Cilium BPF Map Kernel Compatibility Check

Threat/Impact Level: HIGH | Downtime Risk: HIGH | Time to Fix: 15–45 mins

TL;DR

• What broke: Cilium's agent cannot create eBPF maps (LRU_HASH, SOCKMAP, or PERCPU_ARRAY) because the host kernel predates the syscall support for those map types — pod networking is completely down on affected nodes.
• How to fix it: Upgrade the node kernel to ≥ 5.10 LTS (4.19 absolute minimum for basic Cilium, 5.10+ for full feature parity), or disable the specific Cilium features requiring newer map types via Helm values.
• Shortcut: Use our Client-Side Sandbox above to auto-refactor your Cilium Helm values.yaml or DaemonSet spec against your kernel version — no config leaves your browser.

level=fatal msg="Failed to create BPF map" error="map create: operation not supported" mapName="cilium_lb4_services_v2" type=LRU_HASH
level=fatal msg="BPF map creation failed, cannot continue" subsys=maps

FATAL: kernel too old to run Cilium (4.14.0 < 4.19.57)

How to Fix It

Step 0: Confirm the kernel version on the failing node

# Get kernel version per node
kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.kernelVersion}{"\n"}{end}'

# Or exec into the cilium pod before it crashes
kubectl exec -n kube-system cilium-<pod> -- uname -r

Basic Fix — Disable Features Requiring Newer Kernels

If you cannot immediately upgrade the kernel, surgically disable the offending features in your Cilium Helm values:

# cilium/values.yaml

- kubeProxyReplacement: strict
+ kubeProxyReplacement: disabled

- hostServices:
-   enabled: true
+ hostServices:
+   enabled: false

- nodePort:
-   enabled: true
+ nodePort:
+   enabled: false

- bandwidthManager:
-   enabled: true
+ bandwidthManager:
+   enabled: false

- hubble:
-   enabled: true
+ hubble:
+   enabled: false

Then roll the DaemonSet:

helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --reuse-values \
  -f values-degraded.yaml

kubectl rollout restart daemonset/cilium -n kube-system

Enterprise Best Practice — Node Affinity + Kernel Enforcement

Do not let Cilium schedule on nodes that cannot support it. Enforce at the DaemonSet level and at the node pool level.

1. Label compliant nodes during bootstrap (cloud-init / userdata):

kubectl label node <node-name> cilium.io/kernel-compatible=true

2. Patch the Cilium DaemonSet with node affinity:

# cilium DaemonSet spec.template.spec

+ affinity:
+   nodeAffinity:
+     requiredDuringSchedulingIgnoredDuringExecution:
+       nodeSelectorTerms:
+       - matchExpressions:
+         - key: cilium.io/kernel-compatible
+           operator: In
+           values:
+           - "true"

3. Enforce minimum kernel in Helm values (Cilium 1.13+):

# values.yaml

+ k8s:
+   requireIPv4PodCIDR: true

+ affinity:
+   nodeAffinity:
+     requiredDuringSchedulingIgnoredDuringExecution:
+       nodeSelectorTerms:
+         - matchExpressions:
+           - key: kubernetes.io/os
+             operator: In
+             values:
+               - linux
+           - key: cilium.io/kernel-compatible
+             operator: In
+             values:
+               - "true"

4. For EKS/GKE/AKS — pin the node pool image to a kernel-guaranteed AMI:

# Terraform EKS node group example

 resource "aws_eks_node_group" "workers" {
   ...
-  ami_type = "AL2_x86_64"
+  ami_type = "AL2_x86_64"  # Ensure AMI >= al2-kernel-5.10
+  # Pin to a specific AMI ID validated at ≥5.10:
+  launch_template {
+    id      = aws_launch_template.cilium_compatible.id
+    version = "$Latest"
+  }
 }

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

#!/bin/bash
# Add to EC2 userdata / cloud-init before kubelet starts
MIN_KERNEL="5.10"
CURRENT=$(uname -r | cut -d'-' -f1)

if ! printf '%s\n%s' "$MIN_KERNEL" "$CURRENT" | sort -V -C; then
  echo "FATAL: Kernel $CURRENT < required $MIN_KERNEL for Cilium. Halting."
  systemctl stop kubelet
  exit 1
fi

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredNodeAffinity
metadata:
  name: cilium-kernel-affinity
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["DaemonSet"]
    namespaces: ["kube-system"]
  parameters:
    requiredAffinityKey: "cilium.io/kernel-compatible"
    requiredAffinityValue: "true"

# .github/workflows/cilium-lint.yaml
- name: Render Cilium Helm chart
  run: helm template cilium cilium/cilium -f values.yaml > rendered.yaml

- name: Run Checkov on rendered manifest
  uses: bridgecrewio/checkov-action@master
  with:
    file: rendered.yaml
    framework: kubernetes

- name: Validate kernel label affinity exists
  run: |
    grep -q 'cilium.io/kernel-compatible' rendered.yaml || \
      (echo 'Missing kernel affinity in Cilium DaemonSet' && exit 1)

cilium install --dry-run 2>&1 | grep -i "kernel"
cilium preflight install
cilium status --wait