cilium/cilium · error

invalid exit code %q in error %s

Error message

invalid exit code %q in error %s

What it means

Raised by extractExitCode when the regex matched a substring but strconv.Atoi cannot parse it as an integer — practically unreachable with a numeric regex, but guards against malformed matches. Returns ExitInvalidCode.

Source

Thrown at cilium-cli/connectivity/check/action.go:477

		i, err := strconv.Atoi(m[1])
		if err != nil || i < 1 || i > 255 {
			continue
		}
		return ExitCode(i), true
	}
	return ExitInvalidCode, false
}

// extractExitCode extracts command exit code from ExecInPod() error output
func (a *Action) extractExitCode(err error) (ExitCode, error) {
	// Extract exit code from 'err'
	m := exitCodeRegex.FindStringSubmatch(err.Error())
	if len(m) != 2 || len(m[1]) == 0 {
		return ExitInvalidCode, fmt.Errorf("unable to extract exit code from error: %s", err.Error())
	}
	i, err := strconv.Atoi(m[1])
	if err != nil {
		return ExitInvalidCode, fmt.Errorf("invalid exit code %q in error %s", m[1], err.Error())
	}
	if i < 0 || i > 255 {
		return ExitInvalidCode, fmt.Errorf("exit code %q out of range [0-255]", m[1])
	}
	return ExitCode(i), nil
}

// expectedExitCode returns the expected shell exit code, or ExitAnyError for any value between 1-255.
func (a *Action) expectedExitCode() ExitCode {
	if a.expEgress.ExitCode == 0 && a.expIngress.ExitCode == 0 {
		return 0 // success
	}
	// If egress and ingress expect the command to fail in different
	// ways egress enforcement will cause the command to fail first.
	if a.expEgress.ExitCode != 0 {
		return a.expEgress.ExitCode
	}
	return a.expIngress.ExitCode

View on GitHub (pinned to ac7b90affa)

Solutions

1. Verify your cilium-cli build is unmodified (exitCodeRegex matches 'exit status <int>')
2. Report the raw error string upstream if it appears in a stock build
3. Re-run the connectivity test to see if it is transient

func (a *Action) extractExitCode(err error) (ExitCode, error) {
    m := exitCodeRegex.FindStringSubmatch(err.Error())
    if len(m) != 2 || len(m[1]) == 0 {
        return ExitInvalidCode, fmt.Errorf("unable to extract exit code from error: %s", err.Error())
    }
    i, convErr := strconv.Atoi(m[1])
    if convErr != nil {
        return ExitInvalidCode, convErr // typed sentinel for callers
    }
    return ExitCode(i), nil
}

code, err := a.extractExitCode(err)
if code == ExitInvalidCode {
    // do not use code for pass/fail; surface raw err instead
    return err
}

When it happens

Trigger: The regex captured group m[1] contains non-numeric text while still being non-empty, during ExecInPod result processing.

Common situations: Custom/patched cilium-cli builds with a modified exitCodeRegex; unexpected error string formats from exec infrastructure.

Related errors

• unable to extract exit code from error: %s
• exit code %q out of range [0-255]
• unable to parse %s: %w
• Error parsing Cilium network policies: %w
• Error parsing Cilium Cluster Wide network policies: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/98b9187451597fe0. Report an issue: GitHub.