{"record":{"id":"4bfb21e16696b656","repo":"cilium/cilium","slug":"failed-to-validate-cluster-q-w-s","errorCode":null,"errorMessage":"failed to validate Cluster %q (%w): %s","messagePattern":"failed to validate Cluster %q \\(%w\\): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ciliumenvoyconfig/cec_resource_parser.go","lineNumber":401,"sourceCode":"\t\t\t}\n\n\t\t\tif cluster.LoadAssignment != nil {\n\t\t\t\tqualifyEDSEndpoints(cecNamespace, cecName, cluster.LoadAssignment)\n\t\t\t}\n\n\t\t\tname := cluster.Name\n\t\t\tcluster.Name, _ = api.ResourceQualifiedName(cecNamespace, cecName, name)\n\n\t\t\t// Check for duplicate after the name has been qualified\n\t\t\tfor i := range resources.Clusters {\n\t\t\t\tif cluster.Name == resources.Clusters[i].Name {\n\t\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"duplicate Cluster name %q\", cluster.Name)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif validate {\n\t\t\t\tif err := cluster.Validate(); err != nil {\n\t\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"failed to validate Cluster %q (%w): %s\", cluster.Name, err, cluster.String())\n\t\t\t\t}\n\t\t\t}\n\t\t\tresources.Clusters[cluster.Name] = cluster\n\n\t\t\tr.logger.Debug(\"ParseResources: Parsed cluster\",\n\t\t\t\tlogfields.Name, name,\n\t\t\t\tlogfields.ResourceClusters, cluster)\n\n\t\tcase envoy.EndpointTypeURL:\n\t\t\tendpoints, ok := message.(*envoy_config_endpoint.ClusterLoadAssignment)\n\t\t\tif !ok {\n\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"invalid type for Route: %T\", message)\n\t\t\t}\n\t\t\t// Check that a Cluster name is provided\n\t\t\tif endpoints.ClusterName == \"\" {\n\t\t\t\treturn xds.Resources{}, fmt.Errorf(\"unspecified ClusterLoadAssignment cluster_name\")\n\t\t\t}\n","sourceCodeStart":383,"sourceCodeEnd":419,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ciliumenvoyconfig/cec_resource_parser.go#L383-L419","documentation":"When validation is enabled, ParseResources runs the ptypes Validate() on the fully qualified envoy Cluster and wraps any failure in this error, appending the cluster's string form for debugging. It means the cluster proto is structurally invalid per Envoy's proto constraints (missing required fields, invalid values), even though the name checks passed.","triggerScenarios":"ParseResources called with validate=true and a Cluster whose contents violate Envoy proto validation — e.g. unknown/invalid cluster type, bad connect_timeout, invalid TLS transport_socket config, or address/port mismatches. The underlying err (via %w) names the exact field.","commonSituations":"Hand-written Envoy cluster configs with typos or unsupported values; a Cilium upgrade tightening envoy validation rules; mixing fields not allowed together (e.g. static vs EDS config); filling in an invalid TransportSocket name.","solutions":["Read the wrapped inner error and the cluster dump in the message to find the offending field, then fix the cluster config in the CiliumEnvoyConfig","Run the cluster proto through the same Validate() in a unit test locally to iterate quickly","Compare against a known-good generated cluster from cilium (cilium-dbg bgp/envoy output) and align fields"],"exampleFix":"// before\ncluster := &envoy_config_cluster.Cluster{\n    Name: \"svc\",\n    ClusterDiscoveryType: envoy_config_cluster.Cluster_STATIC, // static but no load_assignment\n}\n// after\ncluster := &envoy_config_cluster.Cluster{\n    Name:                 \"svc\",\n    ClusterDiscoveryType: envoy_config_cluster.Cluster_STATIC,\n    LoadAssignment: &envoy_config_endpoint.ClusterLoadAssignment{\n        ClusterName: \"svc\",\n        Endpoints:   []*envoy_config_endpoint.LocalityLbEndpoints{{LbEndpoints: []*envoy_config_endpoint.LbEndpoint{...}}},\n    },\n}","handlingStrategy":"validation","validationCode":"for _, res := range cecResources {\n    if res.GetTypeUrl() == envoy.ClusterTypeURL {\n        var c envoy_config_cluster.Cluster\n        if err := res.UnmarshalTo(&c); err != nil { return err }\n        if err := c.Validate(); err != nil {\n            return fmt.Errorf(\"invalid cluster %q: %w\", c.GetName(), err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"res, err := parser.ParseResources(ns, name, anyResources, true, knobs)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to validate Cluster\") {\n        // surface the wrapped cause and cluster dump to the CEC status\n        return fmt.Errorf(\"CEC %s/%s rejected: %w\", ns, name, err)\n    }\n    return err\n}","preventionTips":["Run cluster protos through Validate() in CI before shipping generated configs","Match field combinations to a known-good Envoy cluster config","Re-run tests after Cilium/Envoy version upgrades since validation rules can tighten"],"tags":["cilium","envoy","xds","proto-validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}