{"record":{"id":"2ad84c0754684826","repo":"cloudflare/cloudflared","slug":"validation-failed","errorCode":null,"errorMessage":"Validation failed","messagePattern":"Validation failed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/ingress_subcommands.go","lineNumber":89,"sourceCode":"\t\tUsageText: \"cloudflared tunnel [--config FILEPATH] ingress rule URL\",\n\t\tArgsUsage: \"URL\",\n\t\tDescription: \"Check which ingress rule matches a given request URL. \" +\n\t\t\t\"Ingress rules match a request's hostname and path. Hostname is \" +\n\t\t\t\"optional and is either a full hostname like `www.example.com` or a \" +\n\t\t\t\"hostname with a `*` for its subdomains, e.g. `*.example.com`. Path \" +\n\t\t\t\"is optional and matches a regular expression, like `/[a-zA-Z0-9_]+.html`\",\n\t}\n}\n\n// validateIngressCommand check the syntax of the ingress rules in the cloudflared config file\nfunc validateIngressCommand(c *cli.Context, warnings string) error {\n\tconf, err := getConfiguration(c)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif _, err := ingress.ParseIngress(conf); err != nil {\n\t\treturn errors.Wrap(err, \"Validation failed\")\n\t}\n\tif c.IsSet(\"url\") {\n\t\treturn ingress.ErrURLIncompatibleWithIngress\n\t}\n\tif warnings != \"\" {\n\t\tfmt.Println(\"Warning: unused keys detected in your config file. Here is a list of unused keys:\")\n\t\tfmt.Println(warnings)\n\t\treturn nil\n\t}\n\tfmt.Println(\"OK\")\n\treturn nil\n}\n\nfunc getConfiguration(c *cli.Context) (*config.Configuration, error) {\n\tvar conf *config.Configuration\n\tif c.IsSet(ingressDataJSONFlagName) {\n\t\tingressJSON := c.String(ingressDataJSONFlagName)\n\t\tfmt.Println(\"Validating rules from cmdline flag --json\")","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/ingress_subcommands.go#L71-L107","documentation":"`cloudflared tunnel ingress validate` parses the ingress rules from the config file plus CLI flags via ingress.ParseIngress. Any rule error (bad URL, malformed service, invalid rule fields) is wrapped as 'Validation failed'. The command also rejects combining --url with ingress rules.","triggerScenarios":"Running `cloudflared tunnel ingress validate` with a config file whose ingress section contains a malformed rule, or passing --url together with ingress rules in the config.","commonSituations":"YAML ingress entries missing 'service', invalid hostname patterns, unreachable service URLs like typo'd schemes, mixing --url flag with an ingress block, indentation mistakes in the config.","solutions":["Read the wrapped inner error; it names the offending rule/line in the config.","Fix the ingress rule syntax: each rule needs hostname + service, with the catch-all '- service: http_status:404' last.","Remove the --url flag when using ingress rules (they are mutually exclusive).","Validate the YAML structure/indentation of the ingress section."],"exampleFix":"// before (config.yml)\ningress:\n  - hostname: app.example.com\n// missing service and catch-all\n// after\ningress:\n  - hostname: app.example.com\n    service: http://localhost:8080\n  - service: http_status:404","handlingStrategy":"validation","validationCode":"// sanity-check ingress config before validating\ndef checkIngress(cfg map[string]interface{}) error {\n\tingress, ok := cfg[\"ingress\"].([]interface{})\n\tif !ok || len(ingress) == 0 { return errors.New(\"no ingress rules\") }\n\tlast, _ := ingress[len(ingress)-1].(map[string]interface{})\n\tif _, ok := last[\"service\"]; !ok { return errors.New(\"missing catch-all rule\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := ingress.ParseIngress(conf); err != nil {\n\treturn errors.Wrap(err, \"Validation failed\")\n}","preventionTips":["End every ingress list with the catch-all `- service: http_status:404`","Never combine --url with an ingress block","Run `cloudflared tunnel ingress validate` after every config edit","Use consistent YAML indentation (2 spaces) in config.yml"],"tags":["cli","ingress","validation","yaml"],"backgroundTag":"schema-validation-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}