istio/istio · error

max retries must be non-negative

Error message

max retries must be non-negative

What it means

Thrown by validateMeshConfigDefaultTrafficPolicy when mesh.defaultTrafficPolicy.connectionPool.http.maxRetries is negative. The mesh-wide baseline retry ceiling must be a non-negative count; a negative value signals a config error (not a valid way to disable retries — omit or zero it instead).

Source

Thrown at pkg/config/validation/agent/validation.go:881

	if dtp == nil {
		return errs
	}
	if cp := dtp.GetConnectionPool(); cp != nil {
		if cp.Http == nil && cp.Tcp == nil {
			errs = AppendValidation(errs, errors.New("connection pool must have at least one field"))
		}
		if http := cp.Http; http != nil {
			if http.Http1MaxPendingRequests < 0 {
				errs = AppendValidation(errs, errors.New("http1 max pending requests must be non-negative"))
			}
			if http.Http2MaxRequests < 0 {
				errs = AppendValidation(errs, errors.New("http2 max requests must be non-negative"))
			}
			if http.MaxRequestsPerConnection < 0 {
				errs = AppendValidation(errs, errors.New("max requests per connection must be non-negative"))
			}
			if http.MaxRetries < 0 {
				errs = AppendValidation(errs, errors.New("max retries must be non-negative"))
			}
			if http.MaxConcurrentStreams < 0 {
				errs = AppendValidation(errs, errors.New("max concurrent streams must be non-negative"))
			}
			if http.IdleTimeout != nil {
				errs = AppendValidation(errs, ValidateDuration(http.IdleTimeout))
			}
			if http.H2UpgradePolicy == networking.ConnectionPoolSettings_HTTPSettings_UPGRADE && http.UseClientProtocol {
				errs = AppendValidation(errs, errors.New("use client protocol must not be true when H2UpgradePolicy is UPGRADE"))
			}
		}
		if tcp := cp.Tcp; tcp != nil {
			if tcp.MaxConnections < 0 {
				errs = AppendValidation(errs, errors.New("max connections must be non-negative"))
			}
			if tcp.ConnectTimeout != nil {
				errs = AppendValidation(errs, ValidateDuration(tcp.ConnectTimeout))
			}

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Set maxRetries to >= 0, or remove the field to keep Envoy/Istio defaults.
2. To minimize retries, set it to 0 rather than negative.
3. Add value clamping in whatever generates the config.

Example fix

# before
defaultTrafficPolicy:
  connectionPool:
    http:
      maxRetries: -1

# after
defaultTrafficPolicy:
  connectionPool:
    http:
      maxRetries: 0

if http := dtp.GetConnectionPool().GetHttp(); http != nil && http.GetMaxRetries() < 0 {
    return fmt.Errorf("maxRetries must be >= 0; use 0 to disable retries")
}

When it happens

Trigger: `defaultTrafficPolicy: {connectionPool: {http: {maxRetries: -3}}}` passing through ValidateMeshConfig's defaultTrafficPolicy validation.

Common situations: Users trying to disable retries with -1; Helm arithmetic producing negatives; env-var-sourced values parsed without bounds checking.

Related errors

• connection pool must have at least one field
• http1 max pending requests must be non-negative
• http2 max requests must be non-negative
• max requests per connection must be non-negative
• max concurrent streams must be non-negative

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/0fb3bdc70fcc217d. Report an issue: GitHub.