{"record":{"id":"c603b930225e228d","repo":"cilium/cilium","slug":"error-running-q-with-args-q-w","errorCode":null,"errorMessage":"error running %q with args %q: %w","messagePattern":"error running %q with args %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/health/health_connectivity_endpoint.go","lineNumber":135,"sourceCode":"\n// configureHealthRouting is meant to be run inside the health service netns\nfunc (h *ciliumHealthManager) configureHealthRouting(routes []route.Route, dev string) error {\n\tfor _, rt := range routes {\n\t\tcmd := rt.ToIPCommand(dev)\n\t\tif len(cmd) < 2 {\n\t\t\treturn fmt.Errorf(\"ip command %s not expected len!\", cmd)\n\t\t}\n\t\tprog := cmd[0]\n\t\targs := cmd[1:]\n\t\th.logger.Debug(fmt.Sprintf(\"Running \\\"%s %+v\\\"\", prog, args))\n\t\tout, err := exec.Command(prog, args...).CombinedOutput()\n\t\tif err == nil && len(out) > 0 {\n\t\t\th.logger.Warn(string(out),\n\t\t\t\tlogfields.Prog, prog,\n\t\t\t\tlogfields.Args, args,\n\t\t\t)\n\t\t} else if err != nil {\n\t\t\treturn fmt.Errorf(\"error running %q with args %q: %w\", prog, args, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// configureHealthInterface is meant to be run inside the health service netns\nfunc (h *ciliumHealthManager) configureHealthInterface(ifName string, ip4Addr, ip6Addr *net.IPNet) error {\n\tlink, err := safenetlink.LinkByName(ifName)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif ip6Addr == nil {\n\t\t// Use the direct sysctl without reconciliation of errors since we're in a different\n\t\t// network namespace and thus can't use the normal sysctl API.\n\t\tsysctl := sysctl.NewDirectSysctl(afero.NewOsFs(), option.Config.ProcFs)\n\t\t// Ignore the error; if IPv6 is completely disabled\n\t\t// then it's okay if we can't write the sysctl.","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/health/health_connectivity_endpoint.go#L117-L153","documentation":"configureHealthRouting runs each rendered `ip` command inside the cilium-health netns with exec.Command and wraps any non-zero/execution error with the program and its arguments. It means the kernel/iproute2 rejected a route configuration step for the health endpoint.","triggerScenarios":"exec.Command(prog, args...).CombinedOutput() returns err — e.g. `ip route add` fails because the device doesn't exist in the netns, permission denied (missing CAP_NET_ADMIN), or the route already exists / prefix is unreachable.","commonSituations":"Running cilium-health with dropped capabilities; MTU/route arguments rejected by the kernel; duplicate route insertion after a partial retry; SELinux/AppArmor blocking ip inside the namespace.","solutions":["Read the wrapped error and the CombinedOutput text (logged at warn) to see the exact `ip` failure.","Ensure the process has CAP_NET_ADMIN/CAP_SYS_ADMIN to configure routes in the netns.","Verify the target device (dev argument) exists inside the health netns (`ip netns exec cilium-health ip link`).","If 'file exists' / 'RTNETLINK answers: File exists', flush stale routes in the health netns and retry."],"exampleFix":"// before: error surfaces as 'error running \"ip\" with args [\"-6\" \"route\" \"add\" ...]: exit status 2'\n// after: capture output for diagnosis\nout, err := exec.Command(prog, args...).CombinedOutput()\nif err != nil {\n    return fmt.Errorf(\"error running %q with args %q: %w: %s\", prog, args, err, string(out))\n}","handlingStrategy":"try-catch","validationCode":"// pre-check device exists in health netns\nif err := exec.Command(\"ip\", \"netns\", \"exec\", \"cilium-health\", \"ip\", \"link\", \"show\", dev).Run(); err != nil {\n    // fix datapath setup before configuring routes\n}","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(prog, args...).CombinedOutput()\nif err != nil {\n    if strings.Contains(string(out), \"File exists\") {\n        // flush duplicate route and retry once\n    }\n    return fmt.Errorf(\"ip %v failed: %w: %s\", args, err, out)\n}","preventionTips":["Run the agent with CAP_NET_ADMIN and CAP_SYS_ADMIN.","Clean up stale netns/routes from previous runs before configuring.","Always log CombinedOutput alongside the error for iproute2 diagnostics."],"tags":["cilium","routing","netns","exec","iproute2"],"backgroundTag":"ip-command-execution-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}