slackhq/nebula · error

config `%s` has invalid value (type %T): %v

Error message

config `%s` has invalid value (type %T): %v

What it means

newAllowList parses one firewall allow-list entry from config. Each CIDR key must map to a boolean allow/deny value; if config.AsBool cannot convert the raw YAML/JSON value to a bool, construction fails with this error. The type %T and value %v of the offending value are included to pinpoint the config mistake.

Source

Thrown at allow_list.go:116

	}

	rules4 := allowListRules{firstValue: true, allValuesMatch: true, defaultSet: false}
	rules6 := allowListRules{firstValue: true, allValuesMatch: true, defaultSet: false}

	for rawCIDR, rawValue := range rawMap {
		if handleKey != nil {
			handled, err := handleKey(rawCIDR, rawValue)
			if err != nil {
				return nil, err
			}
			if handled {
				continue
			}
		}

		value, ok := config.AsBool(rawValue)
		if !ok {
			return nil, fmt.Errorf("config `%s` has invalid value (type %T): %v", k, rawValue, rawValue)
		}

		ipNet, err := netip.ParsePrefix(rawCIDR)
		if err != nil {
			return nil, fmt.Errorf("config `%s` has invalid CIDR: %s. %w", k, rawCIDR, err)
		}

		ipNet = netip.PrefixFrom(ipNet.Addr().Unmap(), ipNet.Bits())

		tree.Insert(ipNet, value)

		maskBits := ipNet.Bits()

		var rules *allowListRules
		if ipNet.Addr().Is4() {
			rules = &rules4
		} else {
			rules = &rules6

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Change the CIDR's value in the config to a literal true or false
2. If using YAML strings like "true", unquote them so they parse as booleans
3. Check the reported type %T in the message to see what the value actually parsed as

Example fix

// before
remote_allow_ranges:
  10.0.0.0/8: "true"
// after
remote_allow_ranges:
  10.0.0.0/8: true

func validBoolRules(m map[string]any) bool {
	for _, v := range m {
		if _, ok := v.(bool); !ok {
			return false
		}
	}
	return true
}

func asBool(v any) (bool, bool) {
	b, ok := v.(bool)
	return b, ok
}

When it happens

Trigger: Calling NewRemoteAllowListFromConfig or newAllowListFromConfig where a CIDR key's value is a non-boolean such as a string ("yes", "allow"), an integer, a list, or a nested map instead of true/false.

Common situations: YAML configs using unquoted yes/no (older YAML 1.1 habit), values wrapped in quotes becoming strings, or users pasting rules where the value is meant for a different firewall syntax (e.g. iptables accept/drop).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• group should contain a single value, an array with more than
• config `%s` contains both true and false rules, but no defau
• config `%s` contains both true and false rules, but no defau
• config `%s.interfaces` is invalid (type %T): %v
• config `%s.interfaces` has invalid value (type %T): %v

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/dede1da7c09d4b19. Report an issue: GitHub.