{"record":{"id":"877d5825626cad85","repo":"cilium/cilium","slug":"no-registered-group-providers","errorCode":null,"errorMessage":"No registered Group providers","messagePattern":"No registered Group providers","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/networkpolicy/external-groups/provider/provider.go","lineNumber":34,"sourceCode":"\tAWSProvider = \"AWS\" // AWS provider key\n)\n\nvar (\n\tproviders = map[string]GroupProviderFunc{} // map with the list of providers to callback to retrieve info from.\n)\n\ntype GroupProviderFunc func(context.Context, *api.Groups) ([]netip.Prefix, error)\n\nfunc Enabled() bool {\n\treturn len(providers) > 0\n}\n\n// GetCidrSet will return the CIDRRule for the rule using the callbacks that\n// are register in the platform.\nfunc GetCidrSet(ctx context.Context, group *api.Groups) ([]netip.Prefix, error) {\n\tvar addrs []netip.Prefix\n\tif len(providers) == 0 {\n\t\treturn nil, fmt.Errorf(\"No registered Group providers\")\n\t}\n\n\tfor provider, getIPsFunc := range providers {\n\t\t// Get per  provider CIDRSet\n\t\ta, err := getIPsFunc(ctx, group)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\"Cannot retrieve data from %s provider: %w\",\n\t\t\t\tprovider, err)\n\t\t}\n\t\taddrs = append(addrs, a...)\n\t}\n\n\tslices.SortFunc(addrs, netip.Prefix.Compare)\n\n\treturn slices.Compact(addrs), nil\n}\n","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/networkpolicy/external-groups/provider/provider.go#L16-L52","documentation":"GetCidrSet resolves external Group rules to CIDR prefixes via provider callbacks registered in the operator's provider map. This error means the map is empty — no Group provider (e.g. AWS, Azure) was ever registered, so no provider can translate the group membership into IPs. It indicates the operator was built or configured without any external-groups provider support.","triggerScenarios":"Calling GetCidrSet with an api.Groups rule when the 'providers' map has no entries — i.e. no provider registered itself via the registration hook before the first network policy referencing external groups is processed.","commonSituations":"Running a Cilium operator build that excludes cloud provider integrations (e.g. generic build on AWS), missing a cell/module import that performs provider registration, or misconfigured cluster where the operator's cloud discovery is disabled while policies still use ToGroups/FromGroups rules.","solutions":["Import/register the provider package for your cloud (e.g. AWS EC2/AWSNode manager) into the operator so the providers map is populated at startup","Verify the operator image matches your cloud platform (use the cloud-specific operator variant)","Check operator startup logs for provider registration messages; if absent, fix the wiring that calls the provider Register function","Remove or delay processing of network policies that use external Groups until a provider is registered"],"exampleFix":"// before\nimport _ \"github.com/cilium/cilium/operator/pkg/networkpolicy/external-groups\"\n// after\nimport _ \"github.com/cilium/cilium/operator/pkg/networkpolicy/external-groups/aws\" // registers the AWS provider","handlingStrategy":"validation","validationCode":"providers, err := provider.RegisteredProviders()\nif err != nil || len(providers) == 0 {\n    return fmt.Errorf(\"operator has no Group providers registered; external Groups policies unsupported\")\n}","typeGuard":"func hasGroupProviders() bool { return len(providers) > 0 }","tryCatchPattern":"cidrs, err := provider.GetCidrSet(ctx, group)\nif err != nil {\n    if strings.Contains(err.Error(), \"No registered Group providers\") {\n        // skip external group resolution or fail fast with actionable message\n    }\n    return err\n}","preventionTips":["Use the cloud-specific operator image for your platform (e.g. cilium-operator-aws on AWS)","Verify provider registration in operator startup logs before applying ToGroups policies","Add an integration smoke test that resolves a Groups rule end-to-end"],"tags":["cilium","networkpolicy","kubernetes","operator","cloud-provider"],"backgroundTag":"no-provider-registered","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}