cilium/cilium · error

Found invalid %s

Error message

Found invalid %s

What it means

During preflight CNP validation, validateNPResources applies the NP validator to every CiliumNetworkPolicy. If the validator returns an error for a resource, it logs the unexpected validation error per-object and sets the aggregate policyErr to 'Found invalid <shortName>' (e.g. 'Found invalid CiliumNetworkPolicy'), which fails the preflight check.

Source

Thrown at cilium-dbg/cmd/preflight_k8s_valid_cnp.go:147

			Do(ctx).
			Into(&cnps)
		if err != nil {
			return err
		}

		for _, cnp := range cnps.Items {
			if cnp.GetNamespace() != "" {
				cnpName = fmt.Sprintf("%s/%s", cnp.GetNamespace(), cnp.GetName())
			} else {
				cnpName = cnp.GetName()
			}
			if err := validator(&cnp); err != nil {
				log.Error("Unexpected validation error",
					logfields.Error, err,
					logfields.Type, shortName,
					logfields.Name, cnpName,
				)
				policyErr = fmt.Errorf("Found invalid %s", shortName)
			} else {
				log.Info("Validation OK!",
					logfields.Type, shortName,
					logfields.Name, cnpName,
				)
			}
		}
		if cnps.GetContinue() == "" {
			break
		}
	}
	return policyErr
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the per-object 'Unexpected validation error' log lines (they include type and policy name) to identify each failing policy.
2. Fix the offending CNP YAML (kubectl edit / apply corrected manifests) to satisfy the new validator rules.
3. Re-run preflight validate-cnp until no invalid resources remain before completing the upgrade.
4. Consult the Cilium upgrade guide for policy schema changes between your old and new versions.

Example fix

# before: policy with deprecated/invalid field
spec:
  endpointSelector:
    matchLabels: "not-a-map"
# after
spec:
  endpointSelector:
    matchLabels:
      app: frontend

// dry-run validation client-side before applying policies
// cilium preflight validate-cnp --k8s-kubeconfig-path=... (run in staging first)

if err := validateNPResources(...); err != nil {
	// policyErr == "Found invalid <Type>"; scan logs for the
	// per-policy 'Unexpected validation error' entries to enumerate offenders
	return fmt.Errorf("preflight failed: %w", err)
}

When it happens

Trigger: Running 'cilium preflight validate-cnp' against a cluster where at least one CiliumNetworkPolicy/CiliumClusterwideNetworkPolicy fails v2 NP validation — e.g. policies created before a Cilium upgrade that violate new schema/validation rules.

Common situations: Running preflight as part of a Cilium upgrade procedure and old policies being incompatible with the new version; hand-edited policies with invalid fields; deprecated rule constructs no longer accepted by the validator.

Related errors

• Kubernetes client not configured. Please provide configurati
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• pod store outdated
• unable to update some endpoints with new namespace labels
• no link found inside container

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/f559aa2130e0f500. Report an issue: GitHub.