cilium/cilium · error

failed to list existing interfaces in pod netns: %w

Error message

failed to list existing interfaces in pod netns: %w

What it means

validateInterfaceNames lists all interfaces in the pod netns with safenetlink.LinkList to build the set of existing names. This error wraps a LinkList failure, aborting collision detection before any rename is attempted.

Source

Thrown at pkg/networkdriver/nri.go:390

	if err := netlink.LinkSetName(l, newIfName); err != nil {
		return nil, fmt.Errorf("failed to rename interface from %s to %s: %w", l.Attrs().Name, newIfName, err)
	}

	// Refresh link reference after rename
	l, err := safenetlink.LinkByName(newIfName)
	if err != nil {
		return nil, fmt.Errorf("failed to get link after rename: %w", err)
	}

	return l, nil
}

// validateInterfaceNames checks if a pod's set of allocated devices
// contain valid interface names, that dont collide with interfaces in the pod namespace.
func validateInterfaceNames(alloc []allocation) error {
	existingLinks, err := safenetlink.LinkList()
	if err != nil {
		return fmt.Errorf("failed to list existing interfaces in pod netns: %w", err)
	}

	existingNames := make(map[string]bool)
	for _, link := range existingLinks {
		existingNames[link.Attrs().Name] = true
	}

	// Check if any of our planned renames would collide with existing interfaces
	for _, a := range alloc {
		if a.Config.PodIfName != "" && existingNames[a.Config.PodIfName] {
			return fmt.Errorf(
				"interface name collision: %q already exists in pod namespace (possibly from CNI)",
				a.Config.PodIfName)
		}
	}

	return nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the wrapped netlink error and node health (dmesg, memory).
2. Verify the agent's seccomp/AppArmor policy permits netlink RTM_GETLINK operations.
3. Restart the agent to recover from transient netlink socket failures and re-run the sandbox hook.
4. If persistent after upgrades, check kernel compatibility with the netlink library version.

if err := driver.RunPodSandbox(ctx, sandbox); err != nil {
    if strings.Contains(err.Error(), "failed to list existing interfaces") {
        // transient netlink failure: backoff and retry
    }
}

When it happens

Trigger: safenetlink.LinkList() inside podNs.Do returns a netlink error — netlink socket creation/enumeration failure, out of memory, or insufficient permissions inside the namespace.

Common situations: Node under memory pressure exhausting netlink sockets; restrictive seccomp/AppArmor profile blocking netlink RTM_GETLINK; kernel issues after upgrade.

Related errors

• pod interface allocations is invalid: %w
• failed to re-create device %s on demand: %w
• device %s still not found after re-creating it on demand: %w
• failed to set interface name: %w
• failed to rename interface from %s to %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/9c322b2963062bab. Report an issue: GitHub.