{"record":{"id":"dbb0506af6495285","repo":"cilium/cilium","slug":"invalid-cni-chaining-mode-s","errorCode":null,"errorMessage":"invalid CNI chaining mode: %s","messagePattern":"invalid CNI chaining mode: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"daemon/cmd/cni/config.go","lineNumber":388,"sourceCode":"// in to an existing CNI network.\nfunc (c *cniConfigManager) renderCNIConf() (cniConfig []byte, err error) {\n\tif c.config.CNIChainingTarget != \"\" {\n\t\tpluginConfig := c.renderCNITemplate(chainedCNIEntry)\n\t\tcniConfig, err = c.mergeExistingCNIConfig(pluginConfig)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t} else {\n\t\tc.logger.Info(\n\t\t\t\"Generating CNI configuration file with mode\",\n\t\t\tlogfields.Mode, c.config.CNIChainingMode,\n\t\t)\n\t\ttmpl := cniConfigs[strings.ToLower(c.config.CNIChainingMode)]\n\t\tcniConfig = []byte(c.renderCNITemplate(tmpl))\n\t}\n\n\tif len(cniConfig) == 0 {\n\t\treturn nil, fmt.Errorf(\"invalid CNI chaining mode: %s\", c.config.CNIChainingMode)\n\t}\n\n\treturn cniConfig, nil\n}\n\n// mergeExistingCNIConfig looks for an existing cni configuration\n// and modifies it to include Cilium. If no configuration is found, it\n// fails.\n//\n// pluginConfig is the raw json to insert in the plugin chain.\n//\n// This was originally added to interact solely with aws-cni, see\n// PR #18522 for details.\nfunc (c *cniConfigManager) mergeExistingCNIConfig(pluginConfig []byte) ([]byte, error) {\n\tcontents, err := c.findCNINetwork(c.config.CNIChainingTarget)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not find existing CNI config for chaining: %w\", err)\n\t}","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/daemon/cmd/cni/config.go#L370-L406","documentation":"renderCNIConf resolves the CNI chaining mode to a built-in configuration template via cniConfigs[strings.ToLower(c.config.CNIChainingMode)] and, when using chaining or custom templates, checks that some configuration was produced. If cniConfig is empty the chaining mode is not a known value, so Cilium refuses to generate a CNI config it cannot honor.","triggerScenarios":"--cni-chaining-mode is set to a value with no entry in the cniConfigs map (and no custom template rendered), e.g. a typo like `flanel` or `calici`, or an empty string when chaining is expected.","commonSituations":"Typos in Helm values (cni.chainingMode), upgrading Cilium after a chaining mode was renamed/removed, passing the mode with wrong casing to a code path that does not normalize it, enabling chaining without setting the mode at all.","solutions":["Set --cni-chaining-mode to a supported value (e.g. none, aws-cni, azure, gke, portmap, flannel) and redeploy the agent.","Check Helm values: cilium cni.chainingMode must match a supported mode exactly; fix typos.","If upgrading, verify the chaining mode still exists in the target Cilium version's cniConfigs map and migrate if removed.","Confirm the agent's ConfigMap actually carries the corrected value (kubectl -n kube-system get cm cilium-config)."],"exampleFix":"// before (Helm values)\ncni:\n  chainingMode: calici\n// after\ncni:\n  chainingMode: portmap","handlingStrategy":"validation","validationCode":"var validChainingModes = map[string]bool{\n  \"none\": true, \"aws-cni\": true, \"azure\": true, \"gke\": true,\n  \"portmap\": true, \"flannel\": true, \"generic-veth\": true,\n}\nmode := strings.ToLower(chainingMode)\nif !validChainingModes[mode] {\n    return fmt.Errorf(\"unsupported cni-chaining-mode %q\", chainingMode)\n}","typeGuard":null,"tryCatchPattern":"conf, err := manager.renderCNIConf()\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"invalid CNI chaining mode\") {\n        // fail fast at deploy time: reject bad Helm values before rolling pods\n    }\n    return err\n}","preventionTips":["Validate chainingMode in CI against the supported list for your Cilium version.","Use Helm values schema / values.schema.json to constrain cni.chainingMode.","Check release notes for renamed/removed chaining modes before upgrades.","Always normalize to lowercase when passing the mode."],"tags":["cni","configuration","cilium"],"backgroundTag":"invalid-config-value","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}