{"record":{"id":"48eb77bdba38fd13","repo":"crowdsecurity/crowdsec","slug":"cannot-create-s-reader","errorCode":null,"errorMessage":"cannot create %s reader","messagePattern":"cannot create (.+?) reader","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kafka/config.go","lineNumber":94,"sourceCode":"\ts.logger.Debugf(\"start configuring %s source\", s.GetName())\n\n\terr := s.UnmarshalConfig(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdialer, err := s.Config.NewDialer()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot create %s dialer: %w\", s.GetName(), err)\n\t}\n\n\ts.Reader, err = s.Config.NewReader(dialer, s.logger)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannote create %s reader: %w\", s.GetName(), err)\n\t}\n\n\tif s.Reader == nil {\n\t\treturn fmt.Errorf(\"cannot create %s reader\", s.GetName())\n\t}\n\n\ts.logger.Debugf(\"successfully configured %s source\", s.GetName())\n\n\treturn nil\n}\n\nfunc (c *Configuration) NewTLSConfig() (*tls.Config, error) {\n\ttlsConfig := tls.Config{\n\t\tInsecureSkipVerify: c.TLS.InsecureSkipVerify,\n\t}\n\n\tcert, err := tls.LoadX509KeyPair(c.TLS.ClientCert, c.TLS.ClientKey)\n\tif err != nil {\n\t\treturn &tlsConfig, err\n\t}\n\n\ttlsConfig.Certificates = []tls.Certificate{cert}","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kafka/config.go#L76-L112","documentation":"Defensive check in Configure(): kafka.NewReader(rConf) returned a nil *kafka.Reader even without an error, so the source cannot operate. In practice kafka.NewReader always returns a non-nil reader for a validated config, so this is an internal invariant violation — the meaningful nil path returns an empty &kafka.Reader{} earlier, which is non-nil, making this branch mostly unreachable defensive code.","triggerScenarios":"Only when Config.NewReader returns (nil, nil) — an unexpected state in the kafka acquisition Configure() path; not triggered by any user configuration value directly.","commonSituations":"Essentially never seen in the wild; a developer debugging the kafka datasource module after modifying NewReader might hit it. There is no wrapped cause, so diagnosis requires inspecting NewReader.","solutions":["Inspect Configuration.NewReader in pkg/acquisition/modules/kafka/config.go to find why it returned a nil reader with nil error","Ensure all error paths in NewReader return either a valid reader or a non-nil error","Re-run crowdsec with debug logging on the kafka datasource to trace configuration"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"if src.Reader == nil {\n    return fmt.Errorf(\"kafka reader was not initialized\")\n}","tryCatchPattern":"if err := src.Configure(ctx, yamlCfg, logger, lvl); err != nil {\n    return fmt.Errorf(\"kafka reader init invariant failed: %w\", err)\n}","preventionTips":["Keep NewReader's error paths returning non-nil errors with every return","Add a unit test asserting NewReader never returns (nil, nil)"],"tags":["kafka","invariant","crowdsec"],"backgroundTag":"internal-invariant-violation","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}