cilium/cilium · error · ErrNotImplemented

not implemented

Error message

not implemented

What it means

ErrNotImplemented is returned by gRPC/BPF-cgroup methods in the Envoy integration that Cilium does not implement (e.g. mountCgroup, GetCgroupID, NewHandle, AddrList, ChainList) depending on build flags or platform. It means the requested operation has no implementation in this binary.

Source

Thrown at pkg/envoy/grpc.go:29

	"os"

	cilium "github.com/cilium/proxy/go/cilium/api"
	envoy_service_cluster "github.com/envoyproxy/go-control-plane/envoy/service/cluster/v3"
	envoy_service_discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	envoy_service_endpoint "github.com/envoyproxy/go-control-plane/envoy/service/endpoint/v3"
	envoy_service_listener "github.com/envoyproxy/go-control-plane/envoy/service/listener/v3"
	envoy_service_route "github.com/envoyproxy/go-control-plane/envoy/service/route/v3"
	envoy_service_secret "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
	"google.golang.org/grpc"
	"google.golang.org/grpc/reflection"

	"github.com/cilium/cilium/pkg/envoy/xds"
	"github.com/cilium/cilium/pkg/logging/logfields"
)

// ErrNotImplemented is the error returned by gRPC methods that are not
// implemented by Cilium.
var ErrNotImplemented = errors.New("not implemented")

// runXDSGRPCServer runs a gRPC server to serve xDS APIs using the given
// resource watcher and network listener. Returns on error or when [ctx]
// is cancelled.
func (s *xdsServer) runXDSGRPCServer(ctx context.Context, config map[string]*xds.ResourceTypeConfiguration) error {
	listener, err := s.newSocketListener()
	if err != nil {
		return fmt.Errorf("failed to create socket listener: %w", err)
	}

	grpcServer := grpc.NewServer()

	// xdsServer optionally pauses serving any resources until endpoints have been restored
	xdsServer := xds.NewServer(s.logger, config, s.restorerPromise, s.config.metrics)
	dsServer := &xdsGRPCServer{Server: xdsServer}

	// TODO: https://github.com/cilium/cilium/issues/5051
	// Implement IncrementalAggregatedResources to support Incremental xDS.

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the platform: these operations require Linux with cgroup v1/v2 available.
2. Rebuild/obtain a Cilium image with the required build tags and dependencies (proper envoy/ebpf support).
3. Guard feature enablement: don't enable Envoy features (e.g. L7 policy) on platforms returning this error.
4. Use errors.Is(err, envoy.ErrNotImplemented) to degrade gracefully instead of crashing.

Example fix

// before
handle, err := envoy.NewHandle()
if err != nil {
    return err
}
// after
handle, err := envoy.NewHandle()
if errors.Is(err, envoy.ErrNotImplemented) {
    log.Warn("cgroup socket-LB not supported on this build; skipping")
    return nil
} else if err != nil {
    return err
}

// runtime feature check before enabling Envoy-dependent features:
// if runtime.GOOS != "linux" || !cgroupsAvailable() { disableL7Policy() }

func isNotImplemented(err error) bool {
    return errors.Is(err, envoy.ErrNotImplemented)
}

err := doGRPCOp()
if errors.Is(err, envoy.ErrNotImplemented) {
    return ErrFeatureUnavailable // degrade gracefully
}

When it happens

Trigger: Calling any of mountCgroup, cgrpCheckOrMountLocation, GetCgroupID, NewHandle, AddrList, or ChainList on a build/platform where the feature is stubbed out (e.g. non-Linux, or Envoy gRPC server paths without cgroup support).

Common situations: Running Cilium on unsupported platforms; calling xDS/gRPC APIs not available in the current mode; binaries built without the relevant CGO/ebpf support.

Related errors

• Rule priority is invalid for the tier
• Can't find IP in NPHDS cache
• key has empty namespace and/or name
• failed to start standalone Envoy server
• nodeId is empty

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/cbe06052c8a6f37f. Report an issue: GitHub.