istio/istio · error

failed to run detection in host namespace: %w

Error message

failed to run detection in host namespace: %w

What it means

util.RunAsHost failed — the detection closure could not be executed inside the host network namespace, so artifact detection did not run at all. Distinct from [249]-[251]: those ran and probed ipsets; this never got there.

Source

Thrown at cni/pkg/nodeagent/detect_artifacts_linux.go:78

			if err != nil {
				log.Debugf("failed to check for v6 IPset %s: %v", v6Name, err)
				if detectionErr != nil {
					detectionErr = fmt.Errorf("%w; v6 IPset detection failed: %w", detectionErr, err)
				} else {
					detectionErr = fmt.Errorf("v6 IPset detection failed: %w", err)
				}
			}

			if v6Exists {
				log.Infof("detected iptables artifact: IPset %s exists", v6Name)
				detected = true
			}
		}

		return nil
	})
	if err != nil {
		return false, fmt.Errorf("failed to run detection in host namespace: %w", err)
	}

	return detected, detectionErr
}

// ipsetExists checks if an IPset with the given name exists on the host.
// Returns:
//   - true, nil if the IPset exists
//   - false, nil if the IPset does not exist (expected for clean/fresh setup)
//   - false, error for any errors
func ipsetExists(name string) (bool, error) {
	_, err := netlink.IpsetList(name)
	if err == nil {
		// IPset exists
		return true, nil
	}

	if strings.Contains(err.Error(), "no such file") {

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Deploy the agent with hostNetwork: true (and hostPID / host /proc mount as the chart requires)
2. Grant CAP_SYS_ADMIN / CAP_NET_ADMIN or run privileged as documented for istio-cni
3. Relax the PodSecurity restricted policy on the istio-system namespace to privileged for the cni-node DaemonSet

// verify host netns reachability before running host-side detection
if _, err := os.Stat("/proc/1/ns/net"); err != nil {
    return errors.New("host /proc not mounted; cannot run as host")
}

if err := util.RunAsHost(func() error { ... }); err != nil {
    // capability/mount problem: fail loudly rather than silently skipping host cleanup
    return fmt.Errorf("host-ns detection failed (check hostPID/CAP_SYS_ADMIN): %w", err)
}

When it happens

Trigger: EnterHostNamespace/nsenter-style switch fails: host /proc not mounted (no hostPID), missing CAP_SYS_ADMIN to setns, or the host netns reference cannot be resolved from the container.

Common situations: istio-cni agent deployed without hostPID/hostNetwork or without the /proc host mount; security policy (PSP/PSA/restricted SCC) blocking setns; running the agent as a plain unprivileged pod.

Related errors

• Error switching to ns fd %v: %v
• v4 IPset detection failed: %w
• nft JSON probe failed (output: %q): %w
• not implemented on this OS platform
• failed to configure netlink rule: %w

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/6f4d3b32397184d5. Report an issue: GitHub.