{"record":{"id":"6c11660faefbe08a","repo":"slackhq/nebula","slug":"groups-spec-s-contains-the-group-any-this-r","errorCode":null,"errorMessage":"groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified","messagePattern":"groups spec \\[(.+?)\\] contains the group '\"any\"\\. This rule will ignore the other groups specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":1027,"sourceCode":"\treturn r, nil\n}\n\n// sanity returns an error if the rule would be evaluated in a way that would short-circuit a configured check on a wildcard value\n// rules are evaluated as \"port AND proto AND (ca_sha OR ca_name) AND (host OR group OR groups OR cidr) AND local_cidr\"\nfunc (r *rule) sanity() error {\n\t//port, proto, local_cidr are AND, no need to check here\n\t//ca_sha and ca_name don't have a wildcard value, no need to check here\n\tgroupsEmpty := len(r.Groups) == 0\n\thostEmpty := r.Host == \"\"\n\tcidrEmpty := r.Cidr == \"\"\n\n\tif (groupsEmpty && hostEmpty && cidrEmpty) == true {\n\t\treturn nil //no content!\n\t}\n\n\tgroupsHasAny := slices.Contains(r.Groups, \"any\")\n\tif groupsHasAny && len(r.Groups) > 1 {\n\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the other groups specified\", r.Groups)\n\t}\n\n\tif r.Host == \"any\" {\n\t\tif !groupsEmpty {\n\t\t\treturn fmt.Errorf(\"groups specified as %s, but host=any will match any host, regardless of groups\", r.Groups)\n\t\t}\n\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"cidr specified as %s, but host=any will match any host, regardless of cidr\", r.Cidr)\n\t\t}\n\t}\n\n\tif groupsHasAny {\n\t\tif !hostEmpty && r.Host != \"any\" {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified host %s\", r.Groups, r.Host)\n\t\t}\n\t\tif !cidrEmpty {\n\t\t\treturn fmt.Errorf(\"groups spec [%s] contains the group '\\\"any\\\". This rule will ignore the specified cidr %s\", r.Groups, r.Cidr)","sourceCodeStart":1009,"sourceCodeEnd":1045,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L1009-L1045","documentation":"The special group name 'any' matches every group, so if it appears alongside other groups in one rule, the other groups are meaningless. The rule translator returns this error instead of silently ignoring the extra groups, forcing the author to write the rule unambiguously.","triggerScenarios":"A firewall rule whose groups list contains 'any' plus at least one other group, e.g. groups: ['any', 'prod'], during rule translation.","commonSituations":"Author assuming groups are ORed and trying to widen a rule by adding 'any'; templating that appends 'any' to an existing list.","solutions":["Remove 'any' and keep only the explicit groups if you want them to match","Or use groups: ['any'] alone if you truly want to match any group","Note that semantically the rule already behaves as any-group; just clean the config"],"exampleFix":"// before\ngroups: [any, prod]\n// after\ngroups: [any]","handlingStrategy":"validation","validationCode":"func checkAnyGroup(groups []string) error {\n    if slices.Contains(groups, \"any\") && len(groups) > 1 {\n        return fmt.Errorf(\"groups contains 'any' plus other groups: %v\", groups)\n    }\n    return nil\n}","typeGuard":"func isUnambiguousGroups(groups []string) bool {\n    return !(slices.Contains(groups, \"any\") && len(groups) > 1)\n}","tryCatchPattern":"if err := loadFirewallConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"contains the group\") {\n        return fmt.Errorf(\"groups=any conflicts with other selectors: %w\", err)\n    }\n    return err\n}","preventionTips":["Never add 'any' to a groups list that has other entries","Treat groups: ['any'] as a standalone construct","Lint rules for the literal group value 'any' before deploying"],"tags":["go","firewall","config","groups"],"backgroundTag":"firewall-rule-invalid","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}