{"record":{"id":"1c0f5e7e02fae99b","repo":"cilium/cilium","slug":"failed-configuring-bgp-server-s-global-export-poli","errorCode":null,"errorMessage":"failed configuring BGP server's global export policy: %w","messagePattern":"failed configuring BGP server's global export policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/bgp/gobgp/server.go","lineNumber":162,"sourceCode":"\t\t\tDirection:     gobgp.PolicyDirection_POLICY_DIRECTION_IMPORT,\n\t\t\tDefaultAction: gobgp.RouteAction_ROUTE_ACTION_REJECT,\n\t\t\tPolicies:      []*gobgp.Policy{allowLocalPolicy},\n\t\t},\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed configuring BGP server's global import policy: %w\", err)\n\t}\n\n\t// Reject all paths announced by Cilium until an explicit export policy permits them.\n\terr = gobgpSrv.server.SetPolicyAssignment(ctx, &gobgp.SetPolicyAssignmentRequest{\n\t\tAssignment: &gobgp.PolicyAssignment{\n\t\t\tName:          globalPolicyAssignmentName,\n\t\t\tDirection:     gobgp.PolicyDirection_POLICY_DIRECTION_EXPORT,\n\t\t\tDefaultAction: gobgp.RouteAction_ROUTE_ACTION_REJECT,\n\t\t},\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed configuring BGP server's global export policy: %w\", err)\n\t}\n\n\t// will log out any peer changes\n\tpeerCallback := func(p *apiutil.WatchEventMessage_PeerEvent, _ time.Time) {\n\t\tif p.Type == apiutil.PEER_EVENT_STATE {\n\t\t\tgobgpSrv.stopMutex.Lock()\n\t\t\tdefer gobgpSrv.stopMutex.Unlock()\n\n\t\t\tif gobgpSrv.stopping {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tlogger.Debug(\"Peer state change\", types.PeerLogField, p)\n\n\t\t\t// if channel is nil (e.g. in tests) below code will not block and will act as a no-op.\n\t\t\tselect {\n\t\t\tcase params.StateNotification <- struct{}{}:\n\t\t\tdefault:","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/bgp/gobgp/server.go#L144-L180","documentation":"NewGoBGPServer also assigns the global export policy (default REJECT until explicitly permitted). This error wraps a SetPolicyAssignment failure for the EXPORT direction, meaning outbound route advertisement policy could not be installed. Without it the server has no export filtering, so startup aborts.","triggerScenarios":"server.SetPolicyAssignment with Direction EXPORT fails: assignment name not registered, prior import-assignment step failed leaving inconsistent state, or gobgp rejects the PolicyAssignment proto (invalid name/direction/action combination).","commonSituations":"gobgp version drift changing PolicyAssignment semantics; refactors that renamed globalPolicyAssignmentName without updating registration; partial startup recovery attempts hitting a stale assignment.","solutions":["Verify the import-direction assignment (previous step) succeeded before the export assignment.","Confirm globalPolicyAssignmentName is consistently registered and referenced.","Inspect the wrapped gobgp error for the exact rejection reason.","Teardown and restart the server cleanly to clear partial policy state."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := server.SetPolicyAssignment(ctx, exportReq)\nif err != nil {\n    // abort startup: exporting without a default-reject policy leaks routes\n    return nil, fmt.Errorf(\"export policy setup failed; aborting to avoid route leaks: %w\", err)\n}","preventionTips":["Treat export policy setup as mandatory — never run without default-reject export.","Use a single constant for the assignment name across registration and assignment.","Run startup integration tests that assert both import and export assignments exist."],"tags":["bgp","gobgp","routing-policy","server-startup"],"backgroundTag":"bgp-policy-apply-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}