{"record":{"id":"ebbb5e88b2c44f00","repo":"cilium/cilium","slug":"invalid-header-action-s","errorCode":null,"errorMessage":"Invalid header action: %s","messagePattern":"Invalid header action: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/policy/api/http.go","lineNumber":146,"sourceCode":"\n\tif h.Method != \"\" {\n\t\t_, err := regexp.Compile(h.Method)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Headers are not sanitized.\n\n\t// But HeaderMatches are\n\tfor _, m := range h.HeaderMatches {\n\t\tif m.Name == \"\" {\n\t\t\treturn fmt.Errorf(\"Header name missing\")\n\t\t}\n\t\tif m.Mismatch != \"\" &&\n\t\t\tm.Mismatch != MismatchActionLog && m.Mismatch != MismatchActionAdd &&\n\t\t\tm.Mismatch != MismatchActionDelete && m.Mismatch != MismatchActionReplace {\n\t\t\treturn fmt.Errorf(\"Invalid header action: %s\", m.Mismatch)\n\t\t}\n\t\tif m.Secret != nil && m.Secret.Name == \"\" {\n\t\t\treturn fmt.Errorf(\"Secret name missing\")\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":128,"sourceCodeEnd":155,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/policy/api/http.go#L128-L155","documentation":"For HeaderMatches with an action (Mismatch field), Validate only accepts \"\", Log, Add, Delete, or Replace (the MismatchAction* constants). Any other string — e.g. a misspelled or wrongly-cased action — fails with this error naming the bad value.","triggerScenarios":"Setting headerMatches[].mismatch (action) to an unsupported value such as \"set\", \"ADD\", \"Remove\", or \"append\" in an HTTP L7 rule; Validate() is invoked during policy parsing.","commonSituations":"Copy-pasting actions from documentation of other proxies (e.g. Envoy's 'replace' vs Cilium's exact casing); typos like 'replce'; assuming case-insensitivity ('log' vs 'Log'); schema drift between Cilium versions.","solutions":["Use exactly one of the supported actions: Log, Add, Delete, or Replace (match the constant casing) — or leave mismatch empty to only match without modifying.","Check the Cilium version's MismatchAction constants in pkg/policy/api/http.go, as accepted values may differ across releases.","Fix typos and casing; the error message echoes the offending string so compare it character-by-character.","Pre-validate the action against a set before submitting the policy."],"exampleFix":"// before (invalid)\nheaderMatches:\n- name: \"X-Trace\"\n  mismatch: set\n  value: \"abc\"\n// after\nheaderMatches:\n- name: \"X-Trace\"\n  mismatch: replace\n  value: \"abc\"","handlingStrategy":"validation","validationCode":"var allowedActions = map[string]bool{\"\": true, \"Log\": true, \"Add\": true, \"Delete\": true, \"Replace\": true}\nfunc validHeaderAction(m api.HeaderMatch) error {\n    if !allowedActions[m.Mismatch] {\n        return fmt.Errorf(\"action %q not in Log|Add|Delete|Replace\", m.Mismatch)\n    }\n    return nil\n}","typeGuard":"func isKnownMismatchAction(a api.MismatchAction) bool {\n    switch a {\n    case \"\", api.MismatchActionLog, api.MismatchActionAdd, api.MismatchActionDelete, api.MismatchActionReplace:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := httpRule.Validate(); err != nil {\n    if strings.Contains(err.Error(), \"Invalid header action\") {\n        return fmt.Errorf(\"unsupported action; use Log, Add, Delete or Replace: %w\", err)\n    }\n    return err\n}","preventionTips":["Use the api.MismatchAction* constants instead of raw strings","Match exact casing — actions are compared with ==","Check accepted values for your Cilium version before upgrading policies","Add an enum-level schema constraint in your policy generation tooling"],"tags":["cilium","networkpolicy","http","validation"],"backgroundTag":"http-header-rule-validation","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}