crowdsecurity/crowdsec · error

max_body_size must be positive

Error message

max_body_size must be positive

What it means

The kubernetesaudit acquisition source validates its configuration before starting the webhook server. max_body_size limits the size of audit event payloads the HTTP webhook accepts; the source refuses to start with a non-positive value because it would reject every incoming event or misconfigure the body reader.

Source

Thrown at pkg/acquisition/modules/kubernetesaudit/config.go:80

	return nil
}

func (c *Configuration) Validate() error {
	if c.ListenAddr == "" {
		return errors.New("listen_addr cannot be empty")
	}

	if c.ListenPort == 0 {
		return errors.New("listen_port cannot be empty")
	}

	if c.WebhookPath == "" {
		return errors.New("webhook_path cannot be empty")
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	return nil
}


func (c *Configuration) Normalize() {
	if c.WebhookPath != "" && c.WebhookPath[0] != '/' {
		c.WebhookPath = "/" + c.WebhookPath
	}
}

func (s *Source) Configure(_ context.Context, config []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(config)
	if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Set max_body_size to a positive byte value (e.g. 10485760 for 10MB) in the kubernetesaudit YAML config
2. Remove the max_body_size key entirely to use the default size limit
3. Fix the code computing the value so it yields a positive integer

Example fix

// before
max_body_size: 0
// after
max_body_size: 10485760

if cfg.MaxBodySize != nil && *cfg.MaxBodySize <= 0 {
    return fmt.Errorf("max_body_size must be positive, got %d", *cfg.MaxBodySize)
}

When it happens

Trigger: Calling Validate() on a KubernetesAuditCfg whose MaxBodySize pointer is non-nil and points to a value <= 0, e.g. a YAML config with `max_body_size: 0` or a negative number, or programmatic construction with a zero/negative int.

Common situations: Users set max_body_size: 0 thinking it means 'unlimited', copy a config where the field was zeroed, or compute the value dynamically and get a non-positive result.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• loki query is mandatory
• path must start with /
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f2ae0e2d4dd33320. Report an issue: GitHub.