{"record":{"id":"0fb3bdc70fcc217d","repo":"istio/istio","slug":"max-retries-must-be-non-negative","errorCode":null,"errorMessage":"max retries must be non-negative","messagePattern":"max retries must be non-negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/validation/agent/validation.go","lineNumber":881,"sourceCode":"\tif dtp == nil {\n\t\treturn errs\n\t}\n\tif cp := dtp.GetConnectionPool(); cp != nil {\n\t\tif cp.Http == nil && cp.Tcp == nil {\n\t\t\terrs = AppendValidation(errs, errors.New(\"connection pool must have at least one field\"))\n\t\t}\n\t\tif http := cp.Http; http != nil {\n\t\t\tif http.Http1MaxPendingRequests < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"http1 max pending requests must be non-negative\"))\n\t\t\t}\n\t\t\tif http.Http2MaxRequests < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"http2 max requests must be non-negative\"))\n\t\t\t}\n\t\t\tif http.MaxRequestsPerConnection < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max requests per connection must be non-negative\"))\n\t\t\t}\n\t\t\tif http.MaxRetries < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max retries must be non-negative\"))\n\t\t\t}\n\t\t\tif http.MaxConcurrentStreams < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max concurrent streams must be non-negative\"))\n\t\t\t}\n\t\t\tif http.IdleTimeout != nil {\n\t\t\t\terrs = AppendValidation(errs, ValidateDuration(http.IdleTimeout))\n\t\t\t}\n\t\t\tif http.H2UpgradePolicy == networking.ConnectionPoolSettings_HTTPSettings_UPGRADE && http.UseClientProtocol {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"use client protocol must not be true when H2UpgradePolicy is UPGRADE\"))\n\t\t\t}\n\t\t}\n\t\tif tcp := cp.Tcp; tcp != nil {\n\t\t\tif tcp.MaxConnections < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max connections must be non-negative\"))\n\t\t\t}\n\t\t\tif tcp.ConnectTimeout != nil {\n\t\t\t\terrs = AppendValidation(errs, ValidateDuration(tcp.ConnectTimeout))\n\t\t\t}","sourceCodeStart":863,"sourceCodeEnd":899,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pkg/config/validation/agent/validation.go#L863-L899","documentation":"Thrown by validateMeshConfigDefaultTrafficPolicy when mesh.defaultTrafficPolicy.connectionPool.http.maxRetries is negative. The mesh-wide baseline retry ceiling must be a non-negative count; a negative value signals a config error (not a valid way to disable retries — omit or zero it instead).","triggerScenarios":"`defaultTrafficPolicy: {connectionPool: {http: {maxRetries: -3}}}` passing through ValidateMeshConfig's defaultTrafficPolicy validation.","commonSituations":"Users trying to disable retries with -1; Helm arithmetic producing negatives; env-var-sourced values parsed without bounds checking.","solutions":["Set maxRetries to >= 0, or remove the field to keep Envoy/Istio defaults.","To minimize retries, set it to 0 rather than negative.","Add value clamping in whatever generates the config."],"exampleFix":"# before\ndefaultTrafficPolicy:\n  connectionPool:\n    http:\n      maxRetries: -1\n\n# after\ndefaultTrafficPolicy:\n  connectionPool:\n    http:\n      maxRetries: 0","handlingStrategy":"validation","validationCode":"if http := dtp.GetConnectionPool().GetHttp(); http != nil && http.GetMaxRetries() < 0 {\n    return fmt.Errorf(\"maxRetries must be >= 0; use 0 to disable retries\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["To disable mesh-baseline retries set maxRetries: 0, not a negative sentinel.","Schema-check for minimum: 0 on all connection-pool integer fields."],"tags":["istio","mesh-config","traffic-policy","connection-pool","retries","validation","go"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}