{"record":{"id":"f39bf61161aa72e9","repo":"cilium/cilium","slug":"ipsec-key-has-unsupported-format","errorCode":null,"errorMessage":"IPsec key has unsupported format","messagePattern":"IPsec key has unsupported format","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/encrypt/ipsec_rotate_key.go","lineNumber":86,"sourceCode":"\treturn fmt.Sprintf(\"%d%s %s %s %s %s\", k.spi, spiSuffix, k.algo, k.key, k.cipherMode, k.cipherKey)\n}\n\nvar (\n\tipsecKeyRegex       = regexp.MustCompile(`^([[:digit:]]+\\+?)[[:space:]](\\S+)[[:space:]]([[:alnum:]]+)[[:space:]]([[:digit:]]+)$`)\n\tcipherIPsecKeyRegex = regexp.MustCompile(`^([[:digit:]]+\\+?)[[:space:]](\\S+)[[:space:]]([[:alnum:]]+)[[:space:]](\\S+)[[:space:]]([[:alnum:]]+)$`)\n\tipsecParsers        = map[*regexp.Regexp]func([]string) (ipsecKey, error){\n\t\tipsecKeyRegex:       keyFromSlice,\n\t\tcipherIPsecKeyRegex: cipherKeyFromSlice,\n\t}\n)\n\nfunc ipsecKeyFromString(s string) (ipsecKey, error) {\n\tfor matcher, parser := range ipsecParsers {\n\t\tif matcher.MatchString(s) {\n\t\t\treturn parser(matcher.FindStringSubmatch(s))\n\t\t}\n\t}\n\treturn ipsecKey{}, fmt.Errorf(\"IPsec key has unsupported format\")\n}\n\nfunc keyFromSlice(parts []string) (ipsecKey, error) {\n\tif len(parts) != 5 {\n\t\treturn ipsecKey{}, fmt.Errorf(\"IPsec key invalid [expected parts: 5, actual parts: %d]\", len(parts))\n\t}\n\tparts[1] = strings.TrimSuffix(parts[1], \"+\")\n\tspi, err := strconv.Atoi(parts[1])\n\tif err != nil {\n\t\treturn ipsecKey{}, fmt.Errorf(\"invalid IPsec key SPI: %s\", parts[1])\n\t}\n\tsize, err := strconv.Atoi(parts[4])\n\tif err != nil {\n\t\treturn ipsecKey{}, fmt.Errorf(\"invalid IPsec key size: %s\", parts[4])\n\t}\n\tkey := ipsecKey{\n\t\tspi:  spi,\n\t\talgo: parts[2],","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/encrypt/ipsec_rotate_key.go#L68-L104","documentation":"ipsecKeyFromString returns this when the key string from the secret matches none of the registered ipsecParsers regexes. The CLI supports a fixed set of IPsec key string layouts; anything else is rejected before parsing.","triggerScenarios":"IPsecRotateKey reads secret.Data[\"keys\"] and ipsecKeyFromString fails to match any parser — e.g. wrong number of fields, missing rfc4106(gcm(aes)) marker, whitespace/newline corruption, or a future/newer format.","commonSituations":"Secrets edited by hand with dropped fields; keys written by newer cilium versions with formats the CLI's parser set doesn't know; trailing newlines or CRLF from manual edits.","solutions":["Print the secret value and compare to the expected format '<spi> rfc4106(gcm(aes)) <128/256-bit hex key>'","Strip stray whitespace/newlines and rewrite the key in the canonical format","Use matching CLI/agent versions so parser regexes cover the key format; otherwise recreate via create-key/rotate-key"],"exampleFix":"// before: malformed key\n\"rfc4106(gcm(aes)) abc123\"\n// after\n\"3 rfc4106(gcm(aes)) 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"","handlingStrategy":"validation","validationCode":"const re = /^\\d+\\s+rfc4106\\(gcm\\(aes\\)\\)\\s+[0-9a-fA-F]+$/m\nif (!re.test(keyStr.trim())) throw new Error('key string not in supported format')","typeGuard":"function isWellFormedKey(s) { return typeof s === 'string' && /^\\d+\\s+rfc4106\\(gcm\\(aes\\)\\)\\s+[0-9a-f]+$/i.test(s.trim()) }","tryCatchPattern":"try { await IPsecRotateKey(ctx) } catch (err) { if (/unsupported format/.test(err.message)) { /* rewrite secret keys value canonically or recreate */ } throw err }","preventionTips":["Never hand-edit key strings; generate with cilium-cli","Trim whitespace/newlines when copying keys between tools","Match cilium-cli version to the cluster version that wrote the key"],"tags":["ipsec","parsing","key-format","cilium"],"backgroundTag":"ipsec-key-format-invalid","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}