Libbpf error after update to v3.21

Hi all,

I recently updated Calico from 3.20.1 to 3.21, switching from manifest to operator, as per instructions. Since then the calico-node logs are filled with the following message

2022-01-04 09:19:42.923 [WARNING][56781] felix/bpf_ep_mgr.go 608: Failed to apply policy to interface, will retry error=error loading program error loading object operation not permitted
2022-01-04 09:19:53.209 [INFO][56781] felix/bpf_ep_mgr.go 1339: Need to attach program hook=“egress” iface=“vxlan.calico” type=“host”
2022-01-04 09:19:53.209 [INFO][56781] felix/bpf_ep_mgr.go 1339: Need to attach program hook=“ingress” iface=“vxlan.calico” type=“host”
libbpf: couldn’t retrieve pinned map ‘/sys/fs/bpf/tc/vxlan.calico_igr/cali_jump’: Operation not permitted
libbpf: map ‘cali_jump’: error reusing pinned map
libbpf: map ‘cali_jump’: failed to create: Operation not permitted(-1)
libbpf: failed to load object ‘/tmp/calico-tc802504830/from_hep_fib_no_log.o’
libbpf: couldn’t retrieve pinned map ‘/sys/fs/bpf/tc/vxlan.calico_egr/cali_jump’: Operation not permitted
libbpf: map ‘cali_jump’: error reusing pinned map
libbpf: map ‘cali_jump’: failed to create: Operation not permitted(-1)
libbpf: failed to load object ‘/tmp/calico-tc805590747/to_hep_no_log.o’

The pods can communicate, I’m just wondering whether this is creating a problem I don’t see yet.

Some more details

  • K8s version is 1.21.3
  • the VMs are using Ubuntu 20.04 with kernel 5.4.0-91-generic #102-Ubuntu SMP Fri Nov 5 16:31:28 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux (also tried 5.8.0-63-generic #71~20.04.1-Ubuntu SMP but it didn’t help)
  • when I installed it the first time, I followed the setup for 50 or less nodes with k8s API datastore, afterwards I configured it to use VXLAN and eBPF (well before the upgrade). The FelixConfiguration spec looks like this:

bpfEnabled: true
bpfKubeProxyIptablesCleanupEnabled: false
bpfLogLevel: “”
ipipEnabled: false
logSeverityScreen: Info
prometheusMetricsEnabled: true
reportingInterval: 0s
vxlanEnabled: true

Looks like a bug, please can you file a bug on the calico Github. Thanks!

Thanks a lot for the reply, I opened the bug, the link is here.