{"record":{"id":"954815d28555662c","repo":"crowdsecurity/crowdsec","slug":"listen-port-cannot-be-empty","errorCode":null,"errorMessage":"listen_port cannot be empty","messagePattern":"listen_port cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kubernetesaudit/config.go","lineNumber":72,"sourceCode":"\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\tcfg, err := ConfigurationFromYAML(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\ts.config = cfg\n\n\treturn nil\n}\n\nfunc (c *Configuration) Validate() error {\n\tif c.ListenAddr == \"\" {\n\t\treturn errors.New(\"listen_addr cannot be empty\")\n\t}\n\n\tif c.ListenPort == 0 {\n\t\treturn errors.New(\"listen_port cannot be empty\")\n\t}\n\n\tif c.WebhookPath == \"\" {\n\t\treturn errors.New(\"webhook_path cannot be empty\")\n\t}\n\n\tif c.MaxBodySize != nil && *c.MaxBodySize <= 0 {\n\t\treturn errors.New(\"max_body_size must be positive\")\n\t}\n\n\treturn nil\n}\n\n\nfunc (c *Configuration) Normalize() {\n\tif c.WebhookPath != \"\" && c.WebhookPath[0] != '/' {\n\t\tc.WebhookPath = \"/\" + c.WebhookPath\n\t}","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kubernetesaudit/config.go#L54-L90","documentation":"The kubernetesaudit source's webhook HTTP server needs a TCP port to listen on. Configuration.Validate() rejects ListenPort == 0 because port 0 would mean an OS-assigned ephemeral port that the Kubernetes API server's audit webhook configuration could never target reliably.","triggerScenarios":"Calling Validate() on a kubernetesaudit Configuration where ListenPort is 0 (unset) — a YAML config missing `listen_port:` or setting it to 0.","commonSituations":"Users specify listen_addr but forget listen_port, or a templated port variable resolves to 0/empty and Go's zero-value default kicks in.","solutions":["Set listen_port to a fixed port (e.g. listen_port: 8080) that matches the audit sink URL configured in the Kubernetes API server.","Make sure the port is not already in use and is reachable from the API server.","Update the cluster's audit policy/webhook backend URL to use the same host:port."],"exampleFix":"// before (yaml)\nsource: kubernetesaudit\nlisten_addr: 0.0.0.0\n\n// after (yaml)\nsource: kubernetesaudit\nlisten_addr: 0.0.0.0\nlisten_port: 8080","handlingStrategy":"validation","validationCode":"if cfg.ListenPort == 0 {\n    return fmt.Errorf(\"kubernetesaudit: listen_port is required and must be non-zero\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin a fixed port and reference the same port in the API server audit sink URL.","Check port availability with `ss -ltn` before assigning.","Never leave port templated to an empty/zero value."],"tags":["kubernetes","audit","config-validation","webhook"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}