{"record":{"id":"f559aa2130e0f500","repo":"cilium/cilium","slug":"found-invalid-s","errorCode":null,"errorMessage":"Found invalid %s","messagePattern":"Found invalid (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-dbg/cmd/preflight_k8s_valid_cnp.go","lineNumber":147,"sourceCode":"\t\t\tDo(ctx).\n\t\t\tInto(&cnps)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tfor _, cnp := range cnps.Items {\n\t\t\tif cnp.GetNamespace() != \"\" {\n\t\t\t\tcnpName = fmt.Sprintf(\"%s/%s\", cnp.GetNamespace(), cnp.GetName())\n\t\t\t} else {\n\t\t\t\tcnpName = cnp.GetName()\n\t\t\t}\n\t\t\tif err := validator(&cnp); err != nil {\n\t\t\t\tlog.Error(\"Unexpected validation error\",\n\t\t\t\t\tlogfields.Error, err,\n\t\t\t\t\tlogfields.Type, shortName,\n\t\t\t\t\tlogfields.Name, cnpName,\n\t\t\t\t)\n\t\t\t\tpolicyErr = fmt.Errorf(\"Found invalid %s\", shortName)\n\t\t\t} else {\n\t\t\t\tlog.Info(\"Validation OK!\",\n\t\t\t\t\tlogfields.Type, shortName,\n\t\t\t\t\tlogfields.Name, cnpName,\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t\tif cnps.GetContinue() == \"\" {\n\t\t\tbreak\n\t\t}\n\t}\n\treturn policyErr\n}\n","sourceCodeStart":129,"sourceCodeEnd":161,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-dbg/cmd/preflight_k8s_valid_cnp.go#L129-L161","documentation":"During preflight CNP validation, validateNPResources applies the NP validator to every CiliumNetworkPolicy. If the validator returns an error for a resource, it logs the unexpected validation error per-object and sets the aggregate policyErr to 'Found invalid <shortName>' (e.g. 'Found invalid CiliumNetworkPolicy'), which fails the preflight check.","triggerScenarios":"Running 'cilium preflight validate-cnp' against a cluster where at least one CiliumNetworkPolicy/CiliumClusterwideNetworkPolicy fails v2 NP validation — e.g. policies created before a Cilium upgrade that violate new schema/validation rules.","commonSituations":"Running preflight as part of a Cilium upgrade procedure and old policies being incompatible with the new version; hand-edited policies with invalid fields; deprecated rule constructs no longer accepted by the validator.","solutions":["Check the per-object 'Unexpected validation error' log lines (they include type and policy name) to identify each failing policy.","Fix the offending CNP YAML (kubectl edit / apply corrected manifests) to satisfy the new validator rules.","Re-run preflight validate-cnp until no invalid resources remain before completing the upgrade.","Consult the Cilium upgrade guide for policy schema changes between your old and new versions."],"exampleFix":"# before: policy with deprecated/invalid field\nspec:\n  endpointSelector:\n    matchLabels: \"not-a-map\"\n# after\nspec:\n  endpointSelector:\n    matchLabels:\n      app: frontend","handlingStrategy":"try-catch","validationCode":"// dry-run validation client-side before applying policies\n// cilium preflight validate-cnp --k8s-kubeconfig-path=... (run in staging first)","typeGuard":null,"tryCatchPattern":"if err := validateNPResources(...); err != nil {\n\t// policyErr == \"Found invalid <Type>\"; scan logs for the\n\t// per-policy 'Unexpected validation error' entries to enumerate offenders\n\treturn fmt.Errorf(\"preflight failed: %w\", err)\n}","preventionTips":["Run preflight validate-cnp before every Cilium upgrade.","Keep CNP manifests in git and validate them in CI against the target Cilium version.","Read per-object error logs (type + name) to locate every invalid policy."],"tags":["kubernetes","policy-validation","preflight","cilium"],"backgroundTag":"policy-validation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}