{"record":{"id":"9c322b2963062bab","repo":"cilium/cilium","slug":"failed-to-list-existing-interfaces-in-pod-netns","errorCode":null,"errorMessage":"failed to list existing interfaces in pod netns: %w","messagePattern":"failed to list existing interfaces in pod netns: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/networkdriver/nri.go","lineNumber":390,"sourceCode":"\tif err := netlink.LinkSetName(l, newIfName); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to rename interface from %s to %s: %w\", l.Attrs().Name, newIfName, err)\n\t}\n\n\t// Refresh link reference after rename\n\tl, err := safenetlink.LinkByName(newIfName)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get link after rename: %w\", err)\n\t}\n\n\treturn l, nil\n}\n\n// validateInterfaceNames checks if a pod's set of allocated devices\n// contain valid interface names, that dont collide with interfaces in the pod namespace.\nfunc validateInterfaceNames(alloc []allocation) error {\n\texistingLinks, err := safenetlink.LinkList()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to list existing interfaces in pod netns: %w\", err)\n\t}\n\n\texistingNames := make(map[string]bool)\n\tfor _, link := range existingLinks {\n\t\texistingNames[link.Attrs().Name] = true\n\t}\n\n\t// Check if any of our planned renames would collide with existing interfaces\n\tfor _, a := range alloc {\n\t\tif a.Config.PodIfName != \"\" && existingNames[a.Config.PodIfName] {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"interface name collision: %q already exists in pod namespace (possibly from CNI)\",\n\t\t\t\ta.Config.PodIfName)\n\t\t}\n\t}\n\n\treturn nil\n}","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/networkdriver/nri.go#L372-L408","documentation":"validateInterfaceNames lists all interfaces in the pod netns with safenetlink.LinkList to build the set of existing names. This error wraps a LinkList failure, aborting collision detection before any rename is attempted.","triggerScenarios":"safenetlink.LinkList() inside podNs.Do returns a netlink error — netlink socket creation/enumeration failure, out of memory, or insufficient permissions inside the namespace.","commonSituations":"Node under memory pressure exhausting netlink sockets; restrictive seccomp/AppArmor profile blocking netlink RTM_GETLINK; kernel issues after upgrade.","solutions":["Check the wrapped netlink error and node health (dmesg, memory).","Verify the agent's seccomp/AppArmor policy permits netlink RTM_GETLINK operations.","Restart the agent to recover from transient netlink socket failures and re-run the sandbox hook.","If persistent after upgrades, check kernel compatibility with the netlink library version."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := driver.RunPodSandbox(ctx, sandbox); err != nil {\n    if strings.Contains(err.Error(), \"failed to list existing interfaces\") {\n        // transient netlink failure: backoff and retry\n    }\n}","preventionTips":["Allow netlink RTM_GETLINK in the agent's seccomp/AppArmor profile","Raise netlink/socket rmem limits on memory-constrained nodes","Restart the agent on persistent netlink enumeration failures"],"tags":["network","netlink","nri","validation"],"backgroundTag":"netlink-list-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}