kubernetes/kops · error

failed to create bpf mount unit

Error message

failed to create bpf mount unit: %w

What it means

CiliumBuilder.Build, when Cilium networking is configured, creates a systemd mount unit for /sys/fs/bpf via buildBPFMount; any failure from that helper is wrapped in this error. The BPF fs mount is required by Cilium's eBPF datapath, so nodeup aborts the Cilium model build without it.

Solutions

1. Boot a kernel with bpffs support (CONFIG_BPF_FS=y) — upgrade the image/kernel
2. Ensure /sys is mounted (and not fully masked) on the node before nodeup runs
3. Inspect the wrapped %w error to confirm whether Statfs failed
4. Check the generated systemd mount unit for invalid settings if the failure is at task-add time

var fsdata unix.Statfs_t
if err := unix.Statfs("/sys/fs/bpf", &fsdata); err != nil {
    return fmt.Errorf("bpffs unavailable, Cilium build would fail: %v", err)
}

if err := b.buildBPFMount(c); err != nil {
    klog.Errorf("bpf mount unit creation failed: %v", err)
    return fmt.Errorf("failed to create bpf mount unit: %w", err)
}

When it happens

Trigger: buildBPFMount(c) returns an error during nodeup Build with Cilium enabled — practically, unix.Statfs("/sys/fs/bpf") failing (see error 717) or an error adding the mount task.

Common situations: Kernel without BPF filesystem support (missing CONFIG_BPF_FS); restricted container/nodeup environments where /sys is not mounted; very old or minimal kernel images.

Related errors

• failed to create cgroupv2 mount unit
• error checking for /sys/fs/bpf
• error building kubelet flags
• error checking for /run/cilium/cgroupv2
• error doing mount options

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ebd8caf14a5ed29d. Report an issue: GitHub.

Appendix: source

Thrown at nodeup/pkg/model/networking/cilium.go:54

}

var _ fi.NodeupModelBuilder = &CiliumBuilder{}

// Build is responsible for configuring the network cni
func (b *CiliumBuilder) Build(c *fi.NodeupModelBuilderContext) error {
	// As long as the Cilium Etcd cluster exists, we should do this
	if b.NodeupConfig.UseCiliumEtcd {
		if err := b.buildCiliumEtcdSecrets(c); err != nil {
			return err
		}
	}

	if b.NodeupConfig.Networking.Cilium == nil {
		return nil
	}

	if err := b.buildBPFMount(c); err != nil {
		return fmt.Errorf("failed to create bpf mount unit: %w", err)
	}

	if err := b.buildCgroup2Mount(c); err != nil {
		return fmt.Errorf("failed to create cgroupv2 mount unit: %w", err)
	}

	disableManageForeignRoutes(c, b.Distribution)
	disableCloudInitNetworkHotplug(c, b.Distribution)

	if b.NodeupConfig.Networking.Cilium.IPAM == kops.CiliumIpamEni {
		maskEC2NetUtilsUdevRules(c, b.Distribution)
		setMACAddressPolicyNone(c, b.Distribution)
		if err := markSecondaryENIsUnmanaged(c, b.Distribution); err != nil {
			return err
		}
	}

	return nil

View on GitHub (pinned to 4c8573c808)