cilium/cilium · error

failed to create path for prefix %s: %w

Error message

failed to create path for prefix %s: %w

What it means

Thrown by getDesiredPaths in the BGP interface reconciler when types.NewPathForPrefix(prefix) fails to convert an advertised prefix (from a CiliumBGPAdvertisement applied to an interface) into a BGP path/NLRI. The wrapped error typically indicates the prefix string cannot be parsed as a valid CIDR/IP prefix, so the desired BGP path set cannot be built and path reconciliation aborts.

Source

Thrown at pkg/bgp/manager/reconciler/interface.go:141

	return r.reconcilePaths(ctx, p, desiredPeerAdverts, txn)
}

func (r *InterfaceReconciler) getDesiredPaths(desiredPeerAdverts PeerAdvertisements, txn statedb.ReadTxn) (AFPathsMap, error) {
	desiredAdverts := make(AFPathsMap)
	for _, peerFamilyAdverts := range desiredPeerAdverts {
		for family, familyAdverts := range peerFamilyAdverts {
			agentFamily := types.ToAgentFamily(family)
			pathsPerFamily, exists := desiredAdverts[agentFamily]
			if !exists {
				pathsPerFamily = make(PathMap)
				desiredAdverts[agentFamily] = pathsPerFamily
			}
			for _, advert := range familyAdverts {
				for _, prefix := range r.getInterfacePrefixes(advert, agentFamily, txn) {
					path, err := types.NewPathForPrefix(prefix)
					if err != nil {
						return nil, fmt.Errorf("failed to create path for prefix %s: %w", prefix, err)
					}
					path.Family = agentFamily
					pathsPerFamily[path.NLRI.String()] = path
				}
			}
		}
	}
	return desiredAdverts, nil
}

func (r *InterfaceReconciler) getDesiredRoutePolicyStatements(instanceName string, desiredPeerAdverts PeerAdvertisements, txn statedb.ReadTxn) ([]*bgpTables.DesiredRoutePolicy, error) {
	desiredStatements := []*bgpTables.DesiredRoutePolicy{}
	for peer, peerFamilyAdverts := range desiredPeerAdverts {
		if peer.Address == "" {
			continue
		}
		peerAddr, err := netip.ParseAddr(peer.Address)
		if err != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the wrapped error to identify the offending prefix string; fix the CIDR in the CiliumBGPAdvertisement / referenced CIDR resource.
2. Validate all advertised CIDRs parse with `python3 -c "import ipaddress; ipaddress.ip_network('...')"` or `cidr` tooling before applying.
3. Ensure selector-based advertisements actually select resources — an empty/unset CIDR producing a blank prefix should be filtered before NewPathForPrefix.
4. Check that prefixes match the configured agent family (no IPv6 CIDRs on an ipv4-only BGP peering).

Example fix

# before (invalid CIDR in advertisement)
advertise:
  cidrs: ["10.0.0.0/33"]
# after
advertise:
  cidrs: ["10.0.0.0/24"]

func validateAdvertisedCIDRs(cidrs []string) error {
	for _, c := range cidrs {
		if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {
			return fmt.Errorf("invalid CIDR %q: %w", c, err)
		}
	}
	return nil
}
// call on the CiliumBGPAdvertisement CIDR list before applying it

func isValidPrefixString(s string) bool {
	_, _, err := net.ParseCIDR(s)
	return err == nil
}

paths, err := getDesiredPaths(...)
if err != nil {
	var prefixErr string
	if _, scan := fmt.Sscanf(err.Error(), "failed to create path for prefix %s", &prefixErr); scan == nil {
		log.Error(err, "fix invalid CIDR in advertisement", "prefix", prefixErr)
	}
	return err
}

When it happens

Trigger: getInterfacePrefixes returns a prefix string that is empty, malformed (e.g., "10.0.0.0/33", "abc", "10.0.0.1" without mask), or of the wrong family relative to agentFamily, causing NewPathForPrefix's internal net.ParseCIDR/parse to error.

Common situations: Advertisement CRs referencing CIDRs with typos; policy-selected pod/node CIDRs empty or unset so an invalid/blank prefix is derived; using an IPv6 prefix with an ipv4 agent family configuration mismatch; custom resources imported from older schema versions with different CIDR formatting.

Related errors

• invalid peer IP address: %w
• failed to convert BGP instances for node %s: %w
• failed to parse BGP router ID IP pool: %w
• CIDR is not v6 family: %s
• CIDR is not v4 family: %s

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/88d52a20e17a4215. Report an issue: GitHub.