Repository navigation
Description
Describe the bug
After upgrading a GKE cluster from 1.33 to 1.34, Pixie's socket_tracer and perf_profiler probes fail to initialize, causing all network-related data tables (conn_stats, http_events, dns_events) to be missing. Scripts like px/cluster fail with "Table 'conn_stats' not found."
GKE 1.34 uses Container-Optimized OS (COS) milestone 125, which ships with Linux kernel 6.12.55. COS does not include host kernel headers at /lib/modules/6.12.55+/build. The PEM falls back to the closest bundled packaged header (6.1.8), which is too far from kernel 6.12 for the socket_tracer BPF program to compile successfully.
As per #2275, the Pixie team runs primarily on GKE COS nodes. GKE 1.34 with COS 125 is now the current default version in GKE release channels, so this affects all GKE COS users who upgrade.
To Reproduce
Steps to reproduce the behavior:
- Deploy Pixie on a GKE 1.34 cluster with COS node images
- Check stirling_error table: socket_tracer shows "Unable to initialize BCC BPF program"
- Run px/cluster — fails with "Table 'conn_stats' not found"
Expected behavior
PEM should either bundle compatible headers for kernel 6.12.x, download them from Google's cos-tools bucket (https://storage.googleapis.com/cos-tools//), or use CO-RE/BTF to avoid the header dependency.
Screenshots
If applicable, add screenshots to help explain your problem. Please make sure the screenshot does not contain any sensitive information such as API keys or access tokens.
Logs
Please attach the logs by running the following command: (only logs deemed relevant to the issue have been attached. We can share more logs if necessary)
# PEM startup — version and kernel detection
I20260402 06:52:11.168628 6953 pem_main.cc:69] Pixie PEM. Version: v0.14.15+Distribution.623e988.202501242347.1.RELEASE.jenkins, id: 5661a75d-639d-44ef-9440-2d829ea172a1, kernel version: 6.12.55
I20260402 06:52:11.168690 6953 kernel_version.cc:82] Obtained Linux version string from `uname`: 6.12.55+
I20260402 06:52:11.168726 6953 stirling.cc:958] Creating Stirling, registered sources: [process_stats, network_stats, jvm_stats, socket_tracer, perf_profiler, proc_exit_tracer, stirling_error]
# Header resolution — host headers not found, falls back to bundled 6.1.8
I20260402 06:52:11.169289 6953 source_connector.cc:35] Initializing source connector: socket_tracer
I20260402 06:52:11.169345 6953 linux_headers.cc:353] Detected kernel release (uname -r): 6.12.55+
I20260402 06:52:11.171020 6953 linux_headers.cc:369] Not Found : Could not find 'source' or 'build' under /lib/modules/6.12.55+.
I20260402 06:52:11.171041 6953 linux_headers.cc:215] Looking for host Linux headers at /host/lib/modules/6.12.55+/build.
I20260402 06:52:11.171056 6953 linux_headers.cc:372] Not Found : Did not find the host headers at path: /host/lib/modules/6.12.55+/build, No such file or directory.
I20260402 06:52:11.171062 6953 linux_headers.cc:314] Attempting to install packaged headers.
I20260402 06:52:11.171190 6953 linux_headers.cc:320] Using packaged header: /px/linux-headers-x86_64-6.1.8.tar.gz
I20260402 06:52:11.498617 6953 linux_headers.cc:345] Successfully installed packaged copy of headers at /lib/modules/6.12.55+/build
# BPF compilation fails — 6.1.8 headers incompatible with 6.12.55 kernel
In file included from src/stirling/source_connectors/socket_tracer/bcc_bpf/socket_trace.c:25:
In file included from src/stirling/bpf_tools/bcc_bpf/system-headers/linux/net.h:1:
In file included from include/linux/net.h:23:
In file included from include/linux/fs.h:13:
In file included from include/linux/list_lru.h:14:
include/linux/xarray.h:1151:20: error: use of undeclared identifier 'CONFIG_BASE_SMALL'
void __rcu *slots[XA_CHUNK_SIZE];
include/linux/xarray.h:1697:38: error: no member named 'marks' in 'struct xa_node'
unsigned long *addr = xas->xa_node->marks[(__force unsigned)mark];
fatal error: too many errors emitted, stopping now [-ferror-limit=]
20 errors generated.
# socket_tracer fails to initialize
W20260402 06:52:14.420778 6953 stirling.cc:416] Source Connector (registry name=socket_tracer) not instantiated, error: Internal : Unable to initialize BCC BPF program: Unable to initialize BPF program
App information (please complete the following information):
- Pixie version: 0.14.15 (operator chart 0.1.7)
- Cloud: Cosmic Cloud (getcosmic.ai)
- K8s cluster version: GKE 1.34.4-gke.1193000
- Node OS: Container-Optimized OS (COS 125)
- Kernel: 6.12.55+
Additional context
Available data tables (missing network tables):
- present: process_stats, network_stats, jvm_stats, proc_exit_events, probe_status, stirling_error
- missing: conn_stats, http_events, dns_events, mysql_events, pgsql_events, redis_events
Activity
ddelnano commentedon Apr 3, 2026
Hey @utkarsh-ginco, you're right that we are behind on updating our bundled linux kernel headers. Pixie has dynamic tracing features that require BCC, which is why we haven't migrated to CO-RE.
I'm working on updating the kernel headers now. It probably won't be until sometime this weekend that I'll have that updated, but I'll keep you updated on the progress of it.
utkarsh-ginco commentedon Apr 3, 2026
Got it, thanks!
ddelnano commentedon Apr 6, 2026
@utkarsh-ginco I should have a PR open by tomorrow.
utkarsh-ginco commentedon Apr 9, 2026
@ddelnano
How does the timeline for merging this PR look like? #2350
ddelnano commentedon Apr 10, 2026
@utkarsh-ginco I'm hoping it will be reviewable by tomorrow, but it will take time for a new release to be made.
utkarsh-ginco commentedon Apr 10, 2026
@ddelnano Understood, thank you for the update!
How about the timeline for the release? When do you think the fix can be released, once the fix is merged? We are at a stage where some of our production environment clusters have already been upgraded to GKE 1.34.1, and some of our monitoring stack depends on Pixie.
utkarsh-ginco commentedon Apr 24, 2026
Hi @ddelnano. Any updates on the fix?
utkarsh-ginco commentedon May 11, 2026
Hi @ddelnano
It would be really helpful if you could let me know the updated timeline. And please let me know if I can help in any way.
Thanks for working on the fix! 🙏
ddelnano commentedon May 12, 2026
Hi @utkarsh-ginco, there is a vizier pre-release build running that includes that change (source). You will be able to update your deployment to use those images once it's available. I'll post the image tags here once it's finished.
I'm still working on getting the PR merged fully but it's been tested on all the important k8s variants.
ddelnano commentedon May 13, 2026
@utkarsh-ginco you can install this pre-release version by with the
pxcli:px deploy -v 0.14.16-pre-ddelnano-update-kernel-versions.38. That will pull the0.14.16-pre-ddelnano-update-kernel-versions.38tagged set of images under the hood.Trim linux headers to LTS kernel versions for 4.x and 5.x and include…
Trim linux headers to LTS kernel versions for 4.x and 5.x and include…
tusharguptaJ commentedon May 20, 2026
@ddelnano i have installed the pre-release version using cli
px deploy -v 0.14.16-pre-ddelnano-update-kernel-versions.38, but the issue still persist. My orignal issue #2275The cli deploy commanded ended with
The query broker log shows,
ddelnano commentedon May 20, 2026
@tusharguptaJ please collect your vizier's logs via
px collect-logsand upload them to this thread. The "table not found" errors are too coarse grained to tell if what you are experiencing is the same as the parent thread. The vizier-pem logs will confirm if that's the case.tusharguptaJ commentedon May 20, 2026
Here's the log @ddelnano
Click to view Pixie PEM logs
ddelnano commentedon May 20, 2026
@tusharguptaJ your issue is #2042. Adding these flags (#2042 (comment)) should allow the BPF programs to load properly. Please provide the next series of logs if that isn't the case.
tusharguptaJ commentedon May 20, 2026
@ddelnano Here's the further logs
Click to view logs
tusharguptaJ commentedon May 25, 2026
@ddelnano anything on this?
Trim linux headers to LTS kernel versions for 4.x and 5.x and include…
Trim linux headers to LTS kernel versions for 4.x and 5.x and include…
tusharguptaJ commentedon Aug 5, 2026
@ddelnano Is there any update?