{"record":{"id":"c9d3ff19267d0445","repo":"cilium/cilium","slug":"ztunnel-endpoint-event-channel-buffer-size-must-be","errorCode":null,"errorMessage":"ztunnel-endpoint-event-channel-buffer-size must be non-negative, got %d","messagePattern":"ztunnel-endpoint-event-channel-buffer-size must be non-negative, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ztunnel/config/config.go","lineNumber":33,"sourceCode":"}\n\n// Config is a shared config for all ZTunnel module's cells.\n// Note: The operator reads EnableZTunnel directly from the ConfigMap,\n// while the agent uses this Config struct for dependency injection.\ntype Config struct {\n\tEnableZTunnel                  bool\n\tEndpointEventChannelBufferSize int `mapstructure:\"ztunnel-endpoint-event-channel-buffer-size\"`\n}\n\nfunc (c Config) Flags(flags *pflag.FlagSet) {\n\tflags.Bool(\"enable-ztunnel\", false, \"Use zTunnel as Cilium's encryption infrastructure\")\n\tflags.Int(\"ztunnel-endpoint-event-channel-buffer-size\", 1, \"Buffer size for the ztunnel endpoint event channel\")\n\tflags.MarkHidden(\"ztunnel-endpoint-event-channel-buffer-size\")\n}\n\nfunc (c Config) Validate() error {\n\tif c.EndpointEventChannelBufferSize < 0 {\n\t\treturn fmt.Errorf(\"ztunnel-endpoint-event-channel-buffer-size must be non-negative, got %d\", c.EndpointEventChannelBufferSize)\n\t}\n\treturn nil\n}\n","sourceCodeStart":15,"sourceCodeEnd":37,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ztunnel/config/config.go#L15-L37","documentation":"Config.Validate enforces that the hidden tuning flag ztunnel-endpoint-event-channel-buffer-size is not negative. The value is a Go channel buffer size for endpoint events; a negative number is meaningless and would panic on channel creation downstream, so it is rejected during config validation with the offending value included.","triggerScenarios":"Starting the agent with --ztunnel-endpoint-event-channel-buffer-size set to a negative integer, typically via CLI flags, Helm extraArgs, or an environment/config file that interpolates an unvalidated value into the flag.","commonSituations":"Helm values computed from an expression that can go negative (e.g. subtracting from a small default); copy-paste of '-1' meant to 'disable' the channel; automation writing the flag from an unset env var defaulting oddly.","solutions":["Set the flag to 0 or a positive integer (default is 1)","Remove the flag entirely to use the built-in default","Clamp the value in your deployment tooling: max(0, computedValue)","If '0' was intended to disable eventing, use the correct disable mechanism instead of -1"],"exampleFix":"// before\nextraArgs: { ztunnel-endpoint-event-channel-buffer-size: \"-1\" }\n// after\nextraArgs: { ztunnel-endpoint-event-channel-buffer-size: \"1\" }","handlingStrategy":"validation","validationCode":"if buf, err := strconv.Atoi(flagVal); err != nil || buf < 0 {\n    return fmt.Errorf(\"ztunnel-endpoint-event-channel-buffer-size must be >= 0, got %q\", flagVal)\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"buffer-size must be non-negative\") {\n        cfg.EndpointEventChannelBufferSize = 1 // fall back to default\n    }\n    return err\n}","preventionTips":["Never pass -1 for buffer sizes; use 0 for unbuffered semantics","Clamp computed Helm values: math.Max(0, n)","Validate all numeric flags in CI before rollout","Prefer omitting hidden tuning flags unless profiling demands it"],"tags":["configuration","validation","flags","ztunnel"],"backgroundTag":"invalid-config-value","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}