Cilium CNI plugin fails with missing kernel module(s)

[varjoinen]

What Happened?

Started minikube with:

minikube start --cni=cilium

The Kubernetes cluster starts, but Cilium will stay in CrashLoopBackOffand logging:

...
level=warning msg="BPF system config check: NOT OK." error="CONFIG_NET_SCH_INGRESS kernel parameter or module is required (needed for: Essential eBPF infrastructure)" subsys=linux-datapath
...
level=warning msg="+ tc qdisc replace dev cilium_vxlan clsact" subsys=datapath-loader
level=warning msg="RTNETLINK answers: Operation not supported" subsys=datapath-loader
...
level=warning msg="We have an error talking to the kernel" subsys=datapath-loader
...
level=fatal msg="Error while creating daemon" error="error while initializing daemon: failed while reinitializing datapath: exit status 1" subsys=daemon

There has been similar issue reported earlier at Cilium side and missing kernel modules have been pointed out.

One can see that related kernel modules are missing from the minikube container:

> docker exec -it minikube /bin/sh    
# zcat /proc/config.gz | grep CONFIG_NET_SCH_INGRESS
# zcat /proc/config.gz | grep CONFIG_NET_CLS_ACT    
# 

The same issue can be seen if minikube is started without CNI plugin and Cilium Helm chart is used to install it.

Attach the log file

log.txt

Operating System

macOS (Default)

Driver

Docker

[maksymilian-mulawa-form3]

My guess is, you are using 4.26.0-1 version of Docker Desktop on macOS, try to downgrade it to 4.25.2 using following steps.

1. Download your desired version from the Release Notes.
2. Open the download, drag "Docker" to "Applications"
3. Chose to "Replace" the existing installation
4. Run Docker desktop

It seems that in 4.26.* some major configuration changes were applied to docker-for-mac VM kernel, e.g. hugetlbfs filesystem not available

[afbjorklund]

The new Docker VM also broke both vfat and 9p filesystem support, so this all sounds like more of the same...

[dgageot]

Sorry all for this issue. This will be fixed in 4.27.0. In the meantime, yes, you can use 4.25.2. Sorry again.

[RazaGR]

I confirm downgrading docker version to 4.25.2 fixed the issues for me.

[El-Coder]

Also ran into same issue 4.25.2 fixed it for me

[maksymilian-mulawa-form3]

This issue was resolved in Docker Desktop 4.27.0.

[ofcRS]

This issue was resolved in Docker Desktop 4.27.0.

I'm still experiencing the issue at 4.27 macOS. However, when I downgrade to version 4.25.x, the problem is resolved.

[dgageot]

@ofcRS do you have exactly the same error message or is it a bit different?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.