{"record":{"id":"a831954b53b5aff7","repo":"cilium/cilium","slug":"failed-to-list-ipset-s-w","errorCode":null,"errorMessage":"failed to list ipset %s: %w","messagePattern":"failed to list ipset (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/iptables/ipset/ipset.go","lineNumber":237,"sourceCode":"\t}\n\treturn nil\n}\n\nfunc (i *ipset) remove(ctx context.Context, name string) error {\n\tif _, err := i.run(ctx, \"list\", name); err != nil {\n\t\t// ipset does not exist, nothing to remove\n\t\treturn nil\n\t}\n\tif _, err := i.run(ctx, \"destroy\", name); err != nil {\n\t\treturn fmt.Errorf(\"failed to remove ipset %s: %w\", name, err)\n\t}\n\treturn nil\n}\n\nfunc (i *ipset) list(ctx context.Context, name string) (AddrSet, error) {\n\tout, err := i.run(ctx, \"list\", name)\n\tif err != nil {\n\t\treturn AddrSet{}, fmt.Errorf(\"failed to list ipset %s: %w\", name, err)\n\t}\n\n\taddrs := AddrSet{}\n\tscanner := bufio.NewScanner(bytes.NewReader(out))\n\tfor scanner.Scan() {\n\t\tline := scanner.Text()\n\t\taddr, err := netip.ParseAddr(line)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\taddrs = addrs.Insert(addr)\n\t}\n\tif err := scanner.Err(); err != nil {\n\t\treturn AddrSet{}, fmt.Errorf(\"failed to scan ipset %s: %w\", name, err)\n\t}\n\treturn addrs, nil\n}\n","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/iptables/ipset/ipset.go#L219-L255","documentation":"Returned by ipset.list when the external `ipset list <name>` command exits non-zero (pkg/datapath/iptables/ipset/ipset.go:237). The wrapper error carries the set name and the underlying exec error, so a missing ipset binary, a nonexistent set, or a permission/kernel problem all surface here. In Cilium's reconcile flow (reconcile -> list) this aborts diffing current set members against desired state.","triggerScenarios":"`ipset list <name>` fails: the ipset executable is missing or not in PATH, the named set does not exist, the caller lacks CAP_NET_ADMIN/root, the kernel ipset module is not loaded, or the command times out / context is canceled.","commonSituations":"Cilium agent container without ipset binary or NET_ADMIN capability; host kernel without ip_set modules; stale iptables rules referencing a deleted set; tests (TestIPSetListInexistentIPSet) probing a set that was never created.","solutions":["Verify the `ipset` binary exists and works on the host (`ipset --version`) and is present in the agent image","Run the agent as root / with NET_ADMIN capability and confirm `lsmod | grep ip_set` shows the kernel modules","If the set may legitimately not exist, check existence first (or handle the 'does not exist' exit code) before listing, as ipset.remove does","Inspect the wrapped %w error from exec to distinguish binary-not-found vs command failure","Retry the reconcile; Prune re-runs on next startup once the environment is fixed"],"exampleFix":"// before\ncurSet, err := ipset.list(ctx, name)\nif err != nil {\n    return fmt.Errorf(\"unable to list ipset %s: %w\", name, err)\n}\n// after: tolerate a not-yet-created set by creating it first (reconcile already does)\nif err := ipset.create(ctx, name, string(family)); err != nil {\n    return fmt.Errorf(\"unable to create ipset %s: %w\", name, err)\n}\ncurSet, err := ipset.list(ctx, name)","handlingStrategy":"try-catch","validationCode":"cmd := exec.Command(\"ipset\", \"list\", name)\nif err := cmd.Run(); err != nil {\n    return fmt.Errorf(\"ipset %s not listable: %w\", name, err)\n}","typeGuard":"func isExecNotFound(err error) bool {\n    var ee *exec.Error\n    return errors.As(err, &ee) && errors.Is(ee.Err, exec.ErrNotFound)\n}","tryCatchPattern":"curSet, err := ipset.list(ctx, name)\nif err != nil {\n    var ee *exec.Error\n    if errors.As(err, &ee) {\n        log.Fatalf(\"ipset binary missing: %v\", err)\n    }\n    return fmt.Errorf(\"skipping reconcile of %s: %w\", name, err)\n}","preventionTips":["Ship the ipset binary in the agent image and smoke-test `ipset --version` at startup","Run with CAP_NET_ADMIN and verify ip_set kernel modules are loaded before reconcile","Check set existence (or use -exist create) before listing","Log the wrapped exec error, not just the wrapper, to speed diagnosis"],"tags":["linux","ipset","exec","networking","cilium"],"backgroundTag":"ipset-command-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}