{"record":{"id":"7d86d917b25b50ab","repo":"cilium/cilium","slug":"error-parsing-cilium-network-policies-w","errorCode":null,"errorMessage":"Error parsing Cilium network policies: %w","messagePattern":"Error parsing Cilium network policies: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/clustermesh/clustermesh.go","lineNumber":1885,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Error parsing network policies: %w\", err)\n\t\t}\n\t\trulesLocal, err := cmk8s.ParseNetworkPolicy(logger, \"some-cluster\", &np)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Error parsing network policies: %w\", err)\n\t\t}\n\n\t\tres.NetworkPolicies[client.ObjectKeyFromObject(&np).String()] = !slices.EqualFunc(rulesAny, rulesLocal, func(a, b *types.PolicyEntry) bool { return a.DeepEqual(b) })\n\t}\n\n\tcnps, err := k8sClient.ListCiliumNetworkPolicies(ctx, namespace, metav1.ListOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Error listing Cilium network policies: %w\", err)\n\t}\n\tfor _, cnp := range cnps.Items {\n\t\trulesAny, err := cnp.Parse(logger, cmtypes.PolicyAnyCluster)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Error parsing Cilium network policies: %w\", err)\n\t\t}\n\t\trulesLocal, err := cnp.Parse(logger, \"some-cluster\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Error parsing Cilium network policies: %w\", err)\n\t\t}\n\n\t\tres.CiliumNetworkPolicies[client.ObjectKeyFromObject(&cnp).String()] = !slices.EqualFunc(rulesAny, rulesLocal, func(a, b *api.Rule) bool { return a.DeepEqual(b) })\n\t}\n\n\tif namespace == corev1.NamespaceAll {\n\t\tccnps, err := k8sClient.ListCiliumClusterwideNetworkPolicies(ctx, metav1.ListOptions{})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Error listing Cilium Cluster Wide network policies: %w\", err)\n\t\t}\n\t\tfor _, ccnp := range ccnps.Items {\n\t\t\trulesAny, err := ccnp.Parse(logger, cmtypes.PolicyAnyCluster)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"Error parsing Cilium Cluster Wide network policies: %w\", err)","sourceCodeStart":1867,"sourceCodeEnd":1903,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/clustermesh/clustermesh.go#L1867-L1903","documentation":"This error wraps a failure from cnp.Parse when parsing a CiliumNetworkPolicy with cmtypes.PolicyAnyCluster. cnp.Parse validates and converts the CNP into internal api.Rule objects; failure means the CNP content is rejected by the policy parser. The parse error is preserved via %w.","triggerScenarios":"Inside the loop over cnps.Items, cnp.Parse(logger, cmtypes.PolicyAnyCluster) returns an error for a CiliumNetworkPolicy.","commonSituations":"CNPs using features not supported by the cilium-cli version (version skew with the cluster's Cilium agent); invalid expressions (bad CIDRs, unsupported L7 rules, invalid selector syntax); CNPs written for a different Cilium schema version.","solutions":["Read the wrapped error to find the offending CNP and fix the invalid field (CIDR, selector, L7 rule)","Align cilium-cli and Cilium agent versions so the parser supports the CNP features used","Validate the CNP with 'cilium policy validate' or by checking agent logs for policy import errors"],"exampleFix":"// before (invalid CNP fragment)\nspec:\n  ingress:\n  - fromCIDR:\n    - 999.999.0.0/16\n// after\nspec:\n  ingress:\n  - fromCIDR:\n    - 10.0.0.0/16","handlingStrategy":"validation","validationCode":"# validate CNP before applying/inspecting\ncilium policy validate --cnp policy.yaml","typeGuard":"func parseSafe(cnp *ciliumv2.CiliumNetworkPolicy) bool {\n    _, err := cnp.Parse(logger, cmtypes.PolicyAnyCluster)\n    return err == nil\n}","tryCatchPattern":"rulesAny, err := cnp.Parse(logger, cmtypes.PolicyAnyCluster)\nif err != nil {\n    logger.WithError(err).Warnf(\"skipping unparsable CNP %s/%s\", cnp.Namespace, cnp.Name)\n    continue\n}","preventionTips":["Run cilium policy validate before applying CNPs","Keep cilium-cli version matched to the cluster's Cilium agent","Avoid deprecated CNP fields from older Cilium schema versions"],"tags":["cilium","cnp","parsing","network-policy"],"backgroundTag":"policy-parse-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}