What causes "%s is not a valid value path element" in istio/istio?

Wrap list-selector elements in brackets: use '[value]' or '[key:value]' instead of the bare form

%s is not a valid value path element

Error message

%s is not a valid value path element

What it means

util.PathV extracts the value part of a bracketed path element. It accepts '[:value]' (value-only) and returns the whole 'key:value' otherwise; the error fires only when RemoveBrackets yields nothing — i.e. the element is empty or not of the form '[...]'. It usually surfaces wrapped as 'path %s: %s' when tpath tries to match leaf-list elements.

Source

Thrown at operator/pkg/util/path.go:150

	kv := splitEscaped(pe, kvSeparatorRune)
	return kv[0], kv[1], nil
}

// PathV returns the value string part of the entire value path element.
// It returns an error if pe is not a value path element.
func PathV(pe string) (string, error) {
	// For :val, return the value only
	if IsVPathElement(pe) {
		v, _ := RemoveBrackets(pe)
		return v[1:], nil
	}

	// For key:val, return the whole thing
	v, _ := RemoveBrackets(pe)
	if len(v) > 0 {
		return v, nil
	}
	return "", fmt.Errorf("%s is not a valid value path element", pe)
}

// PathN returns the index part of the entire value path element.
// It returns an error if pe is not an index path element.
func PathN(pe string) (int, error) {
	if !IsNPathElement(pe) {
		return -1, fmt.Errorf("%s is not a valid index path element", pe)
	}
	v, _ := RemoveBrackets(pe)
	return strconv.Atoi(v)
}

// RemoveBrackets removes the [] around pe and returns the resulting string. It returns false if pe is not surrounded
// by [].
func RemoveBrackets(pe string) (string, bool) {
	if !strings.HasPrefix(pe, "[") || !strings.HasSuffix(pe, "]") {
		return "", false
	}

View on GitHub (pinned to 8dc789c5cf)

Solutions

Wrap list-selector elements in brackets: use '[value]' or '[key:value]' instead of the bare form
Validate elements with util.IsVPathElement / util.IsValidPathElement before building the path
For leaf-list matching pass '[:value]' so PathV returns just the value part

Example fix

// before
util.PathV("mypod")
// after
util.PathV("[:mypod]")

Defensive patterns

Strategy: validation

Validate before calling

if !util.IsVPathElement(pe) && !util.IsKVPathElement(pe) {
    return fmt.Errorf("element %q is not a bracketed [value] or [key:value] element", pe)
}

Type guard

func isBracketed(pe string) bool {
    _, ok := util.RemoveBrackets(pe)
    return ok
}

Try / catch

v, err := util.PathV(pe)
if err != nil {
    return fmt.Errorf("leaf-list matching requires bracketed elements like [:value]: %w", err)
}

Prevention

Always bracket list-selector elements; bare segments are treated as map keys elsewhere and fail here
Use '[:value]' for leaf-list matching so PathV strips the leading colon

When it happens

Trigger: Calling PathV with an unbracketed element ('somekey'), an empty string, or a malformed '['-only fragment; in tpath traversal, a leaf list in the tree being traversed with a path element that lacks brackets.

Common situations: Hand-built paths passed to tpath/util APIs without the bracket convention; overlays where a list path was written as plain dotted segments; programmatic callers assuming PathV tolerates bare keys.

Related errors

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/cf8509d18d719edd. Report an issue: GitHub.