Failed to compile regex for kubernetes plugin matching: %w

Error message

Failed to compile regex for kubernetes plugin matching: %w

What it means

Inside updateCorefile, the controller builds a multiline regex `(?m)^\s*kubernetes.*<domain>.*\{` to locate the kubernetes plugin block in the Corefile. If `regexp.Compile` fails, this wrapped error is returned. Compile failure here is practically impossible since the pattern is constructed from static text plus an escaped domain, so it usually indicates a pathological cluster domain value.

Source

Thrown at clustermesh-apiserver/mcsapi-coredns-cfg/root.go:145

		err = restartCoreDNS(ctx, client, deployment)
		if err != nil {
			logger.Error("Failed to restart CoreDNS Deployment", logfields.Error, err)
		} else {
			logger.Info("CoreDNS is rolling out with the new configuration")
		}
		return
	}))
}

func updateCorefile(clusterDomain, clustersetDomain string, corefile string) (string, error) {
	if strings.Contains(corefile, clustersetDomain) || strings.Contains(corefile, "multicluster") {
		return "", nil // This is not an error as this command might have already been executed
	}

	clusterDomainEscaped := strings.ReplaceAll(clusterDomain, ".", "\\.")
	kubernetesMatchRegex, err := regexp.Compile(fmt.Sprintf(`(?m)^\s*kubernetes.*%s.*\{`, clusterDomainEscaped))
	if err != nil {
		return "", fmt.Errorf("Failed to compile regex for kubernetes plugin matching: %w", err)
	}
	if !kubernetesMatchRegex.MatchString(corefile) {
		return "", fmt.Errorf("CoreDNS not configured with kubernetes plugin and the domain '%s'", clusterDomain)
	}

	corefile = strings.ReplaceAll(
		corefile,
		clusterDomain,
		clusterDomain+" "+clustersetDomain,
	)
	kubernetesReplaceRegex := regexp.MustCompile(`(?m)^(\s*)kubernetes(.*)\{`)
	corefile = kubernetesReplaceRegex.ReplaceAllString(
		corefile,
		fmt.Sprintf("${1}kubernetes${2}{\n${1}   multicluster %s", clustersetDomain),
	)
	return corefile, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

Fix the clusterDomain flag so it is a plain DNS domain (letters, digits, dots, hyphens only)
Check the wrapped `%w` cause in the error message for the exact regexp syntax problem
If running a modified build, validate the domain with a `^[a-z0-9.-]+$` check before composing the regex

Example fix

// before
clusterDomain = "cluster.local))"
// after
clusterDomain = "cluster.local"

Defensive patterns

Strategy: validation

Validate before calling

var domainRe = regexp.MustCompile(`^[a-zA-Z0-9.-]+$`)
if !domainRe.MatchString(clusterDomain) {
    return fmt.Errorf("invalid cluster domain %q", clusterDomain)
}

Try / catch

corefile, err := updateCorefile(domain, clustersetDomain, corefile)
if err != nil {
    if strings.Contains(err.Error(), "Failed to compile regex") {
        log.Fatalf("bad cluster domain %q: %v", domain, err)
    }
}

Prevention

Keep --coredns-cluster-domain limited to valid DNS characters
Quote/escape domains before composing regexes
Fail fast on flag validation at startup

When it happens

Trigger: updateCorefile is called with a clusterDomain that, even after dot-escaping, forms an invalid regex (e.g. containing stray regexp metacharacters beyond dots, or an invalid UTF-8/oversized pattern from misconfiguration).

Common situations: A mistyped --coredns-cluster-domain containing unbalanced parentheses/brackets or control characters, causing regexp.Compile to reject the composed pattern.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/694805b4b52a64e8. Report an issue: GitHub.