{"record":{"id":"c0f6553d4fc1611d","repo":"cilium/cilium","slug":"cec-json-decoding-paniced-v","errorCode":null,"errorMessage":"CEC JSON decoding paniced: %v","messagePattern":"CEC JSON decoding paniced: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/k8s/apis/cilium.io/v2/cec_types.go","lineNumber":178,"sourceCode":"\n// DeepEqual returns 'true' if 'a' and 'b' are equal.\nfunc (a *XDSResource) DeepEqual(b *XDSResource) bool {\n\treturn proto.Equal(a.Any, b.Any)\n}\n\n// MarshalJSON ensures that the unstructured object produces proper\n// JSON when passed to Go's standard JSON library.\nfunc (u *XDSResource) MarshalJSON() ([]byte, error) {\n\treturn protojson.Marshal(u.Any)\n}\n\n// UnmarshalJSON ensures that the unstructured object properly decodes\n// JSON when passed to Go's standard JSON library.\nfunc (u *XDSResource) UnmarshalJSON(b []byte) (err error) {\n\t// xDS resources are not validated in K8s, recover from possible panics\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\terr = fmt.Errorf(\"CEC JSON decoding paniced: %v\", r)\n\t\t}\n\t}()\n\tu.Any = &anypb.Any{}\n\terr = protojson.Unmarshal(b, u.Any)\n\tif err != nil {\n\t\tvar buf bytes.Buffer\n\t\tjson.Indent(&buf, b, \"\", \"\\t\")\n\t\t// slogloggercheck: it's safe to use the default logger here as it has been initialized by the program up to this point.\n\t\tlogging.DefaultSlogLogger.Warn(\"Ignoring invalid CiliumEnvoyConfig JSON\",\n\t\t\tlogfields.Error, err,\n\t\t\tlogfields.Object, buf,\n\t\t)\n\t} else if option.Config.Debug {\n\t\t// slogloggercheck: it's safe to use the default logger here as it has been initialized by the program up to this point.\n\t\tlogging.DefaultSlogLogger.Debug(\"CEC unmarshaled XDS Resource\", logfields.Resource, prototext.Format(u.Any))\n\t}\n\treturn nil\n}","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/k8s/apis/cilium.io/v2/cec_types.go#L160-L196","documentation":"XDSResource.UnmarshalJSON in pkg/k8s/apis/cilium.io/v2/cec_types.go decodes CiliumEnvoyConfig xDS resources with protojson.Unmarshal into an anypb.Any. Since protojson can panic on malformed input, a deferred recover converts any panic into this 'CEC JSON decoding paniced: %v' error so the K8s decode path does not crash the process.","triggerScenarios":"A CiliumEnvoyConfig (CEC) resource is applied whose xds resource bytes are not valid protobuf JSON for anypb.Any (e.g. '@type' missing/incorrect, invalid field types), causing protojson to panic during UnmarshalJSON.","commonSituations":"Hand-writing CEC YAML/JSON with a wrong or missing @type in the Any payload; copy-pasted Envoy config that is plain Envoy JSON rather than protobuf-JSON; version mismatch where a field was renamed.","solutions":["Validate the xds resource payload is proper protobuf JSON with a correct '@type' fully-qualified Any type name (e.g. type.googleapis.com/envoy.config...)","Compare against a known-good CEC example from the cilium repo for your version and fix field names/types","Convert the Envoy config using protoc/gogo protojson marshaling instead of hand-writing JSON","Check cilium version compatibility of the resource schema and update the CEC accordingly"],"exampleFix":"// before\nresources:\n- \"@type\": envoy.config.filter...  # wrong/abbreviated type\n// after\nresources:\n- \"@type\": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\n  ...","handlingStrategy":"validation","validationCode":"// validate the Any payload before creating the CEC\nvar anyObj map[string]any\nif err := json.Unmarshal(xdsBytes, &anyObj); err != nil { return err }\nt, ok := anyObj[\"@type\"]\nif !ok || !strings.HasPrefix(t.(string), \"type.googleapis.com/\") {\n    return fmt.Errorf(\"xds resource missing valid @type\")\n}","typeGuard":"func hasValidAnyType(b []byte) bool {\n    var m struct{ Type string `json:\"@type\"` }\n    return json.Unmarshal(b, &m) == nil && strings.HasPrefix(m.Type, \"type.googleapis.com/\")\n}","tryCatchPattern":"if err := json.Unmarshal(rawCEC, &cec); err != nil {\n    if strings.HasPrefix(err.Error(), \"CEC JSON decoding paniced\") {\n        // reject resource, log payload, fix @type/protobuf-JSON\n    }\n}","preventionTips":["Always use fully-qualified @type URLs in xds Any payloads","Marshal Envoy config with protojson from generated Go types instead of hand-writing","Test CEC manifests against the target cilium version's protobuf schemas","Keep CEC examples versioned with the Envoy/cilium release"],"tags":["json","protobuf","kubernetes","envoy"],"backgroundTag":"protobuf-json-unmarshal-panic","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}