crowdsecurity/crowdsec · error

cannot create %s reader

Error message

cannot create %s reader

What it means

Defensive check in Configure(): kafka.NewReader(rConf) returned a nil *kafka.Reader even without an error, so the source cannot operate. In practice kafka.NewReader always returns a non-nil reader for a validated config, so this is an internal invariant violation — the meaningful nil path returns an empty &kafka.Reader{} earlier, which is non-nil, making this branch mostly unreachable defensive code.

Source

Thrown at pkg/acquisition/modules/kafka/config.go:94

	s.logger.Debugf("start configuring %s source", s.GetName())

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	dialer, err := s.Config.NewDialer()
	if err != nil {
		return fmt.Errorf("cannot create %s dialer: %w", s.GetName(), err)
	}

	s.Reader, err = s.Config.NewReader(dialer, s.logger)
	if err != nil {
		return fmt.Errorf("cannote create %s reader: %w", s.GetName(), err)
	}

	if s.Reader == nil {
		return fmt.Errorf("cannot create %s reader", s.GetName())
	}

	s.logger.Debugf("successfully configured %s source", s.GetName())

	return nil
}

func (c *Configuration) NewTLSConfig() (*tls.Config, error) {
	tlsConfig := tls.Config{
		InsecureSkipVerify: c.TLS.InsecureSkipVerify,
	}

	cert, err := tls.LoadX509KeyPair(c.TLS.ClientCert, c.TLS.ClientKey)
	if err != nil {
		return &tlsConfig, err
	}

	tlsConfig.Certificates = []tls.Certificate{cert}

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect Configuration.NewReader in pkg/acquisition/modules/kafka/config.go to find why it returned a nil reader with nil error
2. Ensure all error paths in NewReader return either a valid reader or a non-nil error
3. Re-run crowdsec with debug logging on the kafka datasource to trace configuration

if src.Reader == nil {
    return fmt.Errorf("kafka reader was not initialized")
}

if err := src.Configure(ctx, yamlCfg, logger, lvl); err != nil {
    return fmt.Errorf("kafka reader init invariant failed: %w", err)
}

When it happens

Trigger: Only when Config.NewReader returns (nil, nil) — an unexpected state in the kafka acquisition Configure() path; not triggered by any user configuration value directly.

Common situations: Essentially never seen in the wild; a developer debugging the kafka datasource module after modifying NewReader might hit it. There is no wrapped cause, so diagnosis requires inspecting NewReader.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• cannot create %s dialer: %w
• cannote create %s reader: %w
• while validating reader configuration: %w
• while setting offset for reader on topic '%s': %w
• while closing %s reader on topic '%s': %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/48eb77bdba38fd13. Report an issue: GitHub.