cilium/cilium · error

%s: PrepareCollection(): invalid ordering constraint: %v

Error message

%s: PrepareCollection(): invalid ordering constraint: %v

What it means

Plugins may express ordering constraints (BEFORE/AFTER) between their hooks and other plugins' hooks on the same program. An OrderingConstraint value outside the known enum is rejected with '<plugin>: PrepareCollection(): invalid ordering constraint: %v', aborting hook preparation.

Source

Thrown at pkg/datapath/loader/plugins.go:369

				continue
			}

			hooksSpec.hook(ps.Name, h.Type).addNode(r.plugin.Name())

			for _, c := range h.Constraints {
				otherPlugin := lnc.Plugins[c.Plugin]
				if otherPlugin == nil {
					continue
				}

				switch c.Order {
				case datapathplugins.PrepareCollectionResponse_HookSpec_OrderingConstraint_BEFORE:
					hooksSpec.hook(ps.Name, h.Type).before(r.plugin.Name(), otherPlugin.Name())
				case datapathplugins.PrepareCollectionResponse_HookSpec_OrderingConstraint_AFTER:
					hooksSpec.hook(ps.Name, h.Type).after(r.plugin.Name(), otherPlugin.Name())
				default:
					err = errors.Join(err, fmt.Errorf("%s: PrepareCollection(): invalid ordering constraint: %v", r.plugin.Name(), c.Order))
					continue process_hooks
				}
			}
		}
	}

	if err != nil {
		return nil, err
	}

	instrumentCollectionRequests, programPatches, err := hooksSpec.instrumentCollection(spec)
	if err != nil {
		return nil, fmt.Errorf("instrumenting collection: %w", err)
	}
	opts.ProgramPatches = programPatches

	for plugin, req := range instrumentCollectionRequests {
		prepareHooksResp := responses[plugin]

View on GitHub (pinned to ac7b90affa)

Solutions

1. Upgrade the agent (or downgrade the plugin) so the OrderingConstraint enum values match
2. Fix the plugin to emit only BEFORE/AFTER ordering constraints
3. Regenerate plugin protobuf bindings from the shared datapathplugins proto
4. Remove ordering constraints from the plugin's response if they are not strictly needed
5. Disable the offending plugin until fixed

func validOrderingConstraint(c OrderingConstraint) bool {
    return c == OrderingConstraint_BEFORE || c == OrderingConstraint_AFTER
}

func isKnownOrdering(c PrepareCollectionResponse_HookSpec_OrderingConstraint) bool {
    return c == OrderingConstraint_BEFORE || c == OrderingConstraint_AFTER
}

When it happens

Trigger: A plugin response includes a hook ordering constraint c.Order that is neither BEFORE nor AFTER — typically an enum value from a newer plugin protocol unknown to this agent, or an unset/invalid field from a buggy plugin.

Common situations: Mixed-version agent/plugin deployments where the plugin emits a new OrderingConstraint value; plugin implementation bug writing an out-of-range enum; corrupted/garbled plugin response over the transport.

Related errors

• %s: PrepareCollection(): invalid hook type %v
• instrumenting collection: %w
• preparing hooks: %w
• loading hooks: %w
• %s: PrepareCollection(): %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/a27f43cc6497a341. Report an issue: GitHub.