goharbor/harbor · error · Exception

Protocol in external log endpoint must be one of 'udp' or 't

Error message

Protocol in external log endpoint must be one of 'udp' or 'tcp'

What it means

Thrown by validate() in make/photon/prepare/utils/configs.py when the external log endpoint's protocol is not exactly 'udp' or 'tcp'. Harbor configures the Docker syslog log-driver with this protocol, and the driver only accepts those two values, so anything else would make the harbor-core/log shipper fail at runtime.

Source

Thrown at make/photon/prepare/utils/configs.py:43

        raise Exception("Please specify hostname")

    # protocol validate
    protocol = conf.get("protocol")
    if protocol == "https":
        if not conf.get("cert_path") or conf["cert_path"] == default_https_cert_path:
            raise Exception("Error: The protocol is https but attribute ssl_cert is not set")
        if not conf.get("cert_key_path") or conf['cert_key_path'] == default_https_key_path:
            raise Exception("Error: The protocol is https but attribute ssl_cert_key is not set")
    if protocol == "http":
        logging.warning("WARNING: HTTP protocol is insecure. Harbor will deprecate http protocol in the future. Please make sure to upgrade to https")

    # log endpoint validate
    if ('log_ep_host' in conf) and not conf['log_ep_host']:
        raise Exception('Error: must set log endpoint host to enable external host')
    if ('log_ep_port' in conf) and not conf['log_ep_port']:
        raise Exception('Error: must set log endpoint port to enable external host')
    if ('log_ep_protocol' in conf) and (conf['log_ep_protocol'] not in ['udp', 'tcp']):
        raise Exception("Protocol in external log endpoint must be one of 'udp' or 'tcp' ")

    # Storage validate
    valid_storage_drivers = ["filesystem", "azure", "gcs", "s3", "swift", "oss"]
    storage_provider_name = conf.get("storage_provider_name")
    if storage_provider_name not in valid_storage_drivers:
        raise Exception("Error: storage driver %s is not supported, only the following ones are supported: %s" % (
            storage_provider_name, ",".join(valid_storage_drivers)))

    # original is registry_storage_provider_config
    storage_provider_config = conf.get("storage_provider_config")
    if storage_provider_name != "filesystem":
        if storage_provider_config == "":
            raise Exception(
                "Error: no provider configurations are provided for provider %s" % storage_provider_name)
    # ca_bundle validate
    if conf.get('registry_custom_ca_bundle_path'):
        registry_custom_ca_bundle_path = conf.get('registry_custom_ca_bundle_path') or ''
        if registry_custom_ca_bundle_path.startswith('/data/'):

View on GitHub (pinned to 7b2fd08cc5)

Solutions

Set 'protocol:' to lowercase 'udp' or 'tcp' exactly
If the receiver expects TLS syslog, front it with a local relay (e.g. rsyslog) and point Harbor at that with tcp/udp
Re-run ./install.sh

Example fix

# harbor.yml (before)
external_endpoint:
  protocol: UDP
  host: logs.example.com
  port: 514

# harbor.yml (after)
external_endpoint:
  protocol: udp
  host: logs.example.com
  port: 514

Defensive patterns

Strategy: validation

Validate before calling

ep = (cfg.get('log') or {}).get('external_endpoint')
if ep is not None and str(ep.get('protocol', '')).strip().lower() not in ('udp', 'tcp'):
    raise SystemExit("log.external_endpoint.protocol must be 'udp' or 'tcp'")

Prevention

Use lowercase protocol values in harbor.yml
Trim whitespace when generating the file programmatically
Remember Harbor's syslog driver supports only udp and tcp, not tls

When it happens

Trigger: harbor.yml has 'log.external_endpoint.protocol:' set to anything other than lowercase 'udp' or 'tcp' — e.g. 'UDP', 'TCP', 'tls', or 'udp ' with trailing space. The comparison conf['log_ep_protocol'] not in ['udp', 'tcp'] is case- and whitespace-sensitive.

Common situations: Copy-pasting from syslog/RSyslog docs where uppercase is used; assuming 'tls' is valid for syslog shipping; values pasted with invisible whitespace.

Related errors

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/2713a055edf3339d. Report an issue: GitHub.