{"record":{"id":"efb00854c6fd6322","repo":"cilium/cilium","slug":"unable-to-rename-s-chain-to-s-s-w","errorCode":null,"errorMessage":"unable to rename %s chain to %s: %s (%w)","messagePattern":"unable to rename (.+?) chain to (.+?): (.+?) \\(%w\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/iptables/custom_chain.go","lineNumber":159,"sourceCode":"\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (c *customChain) doRename(prog runnable, newName string) error {\n\tif exists, err := c.exists(prog); err != nil {\n\t\treturn err\n\t} else if !exists {\n\t\treturn nil\n\t}\n\n\targs := []string{\"-t\", c.table, \"-E\", c.name, newName}\n\n\toutput, err := prog.runProgOutput(args)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to rename %s chain to %s: %s (%w)\", c.name, newName, string(output), err)\n\t}\n\n\treturn nil\n}\n\nfunc (c *customChain) rename(ipv4, ipv6 bool, name string, ip4tables, ip6tables iptablesInterface) error {\n\tif ipv4 {\n\t\tif err := c.doRename(ip4tables, name); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tif ipv6 && c.ipv6 {\n\t\tif err := c.doRename(ip6tables, name); err != nil {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn nil","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/iptables/custom_chain.go#L141-L177","documentation":"Thrown when `iptables -t <table> -E <old> <new>` fails while renaming a Cilium custom chain (part of Cilium's atomic rule-installation flow where new chains are built under temporary names and renamed into place). The wrapped output/error indicates why the rename was rejected.","triggerScenarios":"rename -> doRename when the -E command fails: target name already in use, source chain missing (e.g. prior doAdd failed or was cleaned up), missing privileges, or missing iptables binary.","commonSituations":"A previous partial Cilium run left a stale chain with the destination name; another iptables manager (Docker/kube-proxy scripts) claiming the same chain name; unprivileged container; legacy/nftables backend mismatch.","solutions":["Check for and remove leftover chains with the target name (`iptables -t <table> -S | grep <name>`), then restart Cilium.","Ensure NET_ADMIN capability and a functioning iptables binary.","If a prior add failed, fix the root cause (see chain add errors) so rename operates on an existing chain.","Inspect the wrapped output for the precise iptables error message."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// detect a stale destination chain before renaming\nout, _ := exec.Command(\"iptables\", \"-t\", table, \"-S\", newName).CombinedOutput()\nif len(out) > 0 {\n\texec.Command(\"iptables\", \"-t\", table, \"-F\", newName).Run()\n\texec.Command(\"iptables\", \"-t\", table, \"-X\", newName).Run()\n}","typeGuard":null,"tryCatchPattern":"if err := chain.rename(ipv4, ipv6, newName, ip4, ip6); err != nil {\n\tif strings.Contains(err.Error(), \"already exists\") {\n\t\t// clean stale chain and retry once\n\t\tcleanupStaleChain(table, newName)\n\t\treturn chain.rename(ipv4, ipv6, newName, ip4, ip6)\n\t}\n\treturn err\n}","preventionTips":["Clean up leftover cilium chains after aborted upgrades (`iptables -S | grep CILIUM`).","Keep NET_ADMIN and iptables available in images.","Only one iptables manager (cilium) should own CILIUM_* chains."],"tags":["network","iptables","cilium","datapath"],"backgroundTag":"iptables-command-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}