istio/istio · error

http1 max pending requests must be non-negative

Error message

http1 max pending requests must be non-negative

What it means

Thrown by validateMeshConfigDefaultTrafficPolicy when mesh.defaultTrafficPolicy.connectionPool.http.http1MaxPendingRequests is negative. Pending-request ceilings are Envoy uint32-style bounds; negative values are meaningless and indicate a config or template bug rather than a tuning choice.

Source

Thrown at pkg/config/validation/agent/validation.go:872

		v = AppendWarningf(v, "detected duplicate ECDH curves: %v", sets.SortedList(duplicateECDHCurves))
	}
	return v
}

// validateMeshConfigDefaultTrafficPolicy validates the value constraints of the mesh-wide
// baseline traffic policy. It mirrors the connectionPool / outlierDetection checks applied to
// a DestinationRule traffic policy, since the field reuses the same sub-types.
func validateMeshConfigDefaultTrafficPolicy(dtp *meshconfig.MeshConfig_DefaultTrafficPolicy) (errs Validation) {
	if dtp == nil {
		return errs
	}
	if cp := dtp.GetConnectionPool(); cp != nil {
		if cp.Http == nil && cp.Tcp == nil {
			errs = AppendValidation(errs, errors.New("connection pool must have at least one field"))
		}
		if http := cp.Http; http != nil {
			if http.Http1MaxPendingRequests < 0 {
				errs = AppendValidation(errs, errors.New("http1 max pending requests must be non-negative"))
			}
			if http.Http2MaxRequests < 0 {
				errs = AppendValidation(errs, errors.New("http2 max requests must be non-negative"))
			}
			if http.MaxRequestsPerConnection < 0 {
				errs = AppendValidation(errs, errors.New("max requests per connection must be non-negative"))
			}
			if http.MaxRetries < 0 {
				errs = AppendValidation(errs, errors.New("max retries must be non-negative"))
			}
			if http.MaxConcurrentStreams < 0 {
				errs = AppendValidation(errs, errors.New("max concurrent streams must be non-negative"))
			}
			if http.IdleTimeout != nil {
				errs = AppendValidation(errs, ValidateDuration(http.IdleTimeout))
			}
			if http.H2UpgradePolicy == networking.ConnectionPoolSettings_HTTPSettings_UPGRADE && http.UseClientProtocol {
				errs = AppendValidation(errs, errors.New("use client protocol must not be true when H2UpgradePolicy is UPGRADE"))

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Set http1MaxPendingRequests to a non-negative integer; use a large value (or omit the field) for effectively-unlimited.
2. Fix the templating/arith that produced the negative number; add a min-clamp or schema check in CI.
3. Re-run mesh config validation.

Example fix

# before
defaultTrafficPolicy:
  connectionPool:
    http:
      http1MaxPendingRequests: -1

# after
defaultTrafficPolicy:
  connectionPool:
    http:
      http1MaxPendingRequests: 1024

func nonNeg(v int32) error { if v < 0 { return fmt.Errorf("negative value %d not allowed", v) }; return nil }
// apply to dtp.GetConnectionPool().GetHttp().GetHttp1MaxPendingRequests()

When it happens

Trigger: `defaultTrafficPolicy: {connectionPool: {http: {http1MaxPendingRequests: -1}}}` validated via ValidateMeshConfig (line 1070).

Common situations: Template arithmetic producing negative numbers (e.g. 'replicas - 5' with replicas < 5); sentinel values like -1 intended to mean 'unlimited'; YAML unmarshalling a computed value.

Related errors

• max requests per connection must be non-negative
• connection pool must have at least one field
• http2 max requests must be non-negative
• max retries must be non-negative
• max concurrent streams must be non-negative

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/2ea355fdcb4afa20. Report an issue: GitHub.