crowdsecurity/crowdsec · error

listen_addr cannot be empty

Error message

listen_addr cannot be empty

What it means

The kubernetesaudit source runs an HTTP server to receive audit webhook events, so it must know which address to bind. Configuration.Validate() rejects an empty ListenAddr because without it the audit server cannot be started.

Source

Thrown at pkg/acquisition/modules/kubernetesaudit/config.go:68

	if c.MaxBodySize == nil {
		c.MaxBodySize = new(defaultMaxBodySize)
	}
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	s.config = cfg

	return nil
}

func (c *Configuration) Validate() error {
	if c.ListenAddr == "" {
		return errors.New("listen_addr cannot be empty")
	}

	if c.ListenPort == 0 {
		return errors.New("listen_port cannot be empty")
	}

	if c.WebhookPath == "" {
		return errors.New("webhook_path cannot be empty")
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Set listen_addr in the acquisition YAML, e.g. listen_addr: 0.0.0.0 (or 127.0.0.1 for local-only).
2. Provide both listen_addr and listen_port together; port alone is not sufficient.
3. Validate the config before restarting crowdsec so the audit webhook is reachable.

Example fix

// before (yaml)
source: kubernetesaudit
listen_port: 8080

// after (yaml)
source: kubernetesaudit
listen_addr: 0.0.0.0
listen_port: 8080

if cfg.ListenAddr == "" {
    return fmt.Errorf("kubernetesaudit: listen_addr is required")
}

When it happens

Trigger: Calling Validate() on a kubernetesaudit Configuration where ListenAddr is the empty string — usually a YAML config missing the `listen_addr:` key.

Common situations: A minimal acquisition file with only source: kubernetesaudit and port set, or a config copied from docs that expects a default address which does not exist.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• listen_port cannot be empty
• webhook_path cannot be empty
• selector must be set in kubernetes acquisition
• mtls is selected, but ca_cert is not provided
• invalid auth_type: must be one of basic_auth, headers, mtls

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ef1ae23b43ae93d2. Report an issue: GitHub.