What causes "unable to generate rnd mac addr: %w" in cilium/cilium?

Retry link pair setup; entropy failures are usually transient

unable to generate rnd mac addr: %w

Error message

unable to generate rnd mac addr: %w

What it means

setupVethPair generates a random MAC address for the host-side veth end using mac.GenerateRandMAC, which can fail. The error wraps that failure. Random MACs are set explicitly so systemd does not rewrite the addresses of the veth pair.

Source

Thrown at pkg/datapath/connector/veth.go:33

	"github.com/cilium/cilium/pkg/mac"
)

// setupVethPair sets up the host-facing interface, the peer interface and fills
// up some endpoint fields such as mac, NodeMac, ifIndex and ifName. Returns a pointer
// for the created veth, a pointer for the peer link and error if something fails.
func setupVethPair(defaultLogger *slog.Logger, cfg LinkConfig, sysctl sysctl.Sysctl) (*netlink.Veth, netlink.Link, error) {
	logger := defaultLogger.With(logfields.LogSubsys, "endpoint-connector")
	// systemd 242+ tries to set a "persistent" MAC addr for any virtual device
	// by default (controlled by MACAddressPolicy). As setting happens
	// asynchronously after a device has been created, ep.Mac and ep.HostMac
	// can become stale which has a serious consequence - the kernel will drop
	// any packet sent to/from the endpoint. However, we can trick systemd by
	// explicitly setting MAC addrs for both veth ends. This sets
	// addr_assign_type for NET_ADDR_SET which prevents systemd from changing
	// the addrs.
	epHostMAC, err := mac.GenerateRandMAC()
	if err != nil {
		return nil, nil, fmt.Errorf("unable to generate rnd mac addr: %w", err)
	}
	epLXCMAC, err := mac.GenerateRandMAC()
	if err != nil {
		return nil, nil, fmt.Errorf("unable to generate rnd mac addr: %w", err)
	}

	veth := &netlink.Veth{
		LinkAttrs: netlink.LinkAttrs{
			Name:         cfg.HostIfName,
			HardwareAddr: epHostMAC.HardwareAddr(),
			TxQLen:       1000,
		},
		PeerName:         cfg.PeerIfName,
		PeerHardwareAddr: epLXCMAC.HardwareAddr(),
	}

	if err := netlink.LinkAdd(veth); err != nil {
		return nil, nil, fmt.Errorf("unable to create veth pair: %w", err)

View on GitHub (pinned to ac7b90affa)

Solutions

Retry link pair setup; entropy failures are usually transient
Verify /dev/urandom is readable inside the container/host
Check the cilium/pkg/mac package version for known generation bugs and upgrade
If persistent, replace the entropy source or pin MACs explicitly in configuration

Defensive patterns

Strategy: try-catch

Validate before calling

f, err := os.Open("/dev/urandom"); if err != nil { return fmt.Errorf("no entropy source: %w", err) }; f.Close()

Try / catch

peer, err := NewLinkPair(cfg)
if err != nil {
    if strings.Contains(err.Error(), "unable to generate rnd mac addr") {
        // transient entropy failure: retry with backoff
    }
    return err
}

Prevention

Ensure /dev/urandom is available in the container
Avoid running during extremely early boot when entropy is restricted
Keep the mac package updated
Check seccomp profiles don't block getrandom(2)

When it happens

Trigger: Calling NewLinkPair (or the anonymous setup path) when mac.GenerateRandMAC fails — e.g. crypto/rand cannot supply entropy or the generated bytes fail the library's unicast/multicast bit validation.

Common situations: Hosts with a depleted or blocked /dev/urandom (rare, e.g. very early boot or seccomp restrictions); a bug or misconfiguration in the mac package's constraints causing repeated generation failures.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/4095dc2816605ca7. Report an issue: GitHub.