{"record":{"id":"08d133fe548061e7","repo":"slackhq/nebula","slug":"config-s-has-invalid-type-t","errorCode":null,"errorMessage":"config `%s` has invalid type: %T","messagePattern":"config `(.+?)` has invalid type: %T","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"allow_list.go","lineNumber":87,"sourceCode":"}\n\n// If the handleKey func returns true, the rest of the parsing is skipped\n// for this key. This allows parsing of special values like `interfaces`.\nfunc newAllowListFromConfig(c *config.C, k string, handleKey func(key string, value any) (bool, error)) (*AllowList, error) {\n\tr := c.Get(k)\n\tif r == nil {\n\t\treturn nil, nil\n\t}\n\n\treturn newAllowList(k, r, handleKey)\n}\n\n// If the handleKey func returns true, the rest of the parsing is skipped\n// for this key. This allows parsing of special values like `interfaces`.\nfunc newAllowList(k string, raw any, handleKey func(key string, value any) (bool, error)) (*AllowList, error) {\n\trawMap, ok := raw.(map[string]any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"config `%s` has invalid type: %T\", k, raw)\n\t}\n\n\ttree := new(bart.Table[bool])\n\n\t// Keep track of the rules we have added for both ipv4 and ipv6\n\ttype allowListRules struct {\n\t\tfirstValue     bool\n\t\tallValuesMatch bool\n\t\tdefaultSet     bool\n\t\tallValues      bool\n\t}\n\n\trules4 := allowListRules{firstValue: true, allValuesMatch: true, defaultSet: false}\n\trules6 := allowListRules{firstValue: true, allValuesMatch: true, defaultSet: false}\n\n\tfor rawCIDR, rawValue := range rawMap {\n\t\tif handleKey != nil {\n\t\t\thandled, err := handleKey(rawCIDR, rawValue)","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/allow_list.go#L69-L105","documentation":"newAllowList parses a config key (e.g. firewall rules or allow_lists) that must be a map of CIDR/string to bool. If the raw YAML/JSON value is any other type (string, list, scalar), it returns \"config `%s` has invalid type: %T\" naming the key and the offending Go type, aborting config load.","triggerScenarios":"Defining an allow_list/firewall key as a scalar or array instead of a map — e.g. `allow_lists: local` or `groups: - a` shaped values passed into newAllowList from newAllowListFromConfig or getRemoteAllowRanges.","commonSituations":"YAML indentation mistakes collapsing a mapping into a scalar; putting a list where a map of CIDR->bool is required; accidental duplicate YAML keys overwriting a map with a string.","solutions":["Change the config key to a mapping of CIDR (or \"0.0.0.0/0\") to true/false, e.g. allow_lists: {local: {\"10.0.0.0/8\": true}}","Fix YAML indentation so the value parses as a map, not a string or list","Check for duplicate keys earlier in the file that override the intended mapping"],"exampleFix":"# before\nallow_lists:\n  local: 10.0.0.0/8\n# after\nallow_lists:\n  local:\n    10.0.0.0/8: true","handlingStrategy":"validation","validationCode":"v, ok := rawCfg[\"allow_lists\"]\nif ok {\n    if _, isMap := v.(map[string]any); !isMap {\n        return errors.New(\"allow_lists must be a map of name -> {CIDR: bool}\")\n    }\n}","typeGuard":"func isAllowListShape(raw any) bool {\n    _, ok := raw.(map[string]any)\n    return ok\n}","tryCatchPattern":"al, err := newAllowListFromConfig(name, raw)\nif err != nil {\n    if strings.Contains(err.Error(), \"has invalid type\") {\n        return fmt.Errorf(\"fix YAML: %s must be a mapping of CIDR to true/false: %w\", name, err)\n    }\n    return err\n}","preventionTips":["Write allow lists as maps of CIDR to true/false, never scalars or arrays","Run a YAML schema validator over nebula config before deploy","Beware duplicate YAML keys overwriting a mapping with a scalar","Check indentation when nesting allow_lists under other blocks"],"tags":["nebula","config","allow-list","yaml","validation"],"backgroundTag":"config-type-mismatch","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}