cloudflare/cloudflared · error

Rule #%d has an invalid regex

Error message

Rule #%d has an invalid regex

What it means

Each ingress rule may specify a 'path' regular expression used to match requests. validateIngress compiles it with regexp.Compile; if compilation fails, the error is wrapped with the rule number. The whole ingress config fails to parse.

Source

Thrown at ingress/ingress.go:344

			return Ingress{}, err
		}

		isCatchAllRule := (r.Hostname == "" || r.Hostname == "*") && r.Path == ""
		punycodeHostname := ""
		if !isCatchAllRule {
			punycode, err := idna.Lookup.ToASCII(r.Hostname)
			// Don't provide the punycode hostname if it is the same as the original hostname
			if err == nil && punycode != r.Hostname {
				punycodeHostname = punycode
			}
		}

		var pathRegexp *Regexp
		if r.Path != "" {
			var err error
			regex, err := regexp.Compile(r.Path)
			if err != nil {
				return Ingress{}, errors.Wrapf(err, "Rule #%d has an invalid regex", i+1)
			}
			pathRegexp = &Regexp{Regexp: regex}
		}

		rules[i] = Rule{
			Hostname:         r.Hostname,
			punycodeHostname: punycodeHostname,
			Service:          service,
			Path:             pathRegexp,
			Handlers:         handlers,
			Config:           cfg,
		}
	}
	return Ingress{Rules: rules, Defaults: defaults}, nil
}

func validateHostname(r config.UnvalidatedIngressRule, ruleIndex, totalRules int) error {
	// Ensure that the hostname doesn't contain port

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Test the path pattern with Go's regexp.Compile (or regexpcheck tools) to find the syntax error reported in the wrapped inner error.
2. Escape special regex characters you intend literally, e.g. '\.' instead of '.'.
3. Replace PCRE-only constructs (lookaheads, backreferences) with RE2-compatible patterns.
4. If you only want prefix matching, use a plain pattern like '^/api/' instead of complex regex.

Example fix

// before
path: /api/(?<version>v\d+)/
// after
path: ^/api/(v[0-9]+)/

if r.Path != "" {
    if _, err := regexp.Compile(r.Path); err != nil {
        return fmt.Errorf("rule path %q is not a valid Go regex: %w", r.Path, err)
    }
}

ing, err := ingress.ParseIngress(conf)
if err != nil && strings.Contains(err.Error(), "invalid regex") {
    return fmt.Errorf("fix the path regex in your ingress rules: %w", err)
}

When it happens

Trigger: An ingress rule whose path is not a valid Go RE2 regex, e.g. '/users/(\d+' (unbalanced group), '*' (missing operand), or unsupported lookahead ' (?=...)'.

Common situations: Porting regexes from PCRE-capable languages (JavaScript, Python) that use lookaheads/lookbehinds or backreferences unsupported by Go's RE2; unescaped special characters in hand-written YAML paths.

Related errors

• invalid HTTP status code: %d
• invalid HTTP status code
• No configuration file was found. Please create one, or use t
• cloudflared tunnel rule expects a single argument, the URL t
• ErrNoIngressRules

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c612fdefaff63bdd. Report an issue: GitHub.