slackhq/nebula · error

group should contain a single value, an array with more than

Error message

group should contain a single value, an array with more than one entry was provided

What it means

This error comes from Nebula firewall rule parsing. The 'group' field in a rule definition may be a single string or a list; the library only accepts an array with at most one entry (converted to a simple value with a warning), and rejects any array with more than one entry.

Source

Thrown at firewall.go:973

		if !ok {
			return ""
		}
		return fmt.Sprintf("%v", v)
	}

	r.Port = toString("port", m)
	r.Code = toString("code", m)
	r.Proto = toString("proto", m)
	r.Host = toString("host", m)
	r.Cidr = toString("cidr", m)
	r.LocalCidr = toString("local_cidr", m)
	r.CAName = toString("ca_name", m)
	r.CASha = toString("ca_sha", m)

	// Make sure group isn't an array
	if v, ok := m["group"].([]any); ok {
		if len(v) > 1 {
			return r, errors.New("group should contain a single value, an array with more than one entry was provided")
		}

		l.Warn("group was an array with a single value, converting to simple value",
			"table", table,
			"rule", i,
		)
		m["group"] = v[0]
	}

	singleGroup := toString("group", m)

	if rg, ok := m["groups"]; ok {
		switch reflect.TypeOf(rg).Kind() {
		case reflect.Slice:
			v := reflect.ValueOf(rg)
			r.Groups = make([]string, v.Len())
			for i := 0; i < v.Len(); i++ {
				r.Groups[i] = v.Index(i).Interface().(string)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Use a single value for 'group': group: "g1" in the rule.
2. If you need to match multiple groups, add multiple firewall rules (one per group) or use 'groups' (the list-based field) if supported by your Nebula version.
3. Validate your firewall config with nebula -configtest before deploying.

Example fix

// before
firewall:
  inbound:
    - port: 22
      proto: tcp
      group:
        - admins
        - ssh-users
// after
firewall:
  inbound:
    - port: 22
      proto: tcp
      group: admins

g, ok := rule["group"]
if arr, isArr := g.([]any); isArr && len(arr) > 1 {
    return errors.New("group must be a single value in nebula firewall rules")
}

func isSingleGroup(v any) bool {
    if s, ok := v.(string); ok {
        return s != ""
    }
    if arr, ok := v.([]any); ok {
        return len(arr) <= 1
    }
    return false
}

When it happens

Trigger: A firewall rule in the config supplies 'group' as an array containing two or more values, e.g. group: ["g1", "g2"], while parsing firewall rules from the YAML config.

Common situations: Users copy multi-group rules from docs or other firewalls (where group lists are supported) into Nebula configs; config generators emitting arrays for group; upgrading configs that assumed AND/OR multi-group matching is supported.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• config `%s` has invalid value (type %T): %v
• only one of group or groups should be defined, both provided
• Empty configuration
• no firewall rules
• stats.host can not be empty

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ef85fd113fd4ceb7. Report an issue: GitHub.