{"record":{"id":"ce052d24969f0fc8","repo":"cilium/cilium","slug":"invalid-drop-reason-desc-value-v","errorCode":null,"errorMessage":"invalid --drop-reason-desc value: %v","messagePattern":"invalid --drop-reason-desc value: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hubble/cmd/observe/flows_filter.go","lineNumber":551,"sourceCode":"\t\t\tf.apply(func(f *flowpb.FlowFilter) {\n\t\t\t\tf.Verdict = nil\n\t\t\t})\n\t\t}\n\n\t\tvv, ok := flowpb.Verdict_value[val]\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"invalid --verdict value: %v\", val)\n\t\t}\n\t\tf.apply(func(f *flowpb.FlowFilter) {\n\t\t\tf.Verdict = append(f.GetVerdict(), flowpb.Verdict(vv))\n\t\t})\n\tcase \"drop-reason-desc\":\n\t\tif val == \"\" {\n\t\t\treturn fmt.Errorf(\"empty --drop-reason-desc value\")\n\t\t}\n\t\tv, ok := flowpb.DropReason_value[val]\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"invalid --drop-reason-desc value: %v\", val)\n\t\t}\n\t\tf.apply(func(f *flowpb.FlowFilter) {\n\t\t\tf.DropReasonDesc = append(f.GetDropReasonDesc(), flowpb.DropReason(v))\n\t\t})\n\n\tcase \"http-status\":\n\t\tf.apply(func(f *flowpb.FlowFilter) {\n\t\t\tf.HttpStatusCode = append(f.GetHttpStatusCode(), val)\n\t\t})\n\n\tcase \"http-method\":\n\t\tf.apply(func(f *flowpb.FlowFilter) {\n\t\t\tf.HttpMethod = append(f.GetHttpMethod(), val)\n\t\t})\n\n\tcase \"http-path\":\n\t\tf.apply(func(f *flowpb.FlowFilter) {\n\t\t\tf.HttpPath = append(f.GetHttpPath(), val)","sourceCodeStart":533,"sourceCodeEnd":569,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/hubble/cmd/observe/flows_filter.go#L533-L569","documentation":"After confirming the --drop-reason-desc value is non-empty, Set() looks it up in flowpb.DropReason_value. If the string is not a known DropReason enum name, this error is returned. The value must exactly match a protobuf enum name such as AUTH_REQUIRED, INVALID_IDENTITY, POLICY_DENIED.","triggerScenarios":"`hubble observe --drop-reason-desc <val>` where <val> is misspelled, lowercase, a free-text description instead of the enum name, or from a different Cilium version's enum set.","commonSituations":"Typing human-readable reasons like `--drop-reason-desc \"policy denied\"` instead of POLICY_DENIED; wrong case (`policy_denied`); using a reason name that only exists in newer Cilium releases.","solutions":["Use the exact DropReason enum name (uppercase snake case), e.g. --drop-reason-desc POLICY_DENIED.","Check the flow.proto DropReason enum for your Cilium version for the valid list.","Match capitalization exactly — the map lookup is case-sensitive.","Alternatively filter with --verdict DROPPED if you do not need a specific reason."],"exampleFix":"// before\nhubble observe --drop-reason-desc \"policy denied\"\n// after\nhubble observe --drop-reason-desc POLICY_DENIED","handlingStrategy":"validation","validationCode":"validReasons := map[string]bool{\"AUTH_REQUIRED\": true, \"INVALID_IDENTITY\": true, \"POLICY_DENIED\": true /* ...full DropReason enum... */}\nif !validReasons[reason] {\n    return fmt.Errorf(\"unsupported drop reason %q\", reason)\n}","typeGuard":null,"tryCatchPattern":"if err := cmd.Run(); err != nil {\n    if strings.Contains(err.Error(), \"invalid --drop-reason-desc value\") {\n        fmt.Fprintln(os.Stderr, \"use an uppercase DropReason enum name, e.g. POLICY_DENIED\")\n    }\n}","preventionTips":["Use exact uppercase snake-case DropReason enum names.","Reference flow.proto for your Cilium version rather than guessing names.","Prefer --verdict DROPPED when a specific reason is unnecessary."],"tags":["cli","flag-validation","hubble","enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}