{"record":{"id":"c828e99d612330f1","repo":"cilium/cilium","slug":"retrieving-device-s-w","errorCode":null,"errorMessage":"retrieving device %s: %w","messagePattern":"retrieving device (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/loader/endpoint.go","lineNumber":232,"sourceCode":"\n\t// Insert policy programs before attaching entrypoints to tc hooks.\n\t// Inserting a policy program is considered an attachment, since it makes\n\t// the code reachable by bpf_host when it evaluates policy for the endpoint.\n\t// All internal tail call plumbing needs to be done before this point.\n\t// If the agent dies uncleanly after the first program has been inserted,\n\t// the endpoint's connectivity will be partially broken or exhibit undefined\n\t// behaviour like missed tail calls or drops.\n\tif err := obj.PolicyMap.Update(uint32(ep.GetID()), obj.PolicyProg, ebpf.UpdateAny); err != nil {\n\t\treturn fmt.Errorf(\"inserting endpoint policy program: %w\", err)\n\t}\n\tif err := obj.EgressPolicyMap.Update(uint32(ep.GetID()), obj.EgressPolicyProg, ebpf.UpdateAny); err != nil {\n\t\treturn fmt.Errorf(\"inserting endpoint egress policy program: %w\", err)\n\t}\n\n\tdevice := ep.InterfaceName()\n\tiface, err := safenetlink.LinkByName(device)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"retrieving device %s: %w\", device, err)\n\t}\n\n\tlinkDir := bpffsEndpointLinksDir(bpf.CiliumPath(), ep)\n\tif err := attachSKBProgram(logger, iface, obj.FromContainer, symbolFromEndpoint,\n\t\tlinkDir, netlink.HANDLE_MIN_INGRESS, option.Config.EnableTCX); err != nil {\n\t\treturn fmt.Errorf(\"interface %s ingress: %w\", device, err)\n\t}\n\n\tif ep.RequireEgressProg() {\n\t\tif err := attachSKBProgram(logger, iface, obj.ToContainer, symbolToEndpoint,\n\t\t\tlinkDir, netlink.HANDLE_MIN_EGRESS, option.Config.EnableTCX); err != nil {\n\t\t\treturn fmt.Errorf(\"interface %s egress: %w\", device, err)\n\t\t}\n\t} else {\n\t\tif err := detachSKBProgram(logger, iface, symbolToEndpoint, linkDir, netlink.HANDLE_MIN_EGRESS); err != nil {\n\t\t\tlogger.Error(\n\t\t\t\t\"\",\n\t\t\t\tlogfields.Error, err,","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/loader/endpoint.go#L214-L250","documentation":"reloadEndpoint failed to look up the endpoint's Linux network interface (ep.InterfaceName()) via safenetlink.LinkByName while reloading its BPF datapath. The wrapped error comes from netlink and typically means the interface does not exist in the current network namespace. Without the link, no tc/tcx program can be attached.","triggerScenarios":"reloadEndpoint (via ReloadDatapath) runs but the veth/device named by ep.InterfaceName() is gone or renamed: container was stopped and its veth deleted, interface moved to another netns, or a stale endpoint record is being reloaded after a device removal.","commonSituations":"Deleting a pod while Cilium still regenerates its endpoint; container runtime restarting containers and recreating veths with new names; CNI plugin removing the host veth; netns mismatch during agent startup restore.","solutions":["Verify the interface still exists with `ip link show <device>`; if gone, delete/regenerate the endpoint so it is recreated with a fresh veth.","If the pod/container was just deleted, this is transient — let endpoint GC remove the endpoint.","Confirm the agent runs in the correct network namespace (host vs container) where the veth lives.","If it persists for a live endpoint, restart the Cilium agent to re-sync endpoint state with CNI state.","Check for interface renames (systemd/udev link naming) and update endpoint device state."],"exampleFix":"// before: reloading a stale endpoint whose veth was deleted\niface, err := safenetlink.LinkByName(device) // fails: link not found\n// after: validate the device exists before reload\nif _, err := safenetlink.LinkByName(device); err != nil {\n    logger.Warn(\"endpoint device missing, skipping reload\", \"device\", device)\n    return err // let the endpoint GC path handle deletion\n}","handlingStrategy":"validation","validationCode":"device := ep.InterfaceName()\nif _, err := safenetlink.LinkByName(device); err != nil {\n    return fmt.Errorf(\"endpoint %s device %s missing before reload: %w\", ep.StringID(), device, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check `ip link show <device>` for the endpoint's interface before forcing regeneration.","Clean up endpoints of deleted pods promptly so stale reloads don't occur.","Run the agent in the correct network namespace where the veth exists.","Watch for CNI plugins renaming/removing veths and reconcile endpoint state."],"tags":["network","netlink","cilium","datapath"],"backgroundTag":"network-interface-not-found","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}