{"record":{"id":"37a1b13a392e6896","repo":"istio/istio","slug":"invalid-path-must-be-in-form-of-regex-pattern-v","errorCode":null,"errorMessage":"invalid path, must be in form of regex pattern %v","messagePattern":"invalid path, must be in form of regex pattern (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pilot/cmd/pilot-agent/status/server.go","lineNumber":395,"sourceCode":"// * If we exceed 10 redirects, the probe fails\n// * If we redirect somewhere external, the probe succeeds (https://github.com/kubernetes/kubernetes/blob/b152001f459/pkg/probe/http/http.go#L130)\n// * If we redirect to the same address, the probe will follow the redirect\nfunc redirectChecker() func(*http.Request, []*http.Request) error {\n\treturn func(req *http.Request, via []*http.Request) error {\n\t\tif req.URL.Hostname() != via[0].URL.Hostname() {\n\t\t\treturn http.ErrUseLastResponse\n\t\t}\n\t\t// Default behavior: stop after 10 redirects.\n\t\tif len(via) >= 10 {\n\t\t\treturn errors.New(\"stopped after 10 redirects\")\n\t\t}\n\t\treturn nil\n\t}\n}\n\nfunc validateAppKubeProber(path string, prober *Prober) error {\n\tif !appProberPattern.MatchString(path) {\n\t\treturn fmt.Errorf(`invalid path, must be in form of regex pattern %v`, appProberPattern)\n\t}\n\tcount := 0\n\tif prober.HTTPGet != nil {\n\t\tcount++\n\t}\n\tif prober.TCPSocket != nil {\n\t\tcount++\n\t}\n\tif prober.GRPC != nil {\n\t\tcount++\n\t}\n\tif count != 1 {\n\t\treturn fmt.Errorf(`invalid prober type, must be one of type httpGet, tcpSocket or gRPC`)\n\t}\n\tif prober.HTTPGet != nil && prober.HTTPGet.Port.Type != apimirror.Int {\n\t\treturn fmt.Errorf(\"invalid prober config for %v, the port must be int type\", path)\n\t}\n\tif prober.TCPSocket != nil && prober.TCPSocket.Port.Type != apimirror.Int {","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/pilot/cmd/pilot-agent/status/server.go#L377-L413","documentation":"validateAppKubeProber rejects a prober map key (URL path) that does not match appProberPattern: ^/(app-health|app-lifecycle)/[^/]+/(livez|readyz|startupz|prestopz|poststartz)$. The agent only serves taken-over Kubernetes probes on these exact URL shapes (container name between fixed segments, one of the five probe verbs), because these paths are what kubelet is reconfigured to call.","triggerScenarios":"A key in the decoded KubeAppProbers map like \"/healthz\", \"/app-health/myapp/notaverb\", or \"/app-health/a/b/readyz\" (two path segments in the container slot) fails MatchString during NewServer validation.","commonSituations":"Custom injectors or tools writing the probers annotation/env themselves instead of using FormatProberURL; version skew where an older injector emitted a different URL scheme than the agent's regex expects; manual editing of injected JSON with a 'cleaned up' path.","solutions":["Regenerate paths with FormatProberURL(container) — it emits exactly the five accepted URLs (readyz, livez, startupz, prestopz, poststartz)","Fix the offending key to match /(app-health|app-lifecycle)/<container>/<verb> with a single non-slash container segment","Re-inject the workload with the matching Istio revision instead of crafting the JSON by hand","Check for other mutating webhooks rewriting the injected JSON"],"exampleFix":"// before (hand-written probers map key)\n{\"/healthz/myapp\": {\"httpGet\": {\"path\": \"/\", \"port\": 8080}}}\n// after (use the agent's own URL formatter)\npath, _, _, _, _ := FormatProberURL(\"myapp\") // \"/app-health/myapp/readyz\"\nprobers := map[string]*Prober{path: {HTTPGet: &HTTPGetAction{Path: \"/\", Port: 8080}}}","handlingStrategy":"validation","validationCode":"// Only emit paths the agent accepts: derive them from FormatProberURL\nvar appProberPattern = regexp.MustCompile(`^/(app-health|app-lifecycle)/[^/]+/(livez|readyz|startupz|prestopz|poststartz)$`)\nfor path := range probers {\n    if !appProberPattern.MatchString(path) {\n        return fmt.Errorf(\"bad prober path %q\", path)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always construct prober map keys via FormatProberURL(container) instead of by hand","Reject hand-written probers config in code review"],"tags":["istio","regex","validation","kubernetes-probes","injection"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}