crowdsecurity/crowdsec · error

webhook_path cannot be empty

Error message

webhook_path cannot be empty

What it means

The kubernetesaudit source serves audit events at a specific HTTP endpoint path; Configuration.Validate() requires WebhookPath to be non-empty so the server can register the handler route that the Kubernetes audit sink POSTs to.

Source

Thrown at pkg/acquisition/modules/kubernetesaudit/config.go:76

		return err
	}

	s.config = cfg

	return nil
}

func (c *Configuration) Validate() error {
	if c.ListenAddr == "" {
		return errors.New("listen_addr cannot be empty")
	}

	if c.ListenPort == 0 {
		return errors.New("listen_port cannot be empty")
	}

	if c.WebhookPath == "" {
		return errors.New("webhook_path cannot be empty")
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	return nil
}


func (c *Configuration) Normalize() {
	if c.WebhookPath != "" && c.WebhookPath[0] != '/' {
		c.WebhookPath = "/" + c.WebhookPath
	}
}

func (s *Source) Configure(_ context.Context, config []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger

View on GitHub (pinned to 909b515798)

Solutions

1. Set webhook_path in the acquisition YAML, e.g. webhook_path: /audit or /kubernetes-audit.
2. Use the same path in the Kubernetes API server audit webhook backend configuration (path field of the webhook config).
3. Keep max_body_size positive if set, to pass the remaining validation checks.

Example fix

// before (yaml)
source: kubernetesaudit
listen_addr: 0.0.0.0
listen_port: 8080

// after (yaml)
source: kubernetesaudit
listen_addr: 0.0.0.0
listen_port: 8080
webhook_path: /audit

if cfg.WebhookPath == "" {
    return fmt.Errorf("kubernetesaudit: webhook_path is required")
}

When it happens

Trigger: Calling Validate() on a kubernetesaudit Configuration where WebhookPath is the empty string — a YAML config missing the `webhook_path:` key.

Common situations: Users set address/port but assume a default path exists; or a config fragment copied without the path key. The path must also match the `path` in the API server's webhook audit sink config.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• listen_addr cannot be empty
• listen_port cannot be empty
• selector must be set in kubernetes acquisition
• mtls is selected, but ca_cert is not provided
• invalid auth_type: must be one of basic_auth, headers, mtls

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/279467693e7e4d3e. Report an issue: GitHub.