istio/istio · warning

failed to list elements from IPv6 set %s: %w

Error message

failed to list elements from IPv6 set %s: %w

What it means

This error is the IPv6 counterpart of the v4 list failure: while collecting all set members in ListEntriesByIP, the dump of the v6 set (only attempted when h.enableIPv6 is true) failed. The %w carries the nft error. It aborts the whole inventory call even if the v4 dump succeeded, because the function returns nil, err.

Source

Thrown at cni/pkg/nftables/host_sets.go:330

	if err != nil {
		return nil, fmt.Errorf("failed to list elements from IPv4 set %s: %w", h.v4SetName, err)
	}

	for _, elem := range v4Elements {
		if len(elem.Key) > 0 {
			if ip, err := netip.ParseAddr(elem.Key[0]); err == nil {
				allIPs = append(allIPs, ip)
			} else {
				log.Warnf("Failed to parse IPv4 address %s: %v", elem.Key[0], err)
			}
		}
	}

	// List elements from IPv6 set if enabled
	if h.enableIPv6 {
		v6Elements, err := nft.ListElements(context.TODO(), "set", h.v6SetName)
		if err != nil {
			return nil, fmt.Errorf("failed to list elements from IPv6 set %s: %w", h.v6SetName, err)
		}

		for _, elem := range v6Elements {
			if len(elem.Key) > 0 {
				if ip, err := netip.ParseAddr(elem.Key[0]); err == nil {
					allIPs = append(allIPs, ip)
				} else {
					log.Warnf("Failed to parse IPv6 address %s: %v", elem.Key[0], err)
				}
			}
		}
	}

	return allIPs, nil
}

// clearEntriesFromSetWithComment is a helper function to clear entries with a specific comment from a set
func (h *HostNftSetManager) clearEntriesFromSetWithComment(nft builder.NftablesAPI, setName, comment string) error {

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Verify the v6 set exists (nft list sets); if missing, re-run Init with correct enableIPv6
2. Ensure the node truly supports IPv6 (net.ipv6.conf.all.disable_ipv6=0, nf_tables ipv6 available) and align EnableIPv6 accordingly
3. If the node is effectively v4-only, disable IPv6 in ambient config to skip the v6 dump
4. Restart the istio-cni node agent to rebuild both sets consistently

// Skip v6 inventory when the node cannot support it
func v6NftUsable() bool {
	b, _ := os.ReadFile("/proc/sys/net/ipv6/conf/all/disable_ipv6")
	return strings.TrimSpace(string(b)) != "1"
}

func shouldListV6(enableIPv6, kernelV6 bool) bool { return enableIPv6 && kernelV6 }

// Degrade to v4-only inventory with a warning instead of failing the call
ips, err := mgr.ListEntriesByIP()
if err != nil && strings.Contains(err.Error(), "IPv6 set") {
	log.Warn("v6 set unavailable; falling back to v4 inventory")
	ips, err = mgr.listV4Only()
}

When it happens

Trigger: With enableIPv6=true, nft.ListElements on h.v6SetName errors — v6 set never created (init transaction partially failed), IPv6 disabled at kernel level (ipv6.disable=0 but nf_tables ipv6 family blocked), or concurrent destruction of the table

Common situations: Nodes with partial IPv6 support (kernel module blacklisted) while ambient config requests dual stack; init succeeded for v4 but silently failed v6; mixed-capability node pools in one cluster

Related errors

• request to delete %s from the set, but ipv6 is not enabled
• failed to list elements from set %s: %w
• failed to list elements from IPv4 set %s: %w
• failed to initialize nftables sets: %w
• failed to add IP %s to nftables set %s: %w

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/624a7cfea9d1d84d. Report an issue: GitHub.