cilium/cilium · error

port must be specified

Error message

port must be specified

What it means

SanitizePortInfo in clrp_types.go validates a PortInfo from a CiliumLocalRedirectPolicy spec. If pInfo.Port is the empty string it returns 'port must be specified' because a redirect policy port must carry a numeric port value. The error surfaces when the CRD is processed (policy normalization).

Source

Thrown at pkg/k8s/apis/cilium.io/v2/clrp_types.go:231

type CiliumLocalRedirectPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	// Items is a list of CiliumLocalRedirectPolicy
	Items []CiliumLocalRedirectPolicy `json:"items"`
}

// SanitizePortInfo sanitizes all the fields in the PortInfo.
// It returns port number, name, and protocol derived from the given input  and error (failure cases).
func (pInfo *PortInfo) SanitizePortInfo(checkNamedPort bool) (uint16, string, lb.L4Type, error) {
	var (
		pInt     uint16
		pName    string
		protocol lb.L4Type
	)
	// Sanitize port
	if pInfo.Port == "" {
		return pInt, pName, protocol, fmt.Errorf("port must be specified")
	} else {
		p, err := strconv.ParseUint(pInfo.Port, 0, 16)
		if err != nil {
			return pInt, pName, protocol, fmt.Errorf("unable to parse port: %w", err)
		}
		if p == 0 {
			return pInt, pName, protocol, fmt.Errorf("port cannot be 0")
		}
		pInt = uint16(p)
	}
	// Sanitize name
	if checkNamedPort {
		if pInfo.Name == "" {
			return pInt, pName, protocol, fmt.Errorf("port %s in the local "+
				"redirect policy spec must have a valid IANA_SVC_NAME, as there are multiple ports", pInfo.Port)

		}
		if !iana.IsSvcName(pInfo.Name) {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Set the port field to a numeric value (e.g. port: 8080) in every port entry of the CLRP spec
2. Re-apply the policy with kubectl apply after fixing and verify with kubectl get ciliumlocalredirectpolicy -o yaml
3. If a named port is intended, still provide the numeric port along with the name

Example fix

// before
ports:
- name: "http"
// after
ports:
- name: "http"
  port: 80
  protocol: TCP

for _, p := range lrp.Spec.RedirectFrontend.Ports {
    if p.Port == "" || p.Port == "0" {
        return fmt.Errorf("each CLRP port entry must specify a numeric port")
    }
    n, err := strconv.ParseUint(p.Port, 0, 16)
    if err != nil || n == 0 { return fmt.Errorf("invalid port %q", p.Port) }
}

if err := k8sClient.Create(ctx, lrp); err != nil {
    if strings.Contains(err.Error(), "port must be specified") {
        // fix spec and re-apply
    }
}

When it happens

Trigger: A CiliumLocalRedirectPolicy frontend/backport PortInfo entry has Port: "" (only a name, or an empty object) and SanitizePortInfo is invoked on it.

Common situations: Users specify only portName or rely on a service name and forget the numeric port field; YAML templating leaves the port empty; copying an example and deleting the port line.

Related errors

• unable to parse port: %w
• port cannot be 0
• port %s in the local redirect policy spec must have a valid
• port name %s isn't a valid IANA_SVC_NAME
• invalid address matcher port: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/a1049a9db2979a10. Report an issue: GitHub.