{"record":{"id":"02f7578a20d86901","repo":"cilium/cilium","slug":"too-many-ports-the-max-is-d","errorCode":null,"errorMessage":"too many ports, the max is %d","messagePattern":"too many ports, the max is (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/api/rule_validation.go","lineNumber":643,"sourceCode":"// It is not allowed to configure an ingress listener, but we still\n// have some unit tests relying on this. So, allow overriding this check in the unit tests.\nvar TestAllowIngressListener = false\n\nfunc (pr *PortRule) Validate(ingress bool) error {\n\thasDNSRules := pr.Rules != nil && len(pr.Rules.DNS) > 0\n\tif ingress && hasDNSRules {\n\t\treturn fmt.Errorf(\"DNS rules are not allowed on ingress\")\n\t}\n\n\tif len(pr.ServerNames) > 0 && !pr.Rules.IsEmpty() && pr.TerminatingTLS == nil {\n\t\treturn fmt.Errorf(\"ServerNames are not allowed with L7 rules without TLS termination\")\n\t}\n\tif slices.Contains(pr.ServerNames, \"\") {\n\t\treturn errEmptyServerName\n\t}\n\n\tif len(pr.Ports) > maxPorts {\n\t\treturn fmt.Errorf(\"too many ports, the max is %d\", maxPorts)\n\t}\n\thaveZeroPort := false\n\tfor i := range pr.Ports {\n\t\tvar isZero bool\n\t\tvar err error\n\t\tif isZero, err = pr.Ports[i].Validate(hasDNSRules); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif isZero {\n\t\t\thaveZeroPort = true\n\t\t}\n\t\t// DNS L7 rules can be TCP, UDP or ANY, all others are TCP only.\n\t\tswitch {\n\t\tcase pr.Rules.IsEmpty(), hasDNSRules:\n\t\t\t// nothing to do if no rules OR they are DNS rules (note the comma above)\n\t\tcase pr.Ports[i].Protocol != ProtoTCP:\n\t\t\treturn fmt.Errorf(\"L7 rules can only apply to TCP (not %s) except for DNS rules\", pr.Ports[i].Protocol)\n\t\t}","sourceCodeStart":625,"sourceCodeEnd":661,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/api/rule_validation.go#L625-L661","documentation":"PortRule.Validate enforces a hard limit of maxPorts ports per PortRule. A policy that lists more than this number of entries in a single port rule is rejected to keep the policy manageable and proxy rules bounded. The error reports the configured maximum.","triggerScenarios":"Calling PortRule.Validate with len(pr.Ports) > maxPorts — i.e. one toPorts entry (or generated PortRule) enumerating more than the allowed number of ports, typically from programmatically generated policies listing many ports.","commonSituations":"Auto-generated policies from service inventories enumerating dozens of ports; users trying to whitelist large port ranges by listing each port individually; YAML merge producing concatenated port lists.","solutions":["Split the policy into multiple NetworkPolicy rules, each with at most maxPorts port entries.","Use cidr+port rules more coarsely, or rely on label-based selectors instead of enumerating ports.","Consolidate adjacent ports where the datapath allows (e.g. use a range if supported via toPorts ports with endPort).","Generate the policy programmatically and enforce the maxPorts cap in your generator."],"exampleFix":"// before: one rule with 50+ ports\n- toPorts:\n  - ports:\n    - port: \"1000\"\n    - port: \"1001\"\n    # ... 50 more\n// after: split across rules, or use endPort range\n- toPorts:\n  - ports:\n    - port: \"1000\"\n      endPort: \"1100\"","handlingStrategy":"validation","validationCode":"const maxPorts = 40 // match library constant\nfunc checkPortCount(pr api.PortRule) error {\n    if len(pr.Ports) > maxPorts {\n        return fmt.Errorf(\"port rule has %d ports, max is %d\", len(pr.Ports), maxPorts)\n    }\n    return nil\n}","typeGuard":"func exceedsPortLimit(pr api.PortRule, limit int) bool { return len(pr.Ports) > limit }","tryCatchPattern":null,"preventionTips":["Enforce the maxPorts cap in any policy generator before emitting YAML.","Prefer port ranges (port + endPort) over enumerating many individual ports.","Split wide port sets across multiple NetworkPolicy rules.","Periodically audit large auto-generated policies for rule-size growth."],"tags":["cilium","networkpolicy","ports","limits","validation"],"backgroundTag":"policy-limit-exceeded","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}