crowdsecurity/crowdsec · error

listen_port cannot be empty

Error message

listen_port cannot be empty

What it means

The kubernetesaudit source's webhook HTTP server needs a TCP port to listen on. Configuration.Validate() rejects ListenPort == 0 because port 0 would mean an OS-assigned ephemeral port that the Kubernetes API server's audit webhook configuration could never target reliably.

Source

Thrown at pkg/acquisition/modules/kubernetesaudit/config.go:72

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	s.config = cfg

	return nil
}

func (c *Configuration) Validate() error {
	if c.ListenAddr == "" {
		return errors.New("listen_addr cannot be empty")
	}

	if c.ListenPort == 0 {
		return errors.New("listen_port cannot be empty")
	}

	if c.WebhookPath == "" {
		return errors.New("webhook_path cannot be empty")
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	return nil
}


func (c *Configuration) Normalize() {
	if c.WebhookPath != "" && c.WebhookPath[0] != '/' {
		c.WebhookPath = "/" + c.WebhookPath
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Set listen_port to a fixed port (e.g. listen_port: 8080) that matches the audit sink URL configured in the Kubernetes API server.
2. Make sure the port is not already in use and is reachable from the API server.
3. Update the cluster's audit policy/webhook backend URL to use the same host:port.

Example fix

// before (yaml)
source: kubernetesaudit
listen_addr: 0.0.0.0

// after (yaml)
source: kubernetesaudit
listen_addr: 0.0.0.0
listen_port: 8080

if cfg.ListenPort == 0 {
    return fmt.Errorf("kubernetesaudit: listen_port is required and must be non-zero")
}

When it happens

Trigger: Calling Validate() on a kubernetesaudit Configuration where ListenPort is 0 (unset) — a YAML config missing `listen_port:` or setting it to 0.

Common situations: Users specify listen_addr but forget listen_port, or a templated port variable resolves to 0/empty and Go's zero-value default kicks in.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• listen_addr cannot be empty
• webhook_path cannot be empty
• selector must be set in kubernetes acquisition
• mtls is selected, but ca_cert is not provided
• invalid auth_type: must be one of basic_auth, headers, mtls

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/954815d28555662c. Report an issue: GitHub.