{"record":{"id":"88d52a20e17a4215","repo":"cilium/cilium","slug":"failed-to-create-path-for-prefix-s-w","errorCode":null,"errorMessage":"failed to create path for prefix %s: %w","messagePattern":"failed to create path for prefix (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bgp/manager/reconciler/interface.go","lineNumber":141,"sourceCode":"\n\treturn r.reconcilePaths(ctx, p, desiredPeerAdverts, txn)\n}\n\nfunc (r *InterfaceReconciler) getDesiredPaths(desiredPeerAdverts PeerAdvertisements, txn statedb.ReadTxn) (AFPathsMap, error) {\n\tdesiredAdverts := make(AFPathsMap)\n\tfor _, peerFamilyAdverts := range desiredPeerAdverts {\n\t\tfor family, familyAdverts := range peerFamilyAdverts {\n\t\t\tagentFamily := types.ToAgentFamily(family)\n\t\t\tpathsPerFamily, exists := desiredAdverts[agentFamily]\n\t\t\tif !exists {\n\t\t\t\tpathsPerFamily = make(PathMap)\n\t\t\t\tdesiredAdverts[agentFamily] = pathsPerFamily\n\t\t\t}\n\t\t\tfor _, advert := range familyAdverts {\n\t\t\t\tfor _, prefix := range r.getInterfacePrefixes(advert, agentFamily, txn) {\n\t\t\t\t\tpath, err := types.NewPathForPrefix(prefix)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"failed to create path for prefix %s: %w\", prefix, err)\n\t\t\t\t\t}\n\t\t\t\t\tpath.Family = agentFamily\n\t\t\t\t\tpathsPerFamily[path.NLRI.String()] = path\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn desiredAdverts, nil\n}\n\nfunc (r *InterfaceReconciler) getDesiredRoutePolicyStatements(instanceName string, desiredPeerAdverts PeerAdvertisements, txn statedb.ReadTxn) ([]*bgpTables.DesiredRoutePolicy, error) {\n\tdesiredStatements := []*bgpTables.DesiredRoutePolicy{}\n\tfor peer, peerFamilyAdverts := range desiredPeerAdverts {\n\t\tif peer.Address == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tpeerAddr, err := netip.ParseAddr(peer.Address)\n\t\tif err != nil {","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/bgp/manager/reconciler/interface.go#L123-L159","documentation":"Thrown by getDesiredPaths in the BGP interface reconciler when types.NewPathForPrefix(prefix) fails to convert an advertised prefix (from a CiliumBGPAdvertisement applied to an interface) into a BGP path/NLRI. The wrapped error typically indicates the prefix string cannot be parsed as a valid CIDR/IP prefix, so the desired BGP path set cannot be built and path reconciliation aborts.","triggerScenarios":"getInterfacePrefixes returns a prefix string that is empty, malformed (e.g., \"10.0.0.0/33\", \"abc\", \"10.0.0.1\" without mask), or of the wrong family relative to agentFamily, causing NewPathForPrefix's internal net.ParseCIDR/parse to error.","commonSituations":"Advertisement CRs referencing CIDRs with typos; policy-selected pod/node CIDRs empty or unset so an invalid/blank prefix is derived; using an IPv6 prefix with an ipv4 agent family configuration mismatch; custom resources imported from older schema versions with different CIDR formatting.","solutions":["Inspect the wrapped error to identify the offending prefix string; fix the CIDR in the CiliumBGPAdvertisement / referenced CIDR resource.","Validate all advertised CIDRs parse with `python3 -c \"import ipaddress; ipaddress.ip_network('...')\"` or `cidr` tooling before applying.","Ensure selector-based advertisements actually select resources — an empty/unset CIDR producing a blank prefix should be filtered before NewPathForPrefix.","Check that prefixes match the configured agent family (no IPv6 CIDRs on an ipv4-only BGP peering)."],"exampleFix":"# before (invalid CIDR in advertisement)\nadvertise:\n  cidrs: [\"10.0.0.0/33\"]\n# after\nadvertise:\n  cidrs: [\"10.0.0.0/24\"]","handlingStrategy":"validation","validationCode":"func validateAdvertisedCIDRs(cidrs []string) error {\n\tfor _, c := range cidrs {\n\t\tif _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid CIDR %q: %w\", c, err)\n\t\t}\n\t}\n\treturn nil\n}\n// call on the CiliumBGPAdvertisement CIDR list before applying it","typeGuard":"func isValidPrefixString(s string) bool {\n\t_, _, err := net.ParseCIDR(s)\n\treturn err == nil\n}","tryCatchPattern":"paths, err := getDesiredPaths(...)\nif err != nil {\n\tvar prefixErr string\n\tif _, scan := fmt.Sscanf(err.Error(), \"failed to create path for prefix %s\", &prefixErr); scan == nil {\n\t\tlog.Error(err, \"fix invalid CIDR in advertisement\", \"prefix\", prefixErr)\n\t}\n\treturn err\n}","preventionTips":["Validate all CIDRs in advertisement CRs with a schema pattern (valid CIDR regex) at admission.","Trim whitespace from templated CIDR values in Helm/Kustomize.","Ensure selector-based advertisements resolve to non-empty prefix sets before reconciliation.","Match prefix family to the BGP peering family (no IPv6 CIDRs on ipv4 sessions)."],"tags":["bgp","cidr","path-construction","validation"],"backgroundTag":"invalid-cidr-prefix","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}