cilium/cilium · error

retrieving device %s: %w

Error message

retrieving device %s: %w

What it means

reloadEndpoint failed to look up the endpoint's Linux network interface (ep.InterfaceName()) via safenetlink.LinkByName while reloading its BPF datapath. The wrapped error comes from netlink and typically means the interface does not exist in the current network namespace. Without the link, no tc/tcx program can be attached.

Source

Thrown at pkg/datapath/loader/endpoint.go:232

	// Insert policy programs before attaching entrypoints to tc hooks.
	// Inserting a policy program is considered an attachment, since it makes
	// the code reachable by bpf_host when it evaluates policy for the endpoint.
	// All internal tail call plumbing needs to be done before this point.
	// If the agent dies uncleanly after the first program has been inserted,
	// the endpoint's connectivity will be partially broken or exhibit undefined
	// behaviour like missed tail calls or drops.
	if err := obj.PolicyMap.Update(uint32(ep.GetID()), obj.PolicyProg, ebpf.UpdateAny); err != nil {
		return fmt.Errorf("inserting endpoint policy program: %w", err)
	}
	if err := obj.EgressPolicyMap.Update(uint32(ep.GetID()), obj.EgressPolicyProg, ebpf.UpdateAny); err != nil {
		return fmt.Errorf("inserting endpoint egress policy program: %w", err)
	}

	device := ep.InterfaceName()
	iface, err := safenetlink.LinkByName(device)
	if err != nil {
		return fmt.Errorf("retrieving device %s: %w", device, err)
	}

	linkDir := bpffsEndpointLinksDir(bpf.CiliumPath(), ep)
	if err := attachSKBProgram(logger, iface, obj.FromContainer, symbolFromEndpoint,
		linkDir, netlink.HANDLE_MIN_INGRESS, option.Config.EnableTCX); err != nil {
		return fmt.Errorf("interface %s ingress: %w", device, err)
	}

	if ep.RequireEgressProg() {
		if err := attachSKBProgram(logger, iface, obj.ToContainer, symbolToEndpoint,
			linkDir, netlink.HANDLE_MIN_EGRESS, option.Config.EnableTCX); err != nil {
			return fmt.Errorf("interface %s egress: %w", device, err)
		}
	} else {
		if err := detachSKBProgram(logger, iface, symbolToEndpoint, linkDir, netlink.HANDLE_MIN_EGRESS); err != nil {
			logger.Error(
				"",
				logfields.Error, err,

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify the interface still exists with `ip link show <device>`; if gone, delete/regenerate the endpoint so it is recreated with a fresh veth.
2. If the pod/container was just deleted, this is transient — let endpoint GC remove the endpoint.
3. Confirm the agent runs in the correct network namespace (host vs container) where the veth lives.
4. If it persists for a live endpoint, restart the Cilium agent to re-sync endpoint state with CNI state.
5. Check for interface renames (systemd/udev link naming) and update endpoint device state.

Example fix

// before: reloading a stale endpoint whose veth was deleted
iface, err := safenetlink.LinkByName(device) // fails: link not found
// after: validate the device exists before reload
if _, err := safenetlink.LinkByName(device); err != nil {
    logger.Warn("endpoint device missing, skipping reload", "device", device)
    return err // let the endpoint GC path handle deletion
}

device := ep.InterfaceName()
if _, err := safenetlink.LinkByName(device); err != nil {
    return fmt.Errorf("endpoint %s device %s missing before reload: %w", ep.StringID(), device, err)
}

When it happens

Trigger: reloadEndpoint (via ReloadDatapath) runs but the veth/device named by ep.InterfaceName() is gone or renamed: container was stopped and its veth deleted, interface moved to another netns, or a stale endpoint record is being reloaded after a device removal.

Common situations: Deleting a pod while Cilium still regenerates its endpoint; container runtime restarting containers and recreating veths with new names; CNI plugin removing the host veth; netns mismatch during agent startup restore.

Related errors

• unable to lookup route for node %s: %w
• unable to find local route for destination %s: %w
• failed to setup base devices: %w
• failed to add internal IP address to %s: %w
• next hop initial insert failed for %+v: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/c828e99d612330f1. Report an issue: GitHub.