\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t}); err != nil {\n\t\treturn\n\t}\n\n\tpeer, err = netlink.LinkByIndex(peerIndex)\n\tif err != nil {\n\t\terr = fmt.Errorf(\"unable to lookup link %d: %w\", peerIndex, err)\n\t\treturn\n\t}\n\n\thostMac, _ = mac.FromHardwareAddr(peer.Attrs().HardwareAddr)\n\tvethHostName = peer.Attrs().Name\n\tvethHostIdx = peer.Attrs().Index\n\n\tswitch {\n\tcase vethHostName == \"\":\n\t\terr = errors.New(\"unable to determine name of veth pair on the host side\")\n\t\treturn\n\tcase !hostMac.IsValid():\n\t\terr = errors.New(\"unable to determine MAC address of veth pair on the host side\")\n\t\treturn\n\tcase !vethLXCMac.IsValid():\n\t\terr = errors.New(\"unable to determine MAC address of veth pair on the container side\")\n\t\treturn\n\tcase vethIP == \"\" && vethIPv6 == \"\":","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/plugins/cilium-cni/chaining/generic-veth/generic-veth.go#L162-L198","documentation":"After the netns section succeeds, the plugin (now back in the host netns) resolves the host-side veth by the peer index captured inside the container: netlink.LinkByIndex(peerIndex). If the link cannot be found, this error wraps it. It means the container-side veth's peer is no longer visible from the host, so the plugin cannot learn the host veth name/MAC/index required for the Cilium EndpointChangeRequest.","triggerScenarios":"netlink.LinkByIndex(peerIndex) in Add() (host netns) returns an error: the peer veth was deleted between VethPeerIndex() inside the container and this lookup (pod teardown race), a stale/incorrect peerIndex, or a netlink dump failure on the host.","commonSituations":"Kubelet deleting the sandbox while CNI ADD is in flight; move-to-netns operations that destroyed the peer; kernel/netlink bugs after long uptime; running the plugin in an environment where host netlink is restricted (某些 hardened runtimes).","solutions":["Retry pod creation — a teardown race resolves itself; check whether the pod's sandbox was being stopped at the same time.","Verify the peer ifindex still exists on the host: ip link | grep <ifindex> and compare with the error's %d value.","Check node memory/netlink health (dmesg for rtnetlink errors); reboot if persistent rtnetlink corruption is seen.","Ensure the runtime isn't concurrently modifying the veth pair (check containerd/CRI logs for the same container ID)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"peer, err := netlink.LinkByIndex(peerIndex)\nif err != nil {\n    if errors.Is(err, syscall.ENODEV) {\n        // host-side peer gone: sandbox teardown race, kubelet will retry\n    }\n    return fmt.Errorf(\"unable to lookup link %d: %w\", peerIndex, err)\n}","preventionTips":["Check whether the sandbox was being stopped when the error occurred; treat those as transient.","Correlate containerd/CRI logs with CNI failure timestamps to detect teardown races.","Keep the kernel updated; long-running nodes can accumulate rtnetlink issues.","Confirm no hardened runtime is restricting host netlink access for the CNI plugin."],"tags":["network","veth","netlink","cni"],"backgroundTag":"link-by-index-not-found","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}