What causes "invalid destination label filter: %w" in cilium/cilium?

Correct the destination label selector to valid 'key=value' or supported match syntax.

invalid destination label filter: %w

Error message

invalid destination label filter: %w

What it means

LabelsFilter.OnBuildFilter wraps errors from FilterByLabelSelectors when building the FlowFilter.destinationLabel filter. A malformed destination label selector causes this error, with the parse cause chained via %w so the exact problem is visible.

Source

Thrown at pkg/hubble/filters/labels.go:91

// LabelsFilter implements filtering based on labels
type LabelsFilter struct{}

// OnBuildFilter builds a labels filter
func (l *LabelsFilter) OnBuildFilter(ctx context.Context, ff *flowpb.FlowFilter) ([]FilterFunc, error) {
	var fs []FilterFunc

	if ff.GetSourceLabel() != nil {
		slf, err := FilterByLabelSelectors(ff.GetSourceLabel(), sourceLabels)
		if err != nil {
			return nil, fmt.Errorf("invalid source label filter: %w", err)
		}
		fs = append(fs, slf)
	}

	if ff.GetDestinationLabel() != nil {
		dlf, err := FilterByLabelSelectors(ff.GetDestinationLabel(), destinationLabels)
		if err != nil {
			return nil, fmt.Errorf("invalid destination label filter: %w", err)
		}
		fs = append(fs, dlf)
	}

	if ff.GetNodeLabels() != nil {
		nlf, err := FilterByLabelSelectors(ff.GetNodeLabels(), nodeLabels)
		if err != nil {
			return nil, fmt.Errorf("invalid node label filter: %w", err)
		}
		fs = append(fs, nlf)
	}

	return fs, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

Correct the destination label selector to valid 'key=value' or supported match syntax.
Trim whitespace/quotes and validate selector parsing before constructing the FlowFilter.
Check the wrapped cause to identify which selector entry failed.

Example fix

// before
flowFilter.DestinationLabel = []string{"=backend"}
// after
flowFilter.DestinationLabel = []string{"app=backend"}

Defensive patterns

Strategy: validation

Validate before calling

for _, sel := range flowFilter.GetDestinationLabel() {
    k, v, ok := strings.Cut(sel, "=")
    if !ok || k == "" || v == "" {
        return fmt.Errorf("invalid destination label selector %q", sel)
    }
}

Type guard

func isValidLabelSelector(s string) bool {
    k, v, ok := strings.Cut(s, "=")
    return ok && k != "" && v != ""
}

Try / catch

ffs, err := filterBuilder.Build(ctx, flowFilter)
if err != nil && strings.Contains(err.Error(), "invalid destination label filter") {
    return fmt.Errorf("check destinationLabel selectors: %w", err)
}

Prevention

Validate 'key=value' syntax for every destinationLabel entry.
Trim quotes/whitespace from config-sourced selectors.
Reuse a single selector-validation helper for source, destination, and node labels.

When it happens

Trigger: Calling OnBuildFilter with FlowFilter.destinationLabel entries with invalid selector syntax, e.g. '=value', keys with invalid characters, or unparseable regex matchers.

Common situations: Typos in YAML label filter entries, copy-pasted selectors with stray characters, or labels copied with quotes/whitespace included.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/8007c0a5dc2904c3. Report an issue: GitHub.