{"record":{"id":"beb5bf46160dc1c8","repo":"cilium/cilium","slug":"failed-to-remove-ipset-s-w","errorCode":null,"errorMessage":"failed to remove ipset %s: %w","messagePattern":"failed to remove ipset (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/iptables/ipset/ipset.go","lineNumber":229,"sourceCode":"\tlog *slog.Logger\n\n\texecutable\n}\n\nfunc (i *ipset) create(ctx context.Context, name string, family string) error {\n\tif _, err := i.run(ctx, \"create\", name, \"iphash\", \"family\", family, \"-exist\"); err != nil {\n\t\treturn fmt.Errorf(\"failed to create ipset %s: %w\", name, err)\n\t}\n\treturn nil\n}\n\nfunc (i *ipset) remove(ctx context.Context, name string) error {\n\tif _, err := i.run(ctx, \"list\", name); err != nil {\n\t\t// ipset does not exist, nothing to remove\n\t\treturn nil\n\t}\n\tif _, err := i.run(ctx, \"destroy\", name); err != nil {\n\t\treturn fmt.Errorf(\"failed to remove ipset %s: %w\", name, err)\n\t}\n\treturn nil\n}\n\nfunc (i *ipset) list(ctx context.Context, name string) (AddrSet, error) {\n\tout, err := i.run(ctx, \"list\", name)\n\tif err != nil {\n\t\treturn AddrSet{}, fmt.Errorf(\"failed to list ipset %s: %w\", name, err)\n\t}\n\n\taddrs := AddrSet{}\n\tscanner := bufio.NewScanner(bytes.NewReader(out))\n\tfor scanner.Scan() {\n\t\tline := scanner.Text()\n\t\taddr, err := netip.ParseAddr(line)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/iptables/ipset/ipset.go#L211-L247","documentation":"Returned when `ipset destroy <name>` fails while removing a node ipset. The method first lists the set (a failed list means it doesn't exist and is a no-op success), so this error means the set exists but could not be destroyed — typically because it is still referenced by iptables rules.","triggerScenarios":"ipset.remove when the set is in use: iptables masquerade rules still reference the set (ipset refuses to destroy in-use sets), NET_ADMIN missing, or the ipset binary/module issues after list succeeded.","commonSituations":"Cilium teardown/disable while masquerading rules referencing CILIUM_NODE_IPSET still installed; leftover rules from a crashed previous run blocking destroy; permission problems appearing only at destroy time.","solutions":["Delete iptables rules referencing the ipset first (`iptables-save | grep cilium_node_ipset` then remove them), then destroy manually.","Restart Cilium so it removes rules before ipsets in its normal teardown order.","Ensure NET_ADMIN capability for the destroy command.","If cleanup is truly stuck, destroy manually: `ipset destroy cilium_node_ipset_v4` and inspect the kernel error."],"exampleFix":"// before\n$ ipset destroy cilium_node_ipset_v4\nipset: Set cannot be destroyed: it is in use by a kernel component\n\n// after\n$ iptables -t nat -D POSTROUTING -m set --match-set cilium_node_ipset_v4 src -j MASQUERADE\n$ ipset destroy cilium_node_ipset_v4","handlingStrategy":"try-catch","validationCode":"// ensure no iptables rules reference the set before destroying\nrefs, _ := exec.Command(\"sh\", \"-c\", \"iptables-save | grep -c -- '--match-set \"+name).Output()\nif n, _ := strconv.Atoi(strings.TrimSpace(string(refs))); n > 0 {\n\treturn fmt.Errorf(\"ipset %s still referenced by %d iptables rules\", name, n)\n}","typeGuard":"func isIpsetInUse(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"in use by a kernel component\")\n}","tryCatchPattern":"if err := ipset.remove(ctx, name); err != nil {\n\tif isIpsetInUse(err) {\n\t\tremoveMasqueradeRules(name) // delete referencing iptables rules\n\t\treturn ipset.remove(ctx, name)\n\t}\n\treturn err\n}","preventionTips":["Tear down iptables rules referencing the set before destroying it.","Treat failed `ipset list` as already-removed (the code already does).","Run with NET_ADMIN and keep ipset installed for cleanup paths.","After disabling Cilium, grep iptables-save for cilium_node_ipset leftovers."],"tags":["network","ipset","cilium","datapath"],"backgroundTag":"ipset-command-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}