Firewall errors

Causes and remedies for the error codes of firewall objects, rules, quotas, modes and profiles.

`error.firewall.validation`

Text in the console: The firewall change is not valid: {issue} at {object} ({count} problems in total).
Meaning for API clients: The firewall change adds validation errors (issue is the net.validation.fw_* key of the first, object its path, count how many); the message lists them all.
Code: INVALID_ARGUMENT, HTTP 400

Argument	What it holds
`object`	the path of the first object that is not valid.
`issue`	the validation key of the first error.
`count`	the number of errors in the change.

Cause. The change would leave the firewall configuration with one or more validation errors, so nothing was saved. issue is the key of the first error, object the path of the object it concerns, and count the number of errors. The message of the API response lists all of them.

Remedy.

Read the full list in the response, correct every object it names, and send the change again.
Check the effect of a rule before you save it: kyvernon firewall simulate --vm <vm> --inbound --proto tcp --port 443 --peer 203.0.113.10 shows the verdict and the rule that decides.

`error.firewall.builtin`

Text in the console: {object} is built in and maintained by the platform; it cannot be changed or deleted.
Meaning for API clients: The firewall object is built in and maintained by the control plane (read-only).
Code: FAILED_PRECONDITION, HTTP 412

Argument	What it holds
`object`	the path of the built-in object.

Cause. The object is built in and maintained by the platform (its name starts with sys:). Built-in groups, services, policies and profiles are read-only.

Remedy.

Leave the built-in object as it is.
To get another behaviour, create an object of your own and use it next to the built-in one. For a profile, change the profile that a network adapter uses: kyvernon firewall vnic-profile <vm> <nic> --profile <id>.

`error.firewall.reserved_name`

Text in the console: Names starting with sys: are reserved for built-in firewall objects. Choose another name.
Meaning for API clients: Firewall object names starting with sys: are reserved for built-in objects.
Code: INVALID_ARGUMENT, HTTP 400

Argument	What it holds
`field`	the request field that holds the rejected name.

Cause. The name of a new or renamed firewall object starts with sys:. That prefix is reserved for built-in objects.

Remedy.

Choose a name that does not start with sys:.
Repeat the change.

`error.firewall.quota`

Text in the console: The firewall quota {resource} of this tenant is {limit}; the change would make it {used}.
Meaning for API clients: The tenant's firewall quota (fwGroups, fwPolicies, fwRules, fwGroupMembers) would be exceeded.
Code: FAILED_PRECONDITION, HTTP 412

Argument	What it holds
`resource`	the quota that is exceeded.
`limit`	the quota.
`used`	the number that the change would reach.

Cause. The change would take the tenant over one of its firewall quotas: fwGroups, fwPolicies, fwRules or fwGroupMembers.

Remedy.

Delete firewall objects that are no longer used: groups, policies or rules, or members of a group.
An administrator can raise the quota: kyvernon tenants quota <tenant> --body '{"fwRules": <number>}'. Check the other values of the quota first, because the body replaces the whole quota (kyvernon tenants get <tenant>). Pass on the name of the resource from the message.

`error.firewall.category_scope`

Text in the console: Emergency and Infrastructure policies belong to the provider. Use Environment or Application.
Meaning for API clients: Emergency and Infrastructure policies belong to the provider.
Code: INVALID_ARGUMENT, HTTP 400

Argument	What it holds
`field`	the request field that holds the category.

Cause. A tenant tried to create or move a policy into the category Emergency or Infrastructure. Those categories belong to the provider.

Remedy.

Use the category Environment or Application for the policy.
When the rule really belongs to the provider, an administrator with the provider privileges creates it. Pass on the rule you need.

`error.firewall.in_use`

Text in the console: {object} is still in use.
Meaning for API clients: The firewall object is still used (a profile set on vNICs).
Code: FAILED_PRECONDITION, HTTP 412

Argument	What it holds
`object`	the path of the profile.

Cause. A firewall profile cannot be deleted, because at least one network adapter uses it.

Remedy.

Give each network adapter that uses the profile another one: kyvernon firewall vnic-profile <vm> <nic> --profile <id>, or --reset to return to the default of its kind.
Delete the profile: kyvernon firewall profiles delete <id>.

`error.firewall.no_vnic`

Text in the console: The virtual machine has no network adapter on a host-bridge network.
Meaning for API clients: The VM has no vNIC on a host-bridge network.
Code: FAILED_PRECONDITION, HTTP 412

Cause. The virtual machine has no network adapter on a host-bridge network, so there is nothing to protect with the distributed firewall.

Remedy.

Connect a network adapter of the virtual machine to a host-bridge network, then repeat the operation.
Check the adapters of the virtual machine: kyvernon inventory vm <id>.

`error.firewall.profile_not_selectable`

Text in the console: The firewall profile {profile} cannot be chosen here. Open ports with rules instead.
Meaning for API clients: A tenant user chose a firewall profile the provider did not mark selectable.
Code: PERMISSION_DENIED, HTTP 403

Argument	What it holds
`profile`	the id of the profile.

Cause. A tenant user chose a firewall profile that the provider did not mark as selectable.

Remedy.

Keep the profile of the network adapter and open the ports you need with rules: kyvernon firewall open-port <vm> --tcp <port>.
An administrator can mark a profile as selectable: kyvernon firewall profiles set <id> --selectable.

`error.firewall.unprotected`

Text in the console: Network adapter {nic} cannot be firewalled: {reason}.
Meaning for API clients: The vNIC cannot be firewalled; its mode stays off. reason is linux_or_quarantine_bridge or port_security_off.
Code: FAILED_PRECONDITION, HTTP 412

Argument	What it holds
`nic`	the key of the network adapter.
`reason`	why the adapter cannot be firewalled, `linux_or_quarantine_bridge` or `port_security_off`.

Cause. The network adapter cannot be firewalled, so its mode stays off. The reason argument says why. It is linux_or_quarantine_bridge when the adapter is on a Linux bridge or on a quarantine bridge, and port_security_off when port security is off on its network. The console shows the reason in your language.

Remedy.

Read the reason in the message.
For linux_or_quarantine_bridge, connect the adapter to a host-bridge network that is an Open vSwitch bridge.
For port_security_off, an administrator turns port security on for the network: kyvernon network update <id> --body-file <file>.
Switch the mode again: kyvernon firewall mode <vm> monitor.

`error.firewall.not_pending`

Text in the console: No firewall mode change of this virtual machine is waiting for confirmation.
Meaning for API clients: No firewall mode switch of the VM waits for confirmation.
Code: FAILED_PRECONDITION, HTTP 412

Cause. A confirmation was sent for a firewall mode switch, but none waits for it. The time to confirm has passed and the previous mode is back, or the switch was confirmed already.

Remedy.

Check the firewall mode of the virtual machine in the console with Change mode.
When the mode is not the one you want, switch again and confirm within the time you set: kyvernon firewall mode <vm> enforce --confirm-within 10m, then kyvernon firewall mode confirm <vm>.