failed configuring BGP server's global export policy: %w

Error message

failed configuring BGP server's global export policy: %w

What it means

NewGoBGPServer also assigns the global export policy (default REJECT until explicitly permitted). This error wraps a SetPolicyAssignment failure for the EXPORT direction, meaning outbound route advertisement policy could not be installed. Without it the server has no export filtering, so startup aborts.

Source

Thrown at pkg/bgp/gobgp/server.go:162

			Direction:     gobgp.PolicyDirection_POLICY_DIRECTION_IMPORT,
			DefaultAction: gobgp.RouteAction_ROUTE_ACTION_REJECT,
			Policies:      []*gobgp.Policy{allowLocalPolicy},
		},
	})
	if err != nil {
		return nil, fmt.Errorf("failed configuring BGP server's global import policy: %w", err)
	}

	// Reject all paths announced by Cilium until an explicit export policy permits them.
	err = gobgpSrv.server.SetPolicyAssignment(ctx, &gobgp.SetPolicyAssignmentRequest{
		Assignment: &gobgp.PolicyAssignment{
			Name:          globalPolicyAssignmentName,
			Direction:     gobgp.PolicyDirection_POLICY_DIRECTION_EXPORT,
			DefaultAction: gobgp.RouteAction_ROUTE_ACTION_REJECT,
		},
	})
	if err != nil {
		return nil, fmt.Errorf("failed configuring BGP server's global export policy: %w", err)
	}

	// will log out any peer changes
	peerCallback := func(p *apiutil.WatchEventMessage_PeerEvent, _ time.Time) {
		if p.Type == apiutil.PEER_EVENT_STATE {
			gobgpSrv.stopMutex.Lock()
			defer gobgpSrv.stopMutex.Unlock()

			if gobgpSrv.stopping {
				return
			}

			logger.Debug("Peer state change", types.PeerLogField, p)

			// if channel is nil (e.g. in tests) below code will not block and will act as a no-op.
			select {
			case params.StateNotification <- struct{}{}:
			default:

View on GitHub (pinned to ac7b90affa)

Solutions

Verify the import-direction assignment (previous step) succeeded before the export assignment.
Confirm globalPolicyAssignmentName is consistently registered and referenced.
Inspect the wrapped gobgp error for the exact rejection reason.
Teardown and restart the server cleanly to clear partial policy state.

Defensive patterns

Strategy: try-catch

Try / catch

err := server.SetPolicyAssignment(ctx, exportReq)
if err != nil {
    // abort startup: exporting without a default-reject policy leaks routes
    return nil, fmt.Errorf("export policy setup failed; aborting to avoid route leaks: %w", err)
}

Prevention

Treat export policy setup as mandatory — never run without default-reject export.
Use a single constant for the assignment name across registration and assignment.
Run startup integration tests that assert both import and export assignments exist.

When it happens

Trigger: server.SetPolicyAssignment with Direction EXPORT fails: assignment name not registered, prior import-assignment step failed leaving inconsistent state, or gobgp rejects the PolicyAssignment proto (invalid name/direction/action combination).

Common situations: gobgp version drift changing PolicyAssignment semantics; refactors that renamed globalPolicyAssignmentName without updating registration; partial startup recovery attempts hitting a stale assignment.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/1c0f5e7e02fae99b. Report an issue: GitHub.