cilium/cilium · error

invalid --drop-reason-desc value: %v

Error message

invalid --drop-reason-desc value: %v

What it means

After confirming the --drop-reason-desc value is non-empty, Set() looks it up in flowpb.DropReason_value. If the string is not a known DropReason enum name, this error is returned. The value must exactly match a protobuf enum name such as AUTH_REQUIRED, INVALID_IDENTITY, POLICY_DENIED.

Source

Thrown at hubble/cmd/observe/flows_filter.go:551

			f.apply(func(f *flowpb.FlowFilter) {
				f.Verdict = nil
			})
		}

		vv, ok := flowpb.Verdict_value[val]
		if !ok {
			return fmt.Errorf("invalid --verdict value: %v", val)
		}
		f.apply(func(f *flowpb.FlowFilter) {
			f.Verdict = append(f.GetVerdict(), flowpb.Verdict(vv))
		})
	case "drop-reason-desc":
		if val == "" {
			return fmt.Errorf("empty --drop-reason-desc value")
		}
		v, ok := flowpb.DropReason_value[val]
		if !ok {
			return fmt.Errorf("invalid --drop-reason-desc value: %v", val)
		}
		f.apply(func(f *flowpb.FlowFilter) {
			f.DropReasonDesc = append(f.GetDropReasonDesc(), flowpb.DropReason(v))
		})

	case "http-status":
		f.apply(func(f *flowpb.FlowFilter) {
			f.HttpStatusCode = append(f.GetHttpStatusCode(), val)
		})

	case "http-method":
		f.apply(func(f *flowpb.FlowFilter) {
			f.HttpMethod = append(f.GetHttpMethod(), val)
		})

	case "http-path":
		f.apply(func(f *flowpb.FlowFilter) {
			f.HttpPath = append(f.GetHttpPath(), val)

View on GitHub (pinned to ac7b90affa)

Solutions

1. Use the exact DropReason enum name (uppercase snake case), e.g. --drop-reason-desc POLICY_DENIED.
2. Check the flow.proto DropReason enum for your Cilium version for the valid list.
3. Match capitalization exactly — the map lookup is case-sensitive.
4. Alternatively filter with --verdict DROPPED if you do not need a specific reason.

Example fix

// before
hubble observe --drop-reason-desc "policy denied"
// after
hubble observe --drop-reason-desc POLICY_DENIED

validReasons := map[string]bool{"AUTH_REQUIRED": true, "INVALID_IDENTITY": true, "POLICY_DENIED": true /* ...full DropReason enum... */}
if !validReasons[reason] {
    return fmt.Errorf("unsupported drop reason %q", reason)
}

if err := cmd.Run(); err != nil {
    if strings.Contains(err.Error(), "invalid --drop-reason-desc value") {
        fmt.Fprintln(os.Stderr, "use an uppercase DropReason enum name, e.g. POLICY_DENIED")
    }
}

When it happens

Trigger: `hubble observe --drop-reason-desc <val>` where <val> is misspelled, lowercase, a free-text description instead of the enum name, or from a different Cilium version's enum set.

Common situations: Typing human-readable reasons like `--drop-reason-desc "policy denied"` instead of POLICY_DENIED; wrong case (`policy_denied`); using a reason name that only exists in newer Cilium releases.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid --verdict value: %v
• %s: invalid traffic direction, expected ingress or egress
• empty --drop-reason-desc value
• invalid http-header value %q, expected name:value
• unable to parse type '%s', not a known type name and unable

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/ce052d24969f0fc8. Report an issue: GitHub.