{"record":{"id":"2deb107c0a36e5c3","repo":"cilium/cilium","slug":"only-one-of-hubble-redact-http-headers-allow-and","errorCode":null,"errorMessage":"Only one of --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny can be specified, not both","messagePattern":"Only one of --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny can be specified, not both","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hubble/parser/cell/config.go","lineNumber":47,"sourceCode":"\tRedactHttpHeadersAllow []string `mapstructure:\"hubble-redact-http-headers-allow\"`\n\t// RedactHttpHeadersDeny controls which http headers will be redacted from\n\t// flows.\n\tRedactHttpHeadersDeny []string `mapstructure:\"hubble-redact-http-headers-deny\"`\n}\n\nvar defaultConfig = config{\n\tSkipUnknownCGroupIDs:           true,\n\tEnableNetworkPolicyCorrelation: true,\n\tEnableRedact:                   false,\n\tRedactHttpURLQuery:             false,\n\tRedactHttpUserInfo:             true,\n\tRedactHttpHeadersAllow:         []string{},\n\tRedactHttpHeadersDeny:          []string{},\n}\n\nfunc (cfg config) validate() error {\n\tif len(cfg.RedactHttpHeadersAllow) > 0 && len(cfg.RedactHttpHeadersDeny) > 0 {\n\t\treturn fmt.Errorf(\"Only one of --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny can be specified, not both\")\n\t}\n\treturn nil\n}\n\nfunc (def config) Flags(flags *pflag.FlagSet) {\n\tflags.Bool(\"hubble-skip-unknown-cgroup-ids\", def.SkipUnknownCGroupIDs, \"Skip Hubble events with unknown cgroup ids\")\n\t// Hubble field redaction configuration\n\tflags.Bool(\"hubble-redact-enabled\", def.EnableRedact, \"Hubble redact sensitive information from flows\")\n\tflags.Bool(\"hubble-redact-http-urlquery\", def.RedactHttpURLQuery, \"Hubble redact http URL query from flows\")\n\tflags.Bool(\"hubble-redact-http-userinfo\", def.RedactHttpUserInfo, \"Hubble redact http user info from flows\")\n\tflags.StringSlice(\"hubble-redact-http-headers-allow\", def.RedactHttpHeadersAllow, \"HTTP headers to keep visible in flows\")\n\tflags.StringSlice(\"hubble-redact-http-headers-deny\", def.RedactHttpHeadersDeny, \"HTTP headers to redact from flows\")\n\tflags.Bool(\"hubble-network-policy-correlation-enabled\", def.EnableNetworkPolicyCorrelation, \"Enable network policy correlation of Hubble flows\")\n}\n","sourceCodeStart":29,"sourceCodeEnd":62,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/hubble/parser/cell/config.go#L29-L62","documentation":"Hubble's parser cell config validation rejects enabling both --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny at once, because header redaction supports either an allowlist or a denylist mode, not both simultaneously. validate() at pkg/hubble/parser/cell/config.go:47 returns this error when both lists are non-empty. The error surfaces at agent startup when the cell is instantiated.","triggerScenarios":"Starting the agent (or building the Hubble cell) with both hubble-redact-http-headers-allow and hubble-redact-http-headers-deny set to non-empty values in the config, flags, or Helm values.","commonSituations":"Merging Helm/ConfigMap values where two operators each set a different redaction flag; leftover flags from a previous configuration combined with new ones; copy-pasting example configs containing both options.","solutions":["Remove one of the two flags so only the allow list or only the deny list remains","If you need denylist behavior, clear --hubble-redact-http-headers-allow and vice versa","Audit your Helm values/ConfigMap merge to ensure only one redaction key is set"],"exampleFix":"// before\n--hubble-redact-http-headers-allow=Authorization\n--hubble-redact-http-headers-deny=Cookie\n// after\n--hubble-redact-http-headers-deny=Cookie","handlingStrategy":"validation","validationCode":"allowSet := cfg.RedactHttpHeadersAllow != nil && len(cfg.RedactHttpHeadersAllow) > 0\ndenySet := len(cfg.RedactHttpHeadersDeny) > 0\nif allowSet && denySet {\n    return errors.New(\"set only one of hubble-redact-http-headers-allow or -deny\")\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.validate(); err != nil {\n    log.WithError(err).Fatal(\"invalid hubble parser config\")\n}","preventionTips":["Set at most one of the two redaction flags in Helm values/ConfigMaps","Template your Helm chart so allow and deny keys are mutually exclusive","Validate flags in CI before deploying agent config"],"tags":["cilium","hubble","configuration","validation"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}