cilium/cilium · error

unexpected success: %w

Error message

unexpected success: %w

What it means

The HaveNetkit probe considers ENODEV the success signal for netkit support. If link.AttachNetkit unexpectedly succeeded (nil error) even though the probe passed an out-of-range interface index (math.MaxInt), the probe returns 'unexpected success'. This is an internal invariant violation — the kernel accepted a netkit attach it should have rejected — and it leaves the feature probe in an undefined state.

Source

Thrown at pkg/datapath/linux/probes/probes.go:321

		l, err := link.AttachNetkit(link.NetkitOptions{
			Program:   prog,
			Attach:    ebpf.AttachNetkitPrimary,
			Interface: math.MaxInt,
		})
		// We rely on this being checked during the syscall. With
		// an otherwise correct payload we expect ENODEV here as
		// an indication that the feature is present.
		if errors.Is(err, unix.ENODEV) {
			return nil
		}
		if err != nil {
			return fmt.Errorf("creating link: %w", err)
		}
		if err := l.Close(); err != nil {
			return fmt.Errorf("closing link: %w", err)
		}

		return fmt.Errorf("unexpected success: %w", err)
	})
})

// HaveNetkitScrub returns nil if the running kernel supports netkit scrub
// attribute.
var HaveNetkitScrub = sync.OnceValue(func() error {
	ns, err := netns.New()
	if err != nil {
		return fmt.Errorf("create netns: %w", err)
	}
	defer ns.Close()

	return ns.Do(func() error {
		hostIfName := "tmpnkscr0"
		peerIfName := "tmpnkscr1"

		var hostMac, peerMac mac.MAC
		netkit := &netlink.Netkit{

View on GitHub (pinned to ac7b90affa)

Solutions

1. Report/inspect the kernel's netkit attach behavior for out-of-range ifindex values
2. Pin to a mainline-supported kernel (>= 6.7 stable) so probe semantics hold
3. Update cilium/cilium and cilium/ebpf libraries so probe expectations match current kernels
4. Treat the probe error as 'netkit support unknown' and fall back to the default datapath

if err := probes.HaveNetkit(); err != nil {
    if strings.Contains(err.Error(), "unexpected success") {
        log.Warn("netkit probe invariant violated; using default datapath")
        useDefaultDatapath()
        return nil
    }
    return err
}

When it happens

Trigger: HaveNetkit() on a kernel where attaching a netkit link with Interface=math.MaxInt does not return ENODEV but succeeds, i.e. the syscall semantics differ from what the probe expects (unusual/patched kernels orcilium/vishnetlink behavior changes).

Common situations: Running on kernels with backported/modified netkit semantics; vendor kernels deviating from mainline; testing against a kernel where interface index validation is not performed on the ENODEV path.

Related errors

• unable to lookup netkit peer link: %w
• closing link: %w
• create link: %w
• query link: %w
• netkit scrub attribute not supported

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/081b6f5bbb551b44. Report an issue: GitHub.