crowdsecurity/crowdsec · error

cannot create %s dialer: %w

Error message

cannot create %s dialer: %w

What it means

Wraps any failure from Configuration.NewDialer() while the kafka acquisition source is being configured in CrowdSec. NewDialer fails when the `timeout` value is not an integer, or when TLS is configured and the client cert/key pair or CA cert file cannot be loaded/parsed. The kafka source name ('kafka') is interpolated so the operator knows which datasource failed during acquisition setup.

Source

Thrown at pkg/acquisition/modules/kafka/config.go:85

	s.logger.Debugf("successfully parsed kafka configuration : %+v", s.Config)

	return err
}

func (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

	s.logger.Debugf("start configuring %s source", s.GetName())

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	dialer, err := s.Config.NewDialer()
	if err != nil {
		return fmt.Errorf("cannot create %s dialer: %w", s.GetName(), err)
	}

	s.Reader, err = s.Config.NewReader(dialer, s.logger)
	if err != nil {
		return fmt.Errorf("cannote create %s reader: %w", s.GetName(), err)
	}

	if s.Reader == nil {
		return fmt.Errorf("cannot create %s reader", s.GetName())
	}

	s.logger.Debugf("successfully configured %s source", s.GetName())

	return nil
}

func (c *Configuration) NewTLSConfig() (*tls.Config, error) {
	tlsConfig := tls.Config{

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the `timeout` value in the kafka acquisition yaml to a plain integer number of seconds (e.g. `timeout: 10`), or remove it to use the 10s default
2. Check the paths in tls.client_cert, tls.client_key and tls.ca_cert exist and are readable by the crowdsec process (ls -l, correct mounts)
3. Validate the cert/key pair with `openssl x509 -in cert.pem -noout` and `openssl rsa -in key.pem -check`; regenerate if malformed
4. Read the wrapped %w error in the crowdsec logs to identify which sub-step (timeout parse vs TLS load) failed

Example fix

// before
source: kafka
brokers:
  - broker:9092
topic: crowdsec
timeout: 10s   # Atoi fails -> cannot create kafka dialer
// after
source: kafka
brokers:
  - broker:9092
topic: crowdsec
timeout: 10

// before writing the acquisition yaml
if t, ok := cfg["timeout"]; ok {
    if _, err := strconv.Atoi(t.(string)); err != nil {
        return fmt.Errorf("kafka timeout must be integer seconds, got %q", t)
    }
}
for _, p := range []string{tlsCfg.ClientCert, tlsCfg.ClientKey, tlsCfg.CaCert} {
    if _, err := os.Stat(p); err != nil {
        return fmt.Errorf("TLS file missing: %s", p)
    }
}

if err := src.Configure(ctx, yamlCfg, logger, lvl); err != nil {
    var pathErr *fs.PathError
    if errors.As(err, &pathErr) {
        logger.Errorf("kafka TLS file problem: %v", pathErr)
    }
    return fmt.Errorf("kafka datasource setup failed: %w", err)
}

When it happens

Trigger: CrowdSec loads a kafka datasource (yaml acquisition file) and Configure() calls Config.NewDialer(); it fires when `timeout:` is a non-numeric string (strconv.Atoi error), or when `tls.client_cert`/`tls.client_key` fail tls.LoadX509KeyPair (missing/malformed files) or `tls.ca_cert` fails os.ReadFile.

Common situations: Typo in the timeout value (e.g. '10s' instead of '10', since the field is seconds as an integer, not a duration); wrong paths to cert/key/CA files inside the container; certs mounted but unreadable by the crowdsec user; PEM files that are actually empty or corrupted.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• cannote create %s reader: %w
• path must start with /
• server_cert is required
• server_key is required
• cannot specify both group_id and partition

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/21da0bd1df0dd4b9. Report an issue: GitHub.