{"record":{"id":"eef3eb345f5fb1dd","repo":"cilium/cilium","slug":"unknown-cidr-match-mode-s","errorCode":null,"errorMessage":"unknown CIDR match mode: %s","messagePattern":"unknown CIDR match mode: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/option/config.go","lineNumber":2118,"sourceCode":"\nfunc (c *DaemonConfig) PolicyCIDRMatchesPods() bool {\n\treturn slices.Contains(c.PolicyCIDRMatchMode, \"pods\")\n}\n\n// PerNodeLabelsEnabled returns true if per-node labels feature\n// is enabled\nfunc (c *DaemonConfig) PerNodeLabelsEnabled() bool {\n\treturn c.EnableNodeSelectorLabels\n}\n\nfunc (c *DaemonConfig) validatePolicyCIDRMatchMode() error {\n\t// Currently, the acceptable values are \"nodes\" and \"pods\".\n\tfor _, mode := range c.PolicyCIDRMatchMode {\n\t\tswitch mode {\n\t\tcase \"nodes\", \"pods\":\n\t\t\tcontinue\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unknown CIDR match mode: %s\", mode)\n\t\t}\n\t}\n\treturn nil\n}\n\n// DirectRoutingDeviceRequired return whether the Direct Routing Device is needed under\n// the current configuration.\nfunc (c *DaemonConfig) DirectRoutingDeviceRequired(kprCfg kpr.KPRConfig, wireguardEnabled bool) bool {\n\t// BPF NodePort and BPF Host Routing are using the direct routing device now.\n\t// When tunneling is enabled, node-to-node redirection will be done by tunneling.\n\tBPFHostRoutingEnabled := !c.UnsafeDaemonConfigOption.EnableHostLegacyRouting\n\n\t// XDP needs ipv4_direct_routing when building tunnel headers:\n\tif kprCfg.KubeProxyReplacement && c.NodePortAcceleration != NodePortAccelerationDisabled {\n\t\treturn true\n\t}\n\n\treturn kprCfg.KubeProxyReplacement || BPFHostRoutingEnabled || wireguardEnabled","sourceCodeStart":2100,"sourceCodeEnd":2136,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/option/config.go#L2100-L2136","documentation":"DaemonConfig validation checks each entry of policy-cidr-match-mode against the whitelist of accepted values. This error is returned when a configured value is anything other than \"nodes\" or \"pods\", since Cilium can only match CIDRs against node or pod prefixes.","triggerScenarios":"Setting --policy-cidr-match-mode (or PolicyCIDRMatchMode in config) to any value other than \"nodes\" or \"pods\" — e.g. a typo like \"node\", \"pod\", or \"pods,nodes\" passed as one comma-joined entry instead of a list — and then calling DaemonConfig.Validate().","commonSituations":"Typo or singular/plural mistake in cilium-config ConfigMap; passing a comma-separated string where repeated list values are expected; upgrading Cilium and carrying over an invalid or deprecated value from older Helm values.","solutions":["Set policy-cidr-match-mode to only \"nodes\" and/or \"pods\" (repeat the flag/entry for multiple values)","Check for typos: exact lowercase strings \"nodes\" and \"pods\" only","If you intended both modes, provide them as separate list entries, not \"pods,nodes\"","Fix the value in the cilium-config ConfigMap or Helm values (policyCIDRMatchMode) and restart the agent"],"exampleFix":"// before (cilium-config ConfigMap)\npolicy-cidr-match-mode: \"pods,nodes\"\n// after\npolicy-cidr-match-mode: \"pods\"\n# plus a second entry: policy-cidr-match-mode: \"nodes\"","handlingStrategy":"validation","validationCode":"import \"slices\"\n\nfunc validCIDRMatchModes(modes []string) error {\n    for _, m := range modes {\n        if m != \"nodes\" && m != \"pods\" {\n            return fmt.Errorf(\"unknown CIDR match mode: %s\", m)\n        }\n    }\n    return nil\n}\n// call before applying config: validCIDRMatchMode(cfg.PolicyCIDRMatchMode)","typeGuard":null,"tryCatchPattern":"if err := daemonConfig.Validate(vp); err != nil {\n    if strings.Contains(err.Error(), \"unknown CIDR match mode\") {\n        log.Fatalf(\"fix policy-cidr-match-mode (allowed: nodes, pods): %v\", err)\n    }\n    return err\n}","preventionTips":["Only use the literal strings \"nodes\" and \"pods\" (lowercase, plural)","Provide multiple modes as repeated list entries, not one comma-joined string","Lint Helm values for policyCIDRMatchMode against the allowed set","When upgrading, re-check deprecated/renamed values in the cilium-config ConfigMap"],"tags":["config","validation","cilium","policy"],"backgroundTag":"invalid-config-value","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}