{"record":{"id":"270d4eb5ea72a7fa","repo":"cilium/cilium","slug":"failed-to-validate-listener-w-s","errorCode":null,"errorMessage":"failed to validate Listener (%w): %s","messagePattern":"failed to validate Listener \\(%w\\): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ciliumenvoyconfig/cec_resource_parser.go","lineNumber":315,"sourceCode":"\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tbreak // Done with this filter chain\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tname := listener.Name\n\t\t\tlistener.Name, _ = api.ResourceQualifiedName(cecNamespace, cecName, listener.Name, api.ForceNamespace)\n\n\t\t\t// Check for duplicate after the name has been qualified\n\t\t\tfor i := range resources.Listeners {\n\t\t\t\tif listener.Name == resources.Listeners[i].Name {\n\t\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"duplicate Listener name %q\", listener.Name)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif validate {\n\t\t\t\tif err := listener.Validate(); err != nil {\n\t\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"failed to validate Listener (%w): %s\", err, listener.String())\n\t\t\t\t}\n\t\t\t}\n\t\t\tresources.Listeners[listener.Name] = listener\n\n\t\t\tr.logger.Debug(\"ParseResources: Parsed listener\",\n\t\t\t\tlogfields.Name, name,\n\t\t\t\tlogfields.Listener, listener)\n\n\t\tcase envoy.RouteTypeURL:\n\t\t\troute, ok := message.(*envoy_config_route.RouteConfiguration)\n\t\t\tif !ok {\n\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"invalid type for Route: %T\", message)\n\t\t\t}\n\t\t\t// Check that a Route name is provided\n\t\t\tif route.Name == \"\" {\n\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"unspecified RouteConfiguration name\")\n\t\t\t}\n","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ciliumenvoyconfig/cec_resource_parser.go#L297-L333","documentation":"When the validate flag is set (parsing of new, not-yet-applied resources), ParseResources calls listener.Validate() — the envoy protobuf validate (PGV) method enforcing Envoy constraints such as required address, filter config validity, and SO_REUSEPORT rules for BPF TPROXY mode. Any PGV failure is wrapped as 'failed to validate Listener (...)' together with the full listener proto string for debugging.","triggerScenarios":"Calling ParseResources (with newResources=true) on a Listener that violates envoy protobuf validation: e.g. empty required fields, invalid filter chain config, or reuse_port enabled on a non-internal listener while enableBPFTProxy is active with mismatched settings.","commonSituations":"Invalid CiliumEnvoyConfig submitted by a user (missing address, malformed filter typed config), Envoy API version drift making fields invalid, or SO_REUSEPORT incompatibility when BPF TPROXY is enabled.","solutions":["Read the wrapped (%w) inner validation error and the listener string in the message to see the exact violated field; fix that field in the CEC.","Ensure required listener fields (name, address or internal_listener, filter chains) are present and well-formed.","If using BPF TPROXY (enableBPFTProxy), either mark the listener internal or let the parser disable reuse_port; do not set EnableReusePort=true on a socket-binding listener.","Align the envoy config dependency versions with the Cilium version so validation proto rules match.","Run the CEC through CiliumEnvoyConfigValidation-style checks locally before applying."],"exampleFix":"// before\nlistener := &envoy_config_listener.Listener{Name: \"x\"} // no address, no filter chains\n// after\nlistener := &envoy_config_listener.Listener{Name: \"x\", Address: socketAddr, FilterChains: chains}","handlingStrategy":"validation","validationCode":"for _, l := range cec.Listeners {\n\tmsg := toListenerProto(l)\n\tif err := msg.Validate(); err != nil {\n\t\treturn fmt.Errorf(\"listener %q fails envoy validation: %w\", l.Name, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"res, err := parser.ParseResources(ns, name, xdsResources, inject, logger, validate, hdrs)\nif err != nil {\n\tvar verr error\n\tif errors.As(err, &verr) && strings.HasPrefix(err.Error(), \"failed to validate Listener\") {\n\t\t// parse inner %w validation error and listener string from message to fix config\n\t}\n\treturn err\n}","preventionTips":["Call protovalidate/PGV Validate() on listeners in your own pipeline before submitting the CEC.","Provide required fields: address or internal_listener, and at least one valid filter chain.","Do not set EnableReusePort=true on socket-binding listeners when BPF TPROXY is enabled.","Pin envoy config-go versions to match the cilium release.","Test new CEC configs with the validation tests (e.g. TestCiliumEnvoyConfigValidation) before rollout."],"tags":["envoy","validation","configuration"],"backgroundTag":"envoy-resource-validation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}