cloudflare/cloudflared · error

Failed to create feature selector

Error message

Failed to create feature selector

What it means

prepareTunnelConfig calls features.NewFeatureSelector to compute which protocol/features the connector will use, given the named tunnel properties and CLI flags. If feature selection cannot be produced the whole tunnel configuration fails and StartServer aborts. This guards against invalid combinations of PostQuantum mode and feature flags.

Source

Thrown at cmd/cloudflared/tunnel/configuration.go:125

			}
		}
	}
	return false
}

func prepareTunnelConfig(
	ctx context.Context,
	c *cli.Context,
	info *cliutil.BuildInfo,
	log, logTransport *zerolog.Logger,
	observer *connection.Observer,
	namedTunnel *connection.TunnelProperties,
) (*supervisor.TunnelConfig, *orchestration.Config, error) {
	transportProtocol := c.String(flags.Protocol)
	isPostQuantumEnforced := c.Bool(flags.PostQuantum)
	featureSelector, err := features.NewFeatureSelector(ctx, namedTunnel.Credentials.AccountTag, c.StringSlice(flags.Features), isPostQuantumEnforced, log)
	if err != nil {
		return nil, nil, errors.Wrap(err, "Failed to create feature selector")
	}

	clientConfig, err := client.NewConfig(info.Version(), info.OSArch(), featureSelector)
	if err != nil {
		return nil, nil, err
	}

	log.Info().Msgf("Generated Connector ID: %s", clientConfig.ConnectorID)

	tags, err := NewTagSliceFromCLI(c.StringSlice(flags.Tag))
	if err != nil {
		log.Err(err).Msg("Tag parse failure")
		return nil, nil, errors.Wrap(err, "Tag parse failure")
	}
	tags = append(tags, pogs.Tag{Name: "ID", Value: clientConfig.ConnectorID.String()})

	cfg := config.GetConfiguration()
	ingressRules, err := ingress.ParseIngressFromConfigAndCLI(cfg, c, log)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check the exact value passed to --post-quantum / feature flags against `cloudflared tunnel run --help` and fix the typo.
2. Remove the experimental feature flags and run with defaults to isolate the offending flag.
3. Upgrade or match cloudflared version to one that supports the feature flags you are passing.
4. Review the wrapped inner error message (logged) for the specific rejected input.

Example fix

// before
cloudflared tunnel run --post-quantum=true my-tunnel
// flag no longer takes a value
// after
cloudflared tunnel run --post-quantum my-tunnel

// validate flag values before launch
validPQ := map[string]bool{"": true, "prefer": true, "strict": true}
if !validPQ[pqFlag] { return fmt.Errorf("unsupported --post-quantum value: %s", pqFlag) }

if err != nil {
	return nil, nil, errors.Wrap(err, "Failed to create feature selector")
}

When it happens

Trigger: Starting a tunnel with an invalid --post-quantum value or a features flag combination that features.NewFeatureSelector rejects (unsupported feature set for the supplied TunnelProperties).

Common situations: Typos in the --post-quantum flag; users copying flags from newer/older cloudflared versions whose feature selector no longer accepts them; scripted deployments with stale flag values.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• No configuration file was found. Please create one, or use t
• ErrNoIngressRulesCLI
• Did not receive final destination from client. The --destina
• configuration file %s must contain entries for the tunnel to
• possible conflicting configuration in %[1]s and %[2]s. Eithe

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/a77068fb5c141828. Report an issue: GitHub.