What causes "config `%s.interfaces` has invalid key: %s: %v" in slackhq/nebula?

Fix the key to be a valid regex, e.g. use eth.* instead of eth*

config `%s.interfaces` has invalid key: %s: %v

Error message

config `%s.interfaces` has invalid key: %s: %v

What it means

Each key in the `interfaces` map is compiled as an anchored regex ("^" + name + "$") to match interface names. If the key is not a valid regular expression, the config is rejected and the regexp error is included in the message.

Source

Thrown at allow_list.go:189

func getAllowListInterfaces(k string, v any) ([]AllowListNameRule, error) {
	var nameRules []AllowListNameRule

	rawRules, ok := v.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("config `%s.interfaces` is invalid (type %T): %v", k, v, v)
	}

	firstEntry := true
	var allValues bool
	for name, rawAllow := range rawRules {
		allow, ok := config.AsBool(rawAllow)
		if !ok {
			return nil, fmt.Errorf("config `%s.interfaces` has invalid value (type %T): %v", k, rawAllow, rawAllow)
		}

		nameRE, err := regexp.Compile("^" + name + "$")
		if err != nil {
			return nil, fmt.Errorf("config `%s.interfaces` has invalid key: %s: %v", k, name, err)
		}

		nameRules = append(nameRules, AllowListNameRule{
			Name:  nameRE,
			Allow: allow,
		})

		if firstEntry {
			allValues = allow
			firstEntry = false
		} else {
			if allow != allValues {
				return nil, fmt.Errorf("config `%s.interfaces` values must all be the same true/false value", k)
			}
		}
	}

	return nameRules, nil

View on GitHub (pinned to dd8f660c0a)

Solutions

Fix the key to be a valid regex, e.g. use eth.* instead of eth*
Escape literal special characters: \\* becomes \\* in regex terms (use \\-escaped literals)
Test the pattern with any Go regexp validator before deploying

Example fix

// before
interfaces:
  "eth(": true
// after
interfaces:
  "eth.*": true

Defensive patterns

Strategy: validation

Validate before calling

func validInterfaceKeys(m map[string]any) error {
	for name := range m {
		if _, err := regexp.Compile("^" + name + "$"); err != nil {
			return fmt.Errorf("bad interface pattern %q: %w", name, err)
		}
	}
	return nil
}

Prevention

Remember keys are regexes, not globs: use .* not *
Compile-test patterns in CI before deployment

When it happens

Trigger: getAllowListInterfaces with keys containing invalid regex syntax, e.g. unbalanced parentheses, stray *, or invalid character classes like eth[0-.

Common situations: Writing glob-style patterns (eth*) instead of regex (eth.*), or typos in wildcard patterns.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/10874a5dc015269f. Report an issue: GitHub.