cilium/cilium · error

failed to render CNI configuration file: %w

Error message

failed to render CNI configuration file: %w

What it means

When no user-supplied CNI config file is given, setupCNIConfFile renders the CNI conflist itself via c.renderCNIConf(). If rendering fails, the error is wrapped with this message. Render failures come from the internal config assembly (e.g. malformed IPAM/flannel settings or unsupported configuration combinations).

Source

Thrown at daemon/cmd/cni/config.go:328

			})
		}
	}()

	// generate CNI config, either by reading a user-supplied
	// template file or rendering our own.
	if c.config.ReadCNIConf != "" {
		contents, err = os.ReadFile(c.config.ReadCNIConf)
		if err != nil {
			return fmt.Errorf("failed to read source CNI config file at %s: %w", c.config.ReadCNIConf, err)
		}
		c.logger.Info(
			"Reading CNI configuration file source",
			logfields.ConfigPath, c.config.ReadCNIConf,
		)
	} else {
		contents, err = c.renderCNIConf()
		if err != nil {
			return fmt.Errorf("failed to render CNI configuration file: %w", err)
		}
	}

	err = ensureDirExists(c.cniConfDir)
	if err != nil {
		return fmt.Errorf("failed to create the dir %s of the CNI configuration file: %w", c.cniConfDir, err)
	}

	// Check to see if existing file is the same; if so, do nothing
	existingContents, err := os.ReadFile(dest)
	if err == nil && bytes.Equal(existingContents, contents) {
		c.logger.Debug(
			"Existing CNI configuration file unchanged",
			logfields.Destination, dest,
		)
	} else {
		if err != nil && !os.IsNotExist(err) {
			c.logger.Info(

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the wrapped `%w` cause to see which render step failed
2. Review and correct the CNI-related agent flags (--cni-* and IPAM settings)
3. Alternatively supply a valid static file via --read-cni-conf to bypass rendering

Example fix

// before
//   --write-cni-conf-when-ready=true --read-cni-conf=""
// after (bypass render)
//   --read-cni-conf=/etc/cni/net.d/05-cilium.conflist

// validate the flags that feed renderCNIConf before starting:
// e.g. ensure IPAM mode and --cni-conf-dir values are supported combinations

contents, err := renderCNIConf()
if err != nil {
    if userConf != "" {
        contents, err = os.ReadFile(userConf) // fallback to user template
    }
    if err != nil { log.Fatalf("CNI config unavailable: %v", err) }
}

When it happens

Trigger: c.renderCNIConf() returns an error while generating the default CNI configuration — typically invalid daemon flags (bad IPAM mode, missing network config) that make the rendered JSON/patch impossible.

Common situations: Invalid combination of cilium-agent CNI flags; broken cni-custom-conf templating; misconfigured --cip / IPAM values producing invalid netconf.

Related errors

• failed to read source CNI config file at %s: %w
• no link found inside container
• %s is not set in ConfigMap %q
• unable to parse %s: %w
• failed to render template %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/3b1b00c2b45f79c8. Report an issue: GitHub.