cilium/cilium · error

Only one of --hubble-redact-http-headers-allow and --hubble-

Error message

Only one of --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny can be specified, not both

What it means

Hubble's parser cell config validation rejects enabling both --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny at once, because header redaction supports either an allowlist or a denylist mode, not both simultaneously. validate() at pkg/hubble/parser/cell/config.go:47 returns this error when both lists are non-empty. The error surfaces at agent startup when the cell is instantiated.

Source

Thrown at pkg/hubble/parser/cell/config.go:47

	RedactHttpHeadersAllow []string `mapstructure:"hubble-redact-http-headers-allow"`
	// RedactHttpHeadersDeny controls which http headers will be redacted from
	// flows.
	RedactHttpHeadersDeny []string `mapstructure:"hubble-redact-http-headers-deny"`
}

var defaultConfig = config{
	SkipUnknownCGroupIDs:           true,
	EnableNetworkPolicyCorrelation: true,
	EnableRedact:                   false,
	RedactHttpURLQuery:             false,
	RedactHttpUserInfo:             true,
	RedactHttpHeadersAllow:         []string{},
	RedactHttpHeadersDeny:          []string{},
}

func (cfg config) validate() error {
	if len(cfg.RedactHttpHeadersAllow) > 0 && len(cfg.RedactHttpHeadersDeny) > 0 {
		return fmt.Errorf("Only one of --hubble-redact-http-headers-allow and --hubble-redact-http-headers-deny can be specified, not both")
	}
	return nil
}

func (def config) Flags(flags *pflag.FlagSet) {
	flags.Bool("hubble-skip-unknown-cgroup-ids", def.SkipUnknownCGroupIDs, "Skip Hubble events with unknown cgroup ids")
	// Hubble field redaction configuration
	flags.Bool("hubble-redact-enabled", def.EnableRedact, "Hubble redact sensitive information from flows")
	flags.Bool("hubble-redact-http-urlquery", def.RedactHttpURLQuery, "Hubble redact http URL query from flows")
	flags.Bool("hubble-redact-http-userinfo", def.RedactHttpUserInfo, "Hubble redact http user info from flows")
	flags.StringSlice("hubble-redact-http-headers-allow", def.RedactHttpHeadersAllow, "HTTP headers to keep visible in flows")
	flags.StringSlice("hubble-redact-http-headers-deny", def.RedactHttpHeadersDeny, "HTTP headers to redact from flows")
	flags.Bool("hubble-network-policy-correlation-enabled", def.EnableNetworkPolicyCorrelation, "Enable network policy correlation of Hubble flows")
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Remove one of the two flags so only the allow list or only the deny list remains
2. If you need denylist behavior, clear --hubble-redact-http-headers-allow and vice versa
3. Audit your Helm values/ConfigMap merge to ensure only one redaction key is set

Example fix

// before
--hubble-redact-http-headers-allow=Authorization
--hubble-redact-http-headers-deny=Cookie
// after
--hubble-redact-http-headers-deny=Cookie

allowSet := cfg.RedactHttpHeadersAllow != nil && len(cfg.RedactHttpHeadersAllow) > 0
denySet := len(cfg.RedactHttpHeadersDeny) > 0
if allowSet && denySet {
    return errors.New("set only one of hubble-redact-http-headers-allow or -deny")
}

if err := cfg.validate(); err != nil {
    log.WithError(err).Fatal("invalid hubble parser config")
}

When it happens

Trigger: Starting the agent (or building the Hubble cell) with both hubble-redact-http-headers-allow and hubble-redact-http-headers-deny set to non-empty values in the config, flags, or Helm values.

Common situations: Merging Helm/ConfigMap values where two operators each set a different redaction flag; leftover flags from a previous configuration combined with new ones; copy-pasting example configs containing both options.

Related errors

• must not be empty
• must not be more than 32 characters
• must consist of lower case alphanumeric characters and '-',
• lost event send interval must be greater than 0
• cluster is unset

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/2deb107c0a36e5c3. Report an issue: GitHub.