kubernetes/kops · error

error checking for /sys/fs/bpf: %v

Error message

error checking for /sys/fs/bpf: %v

What it means

buildBPFMount calls unix.Statfs("/sys/fs/bpf") to determine whether bpffs is already mounted; any Statfs error (other than the magic-check flow) is wrapped in this error. It means nodeup could not even probe the BPF filesystem, usually because /sys/fs/bpf does not exist or the kernel lacks bpf support.

Source

Thrown at nodeup/pkg/model/networking/cilium.go:79

	disableManageForeignRoutes(c, b.Distribution)
	disableCloudInitNetworkHotplug(c, b.Distribution)

	if b.NodeupConfig.Networking.Cilium.IPAM == kops.CiliumIpamEni {
		maskEC2NetUtilsUdevRules(c, b.Distribution)
		setMACAddressPolicyNone(c, b.Distribution)
		if err := markSecondaryENIsUnmanaged(c, b.Distribution); err != nil {
			return err
		}
	}

	return nil
}

func (b *CiliumBuilder) buildBPFMount(c *fi.NodeupModelBuilderContext) error {
	var fsdata unix.Statfs_t
	err := unix.Statfs("/sys/fs/bpf", &fsdata)
	if err != nil {
		return fmt.Errorf("error checking for /sys/fs/bpf: %v", err)
	}

	// equivalent to unix.BPF_FS_MAGIC in golang.org/x/sys/unix
	BPF_FS_MAGIC := uint32(0xcafe4a11)

	// systemd v238 includes the bpffs mount by default; and gives an error "has a bad unit file setting" if we try to mount it again (see mount_point_is_api)
	alreadyMounted := uint32(fsdata.Type) == BPF_FS_MAGIC

	if !alreadyMounted {
		unit := `
[Unit]
Description=Cilium BPF mounts
Documentation=http://docs.cilium.io/
DefaultDependencies=no
Before=local-fs.target umount.target kubelet.service

[Mount]
What=bpffs

View on GitHub (pinned to 4c8573c808)

Solutions

1. Mount bpffs on the host: mount -t bpf bpf /sys/fs/bpf (and persist in the image)
2. Use a kernel image with BPF filesystem support (CONFIG_BPF_FS=y)
3. Ensure /sys is mounted before nodeup runs
4. Upgrade the OS image to a distribution with modern kernel/systemd that auto-provides the bpffs mount

Example fix

// before
$ ls /sys/fs/bpf
ls: cannot access '/sys/fs/bpf': No such file or directory
// after
$ mount -t bpf bpf /sys/fs/bpf

var fsdata unix.Statfs_t
if err := unix.Statfs("/sys/fs/bpf", &fsdata); err != nil {
    klog.Warningf("/sys/fs/bpf not statable; mount bpffs before enabling Cilium: %v", err)
}
if _, err := os.Stat("/proc/filesystems"); err == nil {
    if b, _ := os.ReadFile("/proc/filesystems"); !strings.Contains(string(b), "bpf") {
        klog.Warning("kernel lacks bpf filesystem support")
    }
}

if err := unix.Statfs("/sys/fs/bpf", &fsdata); err != nil {
    return fmt.Errorf("error checking for /sys/fs/bpf: %v", err) // caller may fall back to explicit mount
}

When it happens

Trigger: unix.Statfs("/sys/fs/bpf", &fsdata) returns an error during nodeup Build on a Cilium-enabled node — missing bpffs mount point, kernel without CONFIG_BPF_FS, or /sys not mounted.

Common situations: Minimal/custom AMIs or Linode images lacking the bpf mount; containers without /sys passthrough; very old kernels (<4.x); hardened kernels with bpf disabled.

Related errors

• failed to create bpf mount unit: %w
• error checking for /run/cilium/cgroupv2: %v
• failed to create cgroupv2 mount unit: %w
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5eaa72d4d1d9120e. Report an issue: GitHub.