cilium/cilium · error

remove default local ipv6 rule: %w

Error message

remove default local ipv6 rule: %w

What it means

Mirrors the IPv4 case: after replacing the cilium IPv6 local-lookup rule, NodeEnsureLocalRoutingRule deletes the default IPv6 'local' rule. Any netlink error besides ENOENT from deleteDefaultLocalRule(FAMILY_V6) is wrapped and returned.

Source

Thrown at pkg/datapath/linux/node.go:849

	}

	if option.Config.EnableIPv4 {
		if err := route.ReplaceRule(r); err != nil {
			return fmt.Errorf("replace local ipv4 rule: %w", err)
		}

		if err := deleteDefaultLocalRule(netlink.FAMILY_V4); err != nil {
			return fmt.Errorf("remove default local ipv4 rule: %w", err)
		}
	}

	if option.Config.EnableIPv6 {
		if err := route.ReplaceRuleIPv6(r); err != nil {
			return fmt.Errorf("replace local ipv6 rule: %w", err)
		}

		if err := deleteDefaultLocalRule(netlink.FAMILY_V6); err != nil {
			return fmt.Errorf("remove default local ipv6 rule: %w", err)
		}
	}

	return nil
}

// deleteDefaultLocalRule removes a rule with pref 0 pointing to routing table
// 255 (local). Returns nil if the rule is not present.
func deleteDefaultLocalRule(family int) error {
	rule := route.Rule{
		Table:    unix.RT_TABLE_LOCAL,
		Priority: 0,
	}

	err := route.DeleteRule(family, rule)
	if errors.Is(err, syscall.ENOENT) {
		return nil
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Run the agent with CAP_NET_ADMIN in the host netns
2. Confirm the kernel allows deleting IPv6 local rules (test manually: 'ip -6 rule del pref 0 local') — if the kernel forbids it, this environment cannot run Cilium IPv6 local-rule mode
3. Check for competing agents/CNI plugins toggling ip rules concurrently
4. Collect the wrapped errno to guide kernel/environment troubleshooting

// preflight in a test netns
if err := testDeleteIPv6LocalRule(); err != nil {
    return fmt.Errorf("cannot delete ipv6 local rule in this environment: %w", err)
}

if err := h.NodeEnsureLocalRoutingRule(); err != nil {
    if strings.Contains(err.Error(), "remove default local ipv6 rule") {
        // fall back to alerting + skip half-configured state
        return fmt.Errorf("node unusable for ipv6 datapath: %w", err)
    }
    return err
}

When it happens

Trigger: EnableIPv6=true and the RTM_DELRULE for the IPv6 priority-0 local rule fails with EPERM/EOPNOTSUPP or another non-ENOENT netlink error.

Common situations: Sandboxed runtimes refusing deletion of the default local rule; kernels lacking IPv6 policy-routing support; concurrent rule modification by other CNI components.

Related errors

• replace local ipv6 rule: %w
• failed to enable encapsulation: single cluster routes: ipv6:
• failed to apply initial sync (no encapsulation): delete ipv6
• replace local ipv4 rule: %w
• remove default local ipv4 rule: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/259dbb9dbd51c947. Report an issue: GitHub.