cilium/cilium · error

adding specified prefixes would result in too many prefix le

Error message

adding specified prefixes would result in too many prefix lengths (current: %d, result: %d, max: %d)

What it means

pkg/counter tracks unique IP prefix lengths (per IPCache-style counting). checkLimits enforces the configured maximum number of unique prefix lengths; adding prefixes whose resulting count exceeds the limit returns this error with current, resulting, and max counts. It exists to bound BPF map memory used by prefix-length counters.

Source

Thrown at pkg/counter/prefixes.go:81

		createIPNet(net.IPv4len*8, net.IPv4len*8), // hosts

		// IPv6
		createIPNet(0, net.IPv6len*8),             // world
		createIPNet(net.IPv6len*8, net.IPv6len*8), // hosts
	}
	if _, err := counter.Add(defaultPrefixes); err != nil {
		panic(fmt.Errorf("Failed to create default prefix lengths: %w", err))
	}

	return counter
}

// checkLimits checks whether the specified new count of prefixes would exceed
// the specified limit on the maximum number of unique keys, and returns an
// error if it would exceed the limit.
func checkLimits(current, newCount, max int) error {
	if newCount > max {
		return fmt.Errorf("adding specified prefixes would result in too many prefix lengths (current: %d, result: %d, max: %d)",
			current, newCount, max)
	}
	return nil
}

// Add increments references to prefix lengths for the specified IPNets to the
// counter. If the maximum number of unique prefix lengths would be exceeded,
// returns an error.
//
// Returns true if adding these prefixes results in an increase in the total
// number of unique prefix lengths in the counter.
func (p *PrefixLengthCounter) Add(prefixes []netip.Prefix) (bool, error) {
	p.Lock()
	defer p.Unlock()

	// Assemble a map of references that need to be added
	newV4Counter := p.v4.DeepCopy()
	newV6Counter := p.v6.DeepCopy()

View on GitHub (pinned to ac7b90affa)

Solutions

1. Increase the prefix-length limit via the relevant Cilium configuration (e.g. max-custom-counters / ipcache-related limits) if memory allows
2. Normalize CIDRs to a smaller set of common mask lengths before adding (aggregate routes)
3. Identify the source injecting unusual prefix lengths (ipcache dump / route dump) and correct it
4. Reduce the number of distinct CIDRs announced to the cluster

Example fix

// before
// injecting 40 distinct v4 prefix lengths with limit 32
counter.Add(cidrs) // fails
// after: aggregate CIDRs so only <=32 distinct lengths remain, or raise the limit in configuration

// count distinct prefix lengths before adding
lens := map[int]struct{}{}
for _, n := range ipnets {
    ones, _ := n.Mask.Size()
    lens[ones] = struct{}{}
}
if len(lens) > maxUniquePrefixes { return errors.New("too many distinct prefix lengths") }

When it happens

Trigger: Calling prefixes.Add(...) with new /N lengths such that the total distinct prefix lengths in v4 or v6 counters would exceed maxUniquePrefixes4/6; typically from ipcache injecting many differently-sized CIDRs (e.g. pod CIDRs, host IPs of mixed mask lengths).

Common situations: Clusters with many disjoint node pod CIDRs of varying mask lengths (max is 32 for v4 / 128 conceptually but limit configured lower); restoring ipcache state after config change that lowered the limit; erroneous routes/bgp announcements injecting unusual masks like /9, /17.

Related errors

• mutual auth feature is disabled but an ingress auth rule is
• mutual auth feature is disabled but an egress auth rule is d
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• minimum ID must be >= 1
• AddrCluster.UnmarshalJSON: bad address

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4b96f08197e1c4b0. Report an issue: GitHub.