Running the host firewall on a kube-proxy-free cluster with IPv4 only results in the following error:

level=warning msg="Prog section 'to-netdev' rejected: Argument list too long (7)!" subsys=datapath-loader
level=warning msg=" - Type:         3" subsys=datapath-loader
level=warning msg=" - Attach Type:  0" subsys=datapath-loader
level=warning msg=" - Instructions: 4179 (83 over limit)" subsys=datapath-loader
level=warning msg=" - License:      GPL" subsys=datapath-loader

This is easy to reproduce e.g. on GKE with the following command:

helm install cilium ./cilium   --namespace cilium   --set nodeinit.enabled=true   --set nodeinit.reconfigureKubelet=true   --set nodeinit.removeCbrBridge=true   --set cni.binPath=/home/kubernetes/bin   --set tunnel=disabled   --set endpointRoutes.enabled=false   --set ipam.mode=kubernetes   --set nativeRoutingCIDR=$NATIVE_CIDR   --set nodeinit.restartPods=true   --set hostFirewall=true

The regression doesn't affect 1.9.0. It was probably introduced by some of the recent work on IPv4 fragment tracking.

The section failing to load, to-netdev, performs the following actions:

1. Host policy enforcement
2. Bandwidth rate limiter enforcement (disabled on GKE; not required to reproduce)
3. NAT & service handling

The complexity issue only happens when IPv6 is disabled (maybe also when IPv4 is disabled) because the third step above is compiled into a separate tail call only when both IPv4 and IPv6 are enabled:

I will send a pull request to fix it by compiling the NAT & service handling into a separate program when the host firewall is enabled.