cilium/cilium · error

Failed to de-serialize json: %w

Error message

Failed to de-serialize json: %w

What it means

readConfig in pkg/ipmasq/ipmasq.go converts the ip-masq-agent YAML config to JSON via yaml.ToJSON, then json.Unmarshal into the config struct. This error wraps any json.Unmarshal failure, meaning the (converted) config is not valid JSON for the expected config struct shape. It is thrown so the caller (update, via Start) can log and skip applying a bad config rather than corrupting the BPF masquerade map.

Source

Thrown at pkg/ipmasq/ipmasq.go:259

			return true, nil
		}
		return false, fmt.Errorf("Failed to read %s: %w", a.configPath, err)
	}

	if len(raw) == 0 {
		a.nonMasqCIDRsFromConfig = map[string]netip.Prefix{}
		a.masqLinkLocalIPv4 = false
		a.masqLinkLocalIPv6 = false
		return true, nil
	}

	jsonStr, err := yaml.ToJSON(raw)
	if err != nil {
		return false, fmt.Errorf("Failed to convert to json: %w", err)
	}

	if err := json.Unmarshal(jsonStr, &cfg); err != nil {
		return false, fmt.Errorf("Failed to de-serialize json: %w", err)
	}

	nonMasqCIDRs := map[string]netip.Prefix{}
	for _, cidr := range cfg.NonMasqCIDRs {
		n := netip.Prefix(cidr)
		nonMasqCIDRs[n.String()] = n
	}
	a.nonMasqCIDRsFromConfig = nonMasqCIDRs
	a.masqLinkLocalIPv4 = cfg.MasqLinkLocalIPv4
	a.masqLinkLocalIPv6 = cfg.MasqLinkLocalIPv6

	return false, nil
}

func (a *IPMasqAgent) NonMasqCIDRsFromConfig() []netip.Prefix {
	return slices.Collect(maps.Values(a.nonMasqCIDRsFromConfig))
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Fix the YAML/JSON config file so it unmarshals into the expected ipmasq config struct (correct types, valid CIDRs in NonMasqCIDRs)
2. Validate the config locally (convert with yaml.ToJSON / json.Unmarshal in a scratch program or jq) before mounting it
3. Check pod logs for the wrapped %w error to identify the exact JSON offset/field causing the failure
4. Redeploy the correct upstream ip-masq-agent config example for your cilium version

Example fix

// before (bad config)
non-masquerade-cidrs: 10.0.0.0/8
// after
cidr:
  nonMasqCIDRs:
    - 10.0.0.0/8

jsonStr, err := yaml.ToJSON(raw)
if err != nil { return err }
var cfg ipmasqConfig
if err := json.Unmarshal(jsonStr, &cfg); err != nil {
    return fmt.Errorf("invalid ipmasq config: %w", err)
}
for _, c := range cfg.NonMasqCIDRs {
    if _, err := netip.ParsePrefix(string(c)); err != nil { return err }
}

func validIPMasqConfig(b []byte) (*ipmasqConfig, error) {
    var cfg ipmasqConfig
    if err := json.Unmarshal(b, &cfg); err != nil { return nil, err }
    return &cfg, nil
}

When it happens

Trigger: The ip-masq-agent config file mounted at the config path contains YAML that converts to JSON but fails schema/type validation during json.Unmarshal into cfg (e.g. wrong field types, unknown structure mismatch, malformed JSON).

Common situations: Users hand-edit the ConfigMap and mis-indent or type a CIDR field as a number/string mismatch; a stale or partially-written config file is read; a config written for a different agent version is mounted into the pod.

Related errors

• Invalid CIDR: %s
• Failed to convert to json: %w
• failed to marshal config to YAML: %w
• failed to parse table ID %q: %w
• invalid ForwardableIPOwnerType: %s

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/2f0fda112572653c. Report an issue: GitHub.