cilium/cilium · error

unknown CIDR match mode: %s

Error message

unknown CIDR match mode: %s

What it means

DaemonConfig validation checks each entry of policy-cidr-match-mode against the whitelist of accepted values. This error is returned when a configured value is anything other than "nodes" or "pods", since Cilium can only match CIDRs against node or pod prefixes.

Source

Thrown at pkg/option/config.go:2118

func (c *DaemonConfig) PolicyCIDRMatchesPods() bool {
	return slices.Contains(c.PolicyCIDRMatchMode, "pods")
}

// PerNodeLabelsEnabled returns true if per-node labels feature
// is enabled
func (c *DaemonConfig) PerNodeLabelsEnabled() bool {
	return c.EnableNodeSelectorLabels
}

func (c *DaemonConfig) validatePolicyCIDRMatchMode() error {
	// Currently, the acceptable values are "nodes" and "pods".
	for _, mode := range c.PolicyCIDRMatchMode {
		switch mode {
		case "nodes", "pods":
			continue
		default:
			return fmt.Errorf("unknown CIDR match mode: %s", mode)
		}
	}
	return nil
}

// DirectRoutingDeviceRequired return whether the Direct Routing Device is needed under
// the current configuration.
func (c *DaemonConfig) DirectRoutingDeviceRequired(kprCfg kpr.KPRConfig, wireguardEnabled bool) bool {
	// BPF NodePort and BPF Host Routing are using the direct routing device now.
	// When tunneling is enabled, node-to-node redirection will be done by tunneling.
	BPFHostRoutingEnabled := !c.UnsafeDaemonConfigOption.EnableHostLegacyRouting

	// XDP needs ipv4_direct_routing when building tunnel headers:
	if kprCfg.KubeProxyReplacement && c.NodePortAcceleration != NodePortAccelerationDisabled {
		return true
	}

	return kprCfg.KubeProxyReplacement || BPFHostRoutingEnabled || wireguardEnabled

View on GitHub (pinned to ac7b90affa)

Solutions

1. Set policy-cidr-match-mode to only "nodes" and/or "pods" (repeat the flag/entry for multiple values)
2. Check for typos: exact lowercase strings "nodes" and "pods" only
3. If you intended both modes, provide them as separate list entries, not "pods,nodes"
4. Fix the value in the cilium-config ConfigMap or Helm values (policyCIDRMatchMode) and restart the agent

Example fix

// before (cilium-config ConfigMap)
policy-cidr-match-mode: "pods,nodes"
// after
policy-cidr-match-mode: "pods"
# plus a second entry: policy-cidr-match-mode: "nodes"

import "slices"

func validCIDRMatchModes(modes []string) error {
    for _, m := range modes {
        if m != "nodes" && m != "pods" {
            return fmt.Errorf("unknown CIDR match mode: %s", m)
        }
    }
    return nil
}
// call before applying config: validCIDRMatchMode(cfg.PolicyCIDRMatchMode)

if err := daemonConfig.Validate(vp); err != nil {
    if strings.Contains(err.Error(), "unknown CIDR match mode") {
        log.Fatalf("fix policy-cidr-match-mode (allowed: nodes, pods): %v", err)
    }
    return err
}

When it happens

Trigger: Setting --policy-cidr-match-mode (or PolicyCIDRMatchMode in config) to any value other than "nodes" or "pods" — e.g. a typo like "node", "pod", or "pods,nodes" passed as one comma-joined entry instead of a list — and then calling DaemonConfig.Validate().

Common situations: Typo or singular/plural mistake in cilium-config ConfigMap; passing a comma-separated string where repeated list values are expected; upgrading Cilium and carrying over an invalid or deprecated value from older Helm values.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Invalid CIDR: %s
• Invalid CIDR %q: %w
• invalid local redirect policy %v
• Prefix length must be /64
• Invalid comma separated list of ranges for %s option

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/eef3eb345f5fb1dd. Report an issue: GitHub.