{"record":{"id":"2ea355fdcb4afa20","repo":"istio/istio","slug":"http1-max-pending-requests-must-be-non-negative","errorCode":null,"errorMessage":"http1 max pending requests must be non-negative","messagePattern":"http1 max pending requests must be non-negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/validation/agent/validation.go","lineNumber":872,"sourceCode":"\t\tv = AppendWarningf(v, \"detected duplicate ECDH curves: %v\", sets.SortedList(duplicateECDHCurves))\n\t}\n\treturn v\n}\n\n// validateMeshConfigDefaultTrafficPolicy validates the value constraints of the mesh-wide\n// baseline traffic policy. It mirrors the connectionPool / outlierDetection checks applied to\n// a DestinationRule traffic policy, since the field reuses the same sub-types.\nfunc validateMeshConfigDefaultTrafficPolicy(dtp *meshconfig.MeshConfig_DefaultTrafficPolicy) (errs Validation) {\n\tif dtp == nil {\n\t\treturn errs\n\t}\n\tif cp := dtp.GetConnectionPool(); cp != nil {\n\t\tif cp.Http == nil && cp.Tcp == nil {\n\t\t\terrs = AppendValidation(errs, errors.New(\"connection pool must have at least one field\"))\n\t\t}\n\t\tif http := cp.Http; http != nil {\n\t\t\tif http.Http1MaxPendingRequests < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"http1 max pending requests must be non-negative\"))\n\t\t\t}\n\t\t\tif http.Http2MaxRequests < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"http2 max requests must be non-negative\"))\n\t\t\t}\n\t\t\tif http.MaxRequestsPerConnection < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max requests per connection must be non-negative\"))\n\t\t\t}\n\t\t\tif http.MaxRetries < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max retries must be non-negative\"))\n\t\t\t}\n\t\t\tif http.MaxConcurrentStreams < 0 {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"max concurrent streams must be non-negative\"))\n\t\t\t}\n\t\t\tif http.IdleTimeout != nil {\n\t\t\t\terrs = AppendValidation(errs, ValidateDuration(http.IdleTimeout))\n\t\t\t}\n\t\t\tif http.H2UpgradePolicy == networking.ConnectionPoolSettings_HTTPSettings_UPGRADE && http.UseClientProtocol {\n\t\t\t\terrs = AppendValidation(errs, errors.New(\"use client protocol must not be true when H2UpgradePolicy is UPGRADE\"))","sourceCodeStart":854,"sourceCodeEnd":890,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pkg/config/validation/agent/validation.go#L854-L890","documentation":"Thrown by validateMeshConfigDefaultTrafficPolicy when mesh.defaultTrafficPolicy.connectionPool.http.http1MaxPendingRequests is negative. Pending-request ceilings are Envoy uint32-style bounds; negative values are meaningless and indicate a config or template bug rather than a tuning choice.","triggerScenarios":"`defaultTrafficPolicy: {connectionPool: {http: {http1MaxPendingRequests: -1}}}` validated via ValidateMeshConfig (line 1070).","commonSituations":"Template arithmetic producing negative numbers (e.g. 'replicas - 5' with replicas < 5); sentinel values like -1 intended to mean 'unlimited'; YAML unmarshalling a computed value.","solutions":["Set http1MaxPendingRequests to a non-negative integer; use a large value (or omit the field) for effectively-unlimited.","Fix the templating/arith that produced the negative number; add a min-clamp or schema check in CI.","Re-run mesh config validation."],"exampleFix":"# before\ndefaultTrafficPolicy:\n  connectionPool:\n    http:\n      http1MaxPendingRequests: -1\n\n# after\ndefaultTrafficPolicy:\n  connectionPool:\n    http:\n      http1MaxPendingRequests: 1024","handlingStrategy":"validation","validationCode":"func nonNeg(v int32) error { if v < 0 { return fmt.Errorf(\"negative value %d not allowed\", v) }; return nil }\n// apply to dtp.GetConnectionPool().GetHttp().GetHttp1MaxPendingRequests()","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Clamp all rendered traffic-policy numbers to >= 0 in templates.","Use omission (not -1) to express 'unlimited'.","Add cue/jsonschema minimum: 0 constraints for these fields."],"tags":["istio","mesh-config","traffic-policy","connection-pool","http","validation","go"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}