cilium/cilium · error

error building CEL program: %w

Error message

error building CEL program: %w

What it means

filterByCELExpression wraps errors from celEnv.Program(ast), the stage that binds a checked AST into an executable program. This fires when the AST is valid but cannot be turned into a program (e.g. unsupported declarations or environment misconfiguration). Thrown at pkg/hubble/filters/cel_expression.go:82.

Source

Thrown at pkg/hubble/filters/cel_expression.go:82

			"got %q, wanted %q result type",
			checked.OutputType(), celType)
	}
	return ast, nil
}

func filterByCELExpression(ctx context.Context, log *slog.Logger, exprs []string) (FilterFunc, error) {
	var programs []cel.Program
	for _, expr := range exprs {
		// we want filters to be boolean expressions, so check the type of the
		// expression before proceeding
		ast, err := compile(celEnv, expr, cel.BoolType)
		if err != nil {
			return nil, fmt.Errorf("error compiling CEL expression: %w", err)
		}

		prg, err := celEnv.Program(ast)
		if err != nil {
			return nil, fmt.Errorf("error building CEL program: %w", err)
		}
		programs = append(programs, prg)
	}

	return func(ev *v1.Event) bool {
		for _, prg := range programs {
			out, _, err := prg.ContextEval(ctx, map[string]any{
				flowVariableName: ev.GetFlow(),
			})
			if err != nil {
				log.Error("error running CEL program", logfields.Error, err)
				return false
			}

			v, err := out.ConvertToNative(goBoolType)
			if err != nil {
				log.Error("invalid conversion in CEL program", logfields.Error, err)
				return false

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped cause for which declaration/option the program builder rejected
2. Ensure the cel.Env used to build the program is the same one that checked the AST
3. Register any custom functions/declarations the expression uses via celenv options
4. Upgrade/downgrade Cilium if a known CEL library incompatibility is involved

// Ensure the AST compiles to a program with the same env before building filters
ast, _ := celEnv.Parse(expr)
chk, iss := celEnv.Check(ast)
if iss == nil || iss.Err() == nil {
    if _, perr := celEnv.Program(chk); perr != nil { return perr }
}

prg, err := celEnv.Program(ast)
if err != nil {
    return nil, fmt.Errorf("CEL program build failed for %q: %w", expr, err)
}

When it happens

Trigger: celEnv.Program(ast) returning an error after compile() succeeded — typically when the CEL environment lacks needed declarations/functions referenced at program-build time.

Common situations: Custom CEL environments missing function declarations used by the expression; library version mismatches between the CEL runtime and declared functions.

Related errors

• error compiling CEL expression: %w
• got %q, wanted %q result type
• too many slashes in pattern
• program %s has no function metadata
• compiling overlay program: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/d72e55f4945b4b11. Report an issue: GitHub.