cilium/cilium · error

deleting outdated geneve device: %w

Error message

deleting outdated geneve device: %w

What it means

The Geneve device cannot be modified in place to change its destination port, so Cilium deletes the existing cilium_geneve and recreates it. If netlink.LinkDel fails it wraps with 'deleting outdated geneve device'. This occurs only when the existing device's Dport differs from the configured one.

Source

Thrown at pkg/datapath/loader/netlink.go:262

			HardwareAddr: mac.HardwareAddr(),
		},
		FlowBased: true,
		Dport:     dport,
		PortLow:   int(srcPortLow),
		PortHigh:  int(srcPortHigh),
	}

	l, err := ensureDevice(logger, sysctl, dev)
	if err != nil {
		return fmt.Errorf("creating geneve device: %w", err)
	}

	// Recreate the device with the correct destination port. Modifying the device
	// without recreating it is not supported.
	geneve, _ := l.(*netlink.Geneve)
	if geneve.Dport != dport {
		if err := netlink.LinkDel(l); err != nil {
			return fmt.Errorf("deleting outdated geneve device: %w", err)
		}
		if _, err := ensureDevice(logger, sysctl, dev); err != nil {
			return fmt.Errorf("recreating geneve device %s: %w", defaults.GeneveDevice, err)
		}
	}
	if geneve.PortLow != int(srcPortLow) || geneve.PortHigh != int(srcPortHigh) {
		logger.Info(
			"Source port range hint ignored given geneve device already exists",
			logfields.Hint, fmt.Sprintf("(%d-%d)", int(srcPortLow), int(srcPortHigh)),
			logfields.Range, fmt.Sprintf("(%d-%d)", geneve.PortLow, geneve.PortHigh),
			logfields.Device, defaults.GeneveDevice,
		)
	}
	return nil
}

// setupVxlanDevice ensures the cilium_vxlan device is created with the given
// port, source port range, and MTU.

View on GitHub (pinned to ac7b90affa)

Solutions

1. Ensure the agent has CAP_NET_ADMIN to delete links
2. Manually delete: ip link del cilium_geneve, then restart the agent so it recreates with the new port
3. Keep tunnel-destination-port consistent cluster-wide to avoid repeated recreation
4. Check for processes/sockets keeping the device busy (lsof, ip -d link show cilium_geneve)

Example fix

// before
Error: deleting outdated geneve device: device is busy
// after
ip link del cilium_geneve
systemctl restart cilium  # recreated with configured dport

// Keep tunnel-destination-port stable cluster-wide; before changing it:
//   ip -d link show cilium_geneve  # inspect current dport
//   ip link del cilium_geneve 2>/dev/null || true

err := setupTunnelDevice(...)
if err != nil && strings.Contains(err.Error(), "deleting outdated geneve") {
    time.Sleep(2 * time.Second)
    err = setupTunnelDevice(...) // retry once after kernel cleanup
}

When it happens

Trigger: geneve-destination-port (default 6081) changed at runtime; existing cilium_geneve has an old Dport; netlink LinkDel on it fails (busy, EPERM, netlink error).

Common situations: Rolling config change of tunnel-destination-port across a cluster; mixed-version nodes with different ports; device held busy during live migration/restart windows.

Related errors

• recreating geneve device %s: %w
• failed to setup %s tunnel device: %w
• setting up geneve device: %w
• creating geneve device: %w
• an unsupported XfrmStateAlgo combination has been found

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4ec0f160e5c0b5d6. Report an issue: GitHub.