cilium/cilium · error

Error parsing Cilium network policies: %w

Error message

Error parsing Cilium network policies: %w

What it means

This error wraps a failure from cnp.Parse when parsing a CiliumNetworkPolicy with cmtypes.PolicyAnyCluster. cnp.Parse validates and converts the CNP into internal api.Rule objects; failure means the CNP content is rejected by the policy parser. The parse error is preserved via %w.

Source

Thrown at cilium-cli/clustermesh/clustermesh.go:1885

		if err != nil {
			return nil, fmt.Errorf("Error parsing network policies: %w", err)
		}
		rulesLocal, err := cmk8s.ParseNetworkPolicy(logger, "some-cluster", &np)
		if err != nil {
			return nil, fmt.Errorf("Error parsing network policies: %w", err)
		}

		res.NetworkPolicies[client.ObjectKeyFromObject(&np).String()] = !slices.EqualFunc(rulesAny, rulesLocal, func(a, b *types.PolicyEntry) bool { return a.DeepEqual(b) })
	}

	cnps, err := k8sClient.ListCiliumNetworkPolicies(ctx, namespace, metav1.ListOptions{})
	if err != nil {
		return nil, fmt.Errorf("Error listing Cilium network policies: %w", err)
	}
	for _, cnp := range cnps.Items {
		rulesAny, err := cnp.Parse(logger, cmtypes.PolicyAnyCluster)
		if err != nil {
			return nil, fmt.Errorf("Error parsing Cilium network policies: %w", err)
		}
		rulesLocal, err := cnp.Parse(logger, "some-cluster")
		if err != nil {
			return nil, fmt.Errorf("Error parsing Cilium network policies: %w", err)
		}

		res.CiliumNetworkPolicies[client.ObjectKeyFromObject(&cnp).String()] = !slices.EqualFunc(rulesAny, rulesLocal, func(a, b *api.Rule) bool { return a.DeepEqual(b) })
	}

	if namespace == corev1.NamespaceAll {
		ccnps, err := k8sClient.ListCiliumClusterwideNetworkPolicies(ctx, metav1.ListOptions{})
		if err != nil {
			return nil, fmt.Errorf("Error listing Cilium Cluster Wide network policies: %w", err)
		}
		for _, ccnp := range ccnps.Items {
			rulesAny, err := ccnp.Parse(logger, cmtypes.PolicyAnyCluster)
			if err != nil {
				return nil, fmt.Errorf("Error parsing Cilium Cluster Wide network policies: %w", err)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped error to find the offending CNP and fix the invalid field (CIDR, selector, L7 rule)
2. Align cilium-cli and Cilium agent versions so the parser supports the CNP features used
3. Validate the CNP with 'cilium policy validate' or by checking agent logs for policy import errors

Example fix

// before (invalid CNP fragment)
spec:
  ingress:
  - fromCIDR:
    - 999.999.0.0/16
// after
spec:
  ingress:
  - fromCIDR:
    - 10.0.0.0/16

# validate CNP before applying/inspecting
cilium policy validate --cnp policy.yaml

func parseSafe(cnp *ciliumv2.CiliumNetworkPolicy) bool {
    _, err := cnp.Parse(logger, cmtypes.PolicyAnyCluster)
    return err == nil
}

rulesAny, err := cnp.Parse(logger, cmtypes.PolicyAnyCluster)
if err != nil {
    logger.WithError(err).Warnf("skipping unparsable CNP %s/%s", cnp.Namespace, cnp.Name)
    continue
}

When it happens

Trigger: Inside the loop over cnps.Items, cnp.Parse(logger, cmtypes.PolicyAnyCluster) returns an error for a CiliumNetworkPolicy.

Common situations: CNPs using features not supported by the cilium-cli version (version skew with the cluster's Cilium agent); invalid expressions (bad CIDRs, unsupported L7 rules, invalid selector syntax); CNPs written for a different Cilium schema version.

Related errors

• Error parsing Cilium Cluster Wide network policies: %w
• authenticating failed by the always-fail auth handler
• Cilium is currently affected by a bug that causes traffic ma
• Rule priority is invalid for the tier
• port 53 must be specified for DNS rules

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/7d86d917b25b50ab. Report an issue: GitHub.