{"record":{"id":"ef85fd113fd4ceb7","repo":"slackhq/nebula","slug":"group-should-contain-a-single-value-an-array-with","errorCode":null,"errorMessage":"group should contain a single value, an array with more than one entry was provided","messagePattern":"group should contain a single value, an array with more than one entry was provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"firewall.go","lineNumber":973,"sourceCode":"\t\tif !ok {\n\t\t\treturn \"\"\n\t\t}\n\t\treturn fmt.Sprintf(\"%v\", v)\n\t}\n\n\tr.Port = toString(\"port\", m)\n\tr.Code = toString(\"code\", m)\n\tr.Proto = toString(\"proto\", m)\n\tr.Host = toString(\"host\", m)\n\tr.Cidr = toString(\"cidr\", m)\n\tr.LocalCidr = toString(\"local_cidr\", m)\n\tr.CAName = toString(\"ca_name\", m)\n\tr.CASha = toString(\"ca_sha\", m)\n\n\t// Make sure group isn't an array\n\tif v, ok := m[\"group\"].([]any); ok {\n\t\tif len(v) > 1 {\n\t\t\treturn r, errors.New(\"group should contain a single value, an array with more than one entry was provided\")\n\t\t}\n\n\t\tl.Warn(\"group was an array with a single value, converting to simple value\",\n\t\t\t\"table\", table,\n\t\t\t\"rule\", i,\n\t\t)\n\t\tm[\"group\"] = v[0]\n\t}\n\n\tsingleGroup := toString(\"group\", m)\n\n\tif rg, ok := m[\"groups\"]; ok {\n\t\tswitch reflect.TypeOf(rg).Kind() {\n\t\tcase reflect.Slice:\n\t\t\tv := reflect.ValueOf(rg)\n\t\t\tr.Groups = make([]string, v.Len())\n\t\t\tfor i := 0; i < v.Len(); i++ {\n\t\t\t\tr.Groups[i] = v.Index(i).Interface().(string)","sourceCodeStart":955,"sourceCodeEnd":991,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/firewall.go#L955-L991","documentation":"This error comes from Nebula firewall rule parsing. The 'group' field in a rule definition may be a single string or a list; the library only accepts an array with at most one entry (converted to a simple value with a warning), and rejects any array with more than one entry.","triggerScenarios":"A firewall rule in the config supplies 'group' as an array containing two or more values, e.g. group: [\"g1\", \"g2\"], while parsing firewall rules from the YAML config.","commonSituations":"Users copy multi-group rules from docs or other firewalls (where group lists are supported) into Nebula configs; config generators emitting arrays for group; upgrading configs that assumed AND/OR multi-group matching is supported.","solutions":["Use a single value for 'group': group: \"g1\" in the rule.","If you need to match multiple groups, add multiple firewall rules (one per group) or use 'groups' (the list-based field) if supported by your Nebula version.","Validate your firewall config with nebula -configtest before deploying."],"exampleFix":"// before\nfirewall:\n  inbound:\n    - port: 22\n      proto: tcp\n      group:\n        - admins\n        - ssh-users\n// after\nfirewall:\n  inbound:\n    - port: 22\n      proto: tcp\n      group: admins","handlingStrategy":"validation","validationCode":"g, ok := rule[\"group\"]\nif arr, isArr := g.([]any); isArr && len(arr) > 1 {\n    return errors.New(\"group must be a single value in nebula firewall rules\")\n}","typeGuard":"func isSingleGroup(v any) bool {\n    if s, ok := v.(string); ok {\n        return s != \"\"\n    }\n    if arr, ok := v.([]any); ok {\n        return len(arr) <= 1\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Always use a scalar string for 'group' in firewall rules","Use nebula -configtest to validate configs before deployment","Use the 'groups' list field (not 'group') when multiple groups are needed","Share a linted/config-validated config template across teams"],"tags":["config","firewall","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}