{"record":{"id":"2f0fda112572653c","repo":"cilium/cilium","slug":"failed-to-de-serialize-json-w","errorCode":null,"errorMessage":"Failed to de-serialize json: %w","messagePattern":"Failed to de-serialize json: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ipmasq/ipmasq.go","lineNumber":259,"sourceCode":"\t\t\treturn true, nil\n\t\t}\n\t\treturn false, fmt.Errorf(\"Failed to read %s: %w\", a.configPath, err)\n\t}\n\n\tif len(raw) == 0 {\n\t\ta.nonMasqCIDRsFromConfig = map[string]netip.Prefix{}\n\t\ta.masqLinkLocalIPv4 = false\n\t\ta.masqLinkLocalIPv6 = false\n\t\treturn true, nil\n\t}\n\n\tjsonStr, err := yaml.ToJSON(raw)\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"Failed to convert to json: %w\", err)\n\t}\n\n\tif err := json.Unmarshal(jsonStr, &cfg); err != nil {\n\t\treturn false, fmt.Errorf(\"Failed to de-serialize json: %w\", err)\n\t}\n\n\tnonMasqCIDRs := map[string]netip.Prefix{}\n\tfor _, cidr := range cfg.NonMasqCIDRs {\n\t\tn := netip.Prefix(cidr)\n\t\tnonMasqCIDRs[n.String()] = n\n\t}\n\ta.nonMasqCIDRsFromConfig = nonMasqCIDRs\n\ta.masqLinkLocalIPv4 = cfg.MasqLinkLocalIPv4\n\ta.masqLinkLocalIPv6 = cfg.MasqLinkLocalIPv6\n\n\treturn false, nil\n}\n\nfunc (a *IPMasqAgent) NonMasqCIDRsFromConfig() []netip.Prefix {\n\treturn slices.Collect(maps.Values(a.nonMasqCIDRsFromConfig))\n}\n","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ipmasq/ipmasq.go#L241-L277","documentation":"readConfig in pkg/ipmasq/ipmasq.go converts the ip-masq-agent YAML config to JSON via yaml.ToJSON, then json.Unmarshal into the config struct. This error wraps any json.Unmarshal failure, meaning the (converted) config is not valid JSON for the expected config struct shape. It is thrown so the caller (update, via Start) can log and skip applying a bad config rather than corrupting the BPF masquerade map.","triggerScenarios":"The ip-masq-agent config file mounted at the config path contains YAML that converts to JSON but fails schema/type validation during json.Unmarshal into cfg (e.g. wrong field types, unknown structure mismatch, malformed JSON).","commonSituations":"Users hand-edit the ConfigMap and mis-indent or type a CIDR field as a number/string mismatch; a stale or partially-written config file is read; a config written for a different agent version is mounted into the pod.","solutions":["Fix the YAML/JSON config file so it unmarshals into the expected ipmasq config struct (correct types, valid CIDRs in NonMasqCIDRs)","Validate the config locally (convert with yaml.ToJSON / json.Unmarshal in a scratch program or jq) before mounting it","Check pod logs for the wrapped %w error to identify the exact JSON offset/field causing the failure","Redeploy the correct upstream ip-masq-agent config example for your cilium version"],"exampleFix":"// before (bad config)\nnon-masquerade-cidrs: 10.0.0.0/8\n// after\ncidr:\n  nonMasqCIDRs:\n    - 10.0.0.0/8","handlingStrategy":"validation","validationCode":"jsonStr, err := yaml.ToJSON(raw)\nif err != nil { return err }\nvar cfg ipmasqConfig\nif err := json.Unmarshal(jsonStr, &cfg); err != nil {\n    return fmt.Errorf(\"invalid ipmasq config: %w\", err)\n}\nfor _, c := range cfg.NonMasqCIDRs {\n    if _, err := netip.ParsePrefix(string(c)); err != nil { return err }\n}","typeGuard":"func validIPMasqConfig(b []byte) (*ipmasqConfig, error) {\n    var cfg ipmasqConfig\n    if err := json.Unmarshal(b, &cfg); err != nil { return nil, err }\n    return &cfg, nil\n}","tryCatchPattern":null,"preventionTips":["Lint the ConfigMap YAML before applying (yamllint + schema check)","Validate CIDR syntax in CI for NonMasqCIDRs entries","Pin and test config examples against the cilium version in use","Check agent logs for the wrapped json error after each config change"],"tags":["yaml","json","config","ipmasq"],"backgroundTag":"config-deserialization-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}