{"record":{"id":"db0a2a024fdde768","repo":"cilium/cilium","slug":"the-value-s-s-is-not-supported-as-default-unde","errorCode":null,"errorMessage":"The value --%s=%s is not supported as default under annotation mode","messagePattern":"The value --(.+?)=(.+?) is not supported as default under annotation mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/loadbalancer/config.go","lineNumber":497,"sourceCode":"\t\tif extMax >= cfg.NodePortMin {\n\t\t\treturn Config{}, fmt.Errorf(\"extended NodePort NAT range must not overlap with NodePort range\")\n\t\t}\n\t\tcfg.NodePortMinNATExt = extMin\n\t\tcfg.NodePortMaxNATExt = extMax\n\t}\n\n\tif cfg.LBAlgorithm != LBAlgorithmRandom &&\n\t\tcfg.LBAlgorithm != LBAlgorithmMaglev {\n\t\treturn Config{}, fmt.Errorf(\"Invalid value for --%s: %s\", LBAlgorithmName, cfg.LBAlgorithm)\n\t}\n\n\tif cfg.LBMode != LBModeSNAT && cfg.LBMode != LBModeDSR && cfg.LBMode != LBModeHybrid {\n\t\treturn Config{}, fmt.Errorf(\"Invalid value for --%s: %s\", LoadBalancerModeName, cfg.LBMode)\n\t}\n\n\tif cfg.LBModeAnnotation &&\n\t\tcfg.LBMode == LBModeHybrid {\n\t\treturn Config{}, fmt.Errorf(\"The value --%s=%s is not supported as default under annotation mode\", LoadBalancerModeName, cfg.LBMode)\n\t}\n\n\tif cfg.ReflectorWaitTime <= 0 {\n\t\treturn Config{}, fmt.Errorf(\"--lb-reflector-wait-time must be greater than 0, got %s\", cfg.ReflectorWaitTime)\n\t}\n\n\tif cfg.DSRDispatch != DSRDispatchOption &&\n\t\tcfg.DSRDispatch != DSRDispatchIPIP &&\n\t\tcfg.DSRDispatch != DSRDispatchGeneve {\n\t\treturn Config{}, fmt.Errorf(\"Invalid value for --%s: %s\", LoadBalancerDSRDispatchName, cfg.DSRDispatch)\n\t}\n\n\treturn\n}\n\nvar DefaultUserConfig = UserConfig{\n\tRetryBackoffMin:           time.Second,\n\tRetryBackoffMax:           time.Minute,","sourceCodeStart":479,"sourceCodeEnd":515,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/loadbalancer/config.go#L479-L515","documentation":"When annotation-based load-balancing mode selection is enabled (LBModeAnnotation), the default --lb-mode may not be 'hybrid', because hybrid cannot be expressed per-service via annotations. NewConfig refuses the configuration in that combination.","triggerScenarios":"Calling NewConfig with UserConfig.LBModeAnnotation == true AND LBMode == LBModeHybrid.","commonSituations":"Operators enabling the lb-mode annotation feature while keeping a previously-set default of hybrid; Helm/config templates that enable annotations without changing an inherited hybrid default.","solutions":["Change the default --lb-mode to \"snat\" or \"dsr\" when annotation mode is enabled.","Disable the annotation mode option if hybrid as a cluster-wide default is required.","Use per-service annotations to select hybrid behavior where needed instead of a hybrid default."],"exampleFix":"// before\n--enable-lb-mode-annotation --lb-mode=hybrid\n// after\n--enable-lb-mode-annotation --lb-mode=snat","handlingStrategy":"validation","validationCode":"if cfg.LBModeAnnotation && cfg.LBMode == loadbalancer.LBModeHybrid {\n    return fmt.Errorf(\"hybrid default is incompatible with lb-mode annotation mode\")\n}","typeGuard":null,"tryCatchPattern":"cfg, err := loadbalancer.NewConfig(log, uc, dcfg)\nif err != nil && strings.Contains(err.Error(), \"annotation mode\") {\n    uc.LBMode = loadbalancer.LBModeSNAT\n    cfg, err = loadbalancer.NewConfig(log, uc, dcfg)\n}","preventionTips":["Whenever enabling LBModeAnnotation, explicitly set a non-hybrid default mode.","Encode this pairing rule in Helm values validation or admission logic.","Add a unit test covering the annotation+hybrid combination."],"tags":["load-balancing","config-validation","hybrid-mode","annotation"],"backgroundTag":"incompatible-config-combination","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}