cilium/cilium · error

No registered Group providers

Error message

No registered Group providers

What it means

GetCidrSet resolves external Group rules to CIDR prefixes via provider callbacks registered in the operator's provider map. This error means the map is empty — no Group provider (e.g. AWS, Azure) was ever registered, so no provider can translate the group membership into IPs. It indicates the operator was built or configured without any external-groups provider support.

Source

Thrown at operator/pkg/networkpolicy/external-groups/provider/provider.go:34

	AWSProvider = "AWS" // AWS provider key
)

var (
	providers = map[string]GroupProviderFunc{} // map with the list of providers to callback to retrieve info from.
)

type GroupProviderFunc func(context.Context, *api.Groups) ([]netip.Prefix, error)

func Enabled() bool {
	return len(providers) > 0
}

// GetCidrSet will return the CIDRRule for the rule using the callbacks that
// are register in the platform.
func GetCidrSet(ctx context.Context, group *api.Groups) ([]netip.Prefix, error) {
	var addrs []netip.Prefix
	if len(providers) == 0 {
		return nil, fmt.Errorf("No registered Group providers")
	}

	for provider, getIPsFunc := range providers {
		// Get per  provider CIDRSet
		a, err := getIPsFunc(ctx, group)
		if err != nil {
			return nil, fmt.Errorf(
				"Cannot retrieve data from %s provider: %w",
				provider, err)
		}
		addrs = append(addrs, a...)
	}

	slices.SortFunc(addrs, netip.Prefix.Compare)

	return slices.Compact(addrs), nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Import/register the provider package for your cloud (e.g. AWS EC2/AWSNode manager) into the operator so the providers map is populated at startup
2. Verify the operator image matches your cloud platform (use the cloud-specific operator variant)
3. Check operator startup logs for provider registration messages; if absent, fix the wiring that calls the provider Register function
4. Remove or delay processing of network policies that use external Groups until a provider is registered

Example fix

// before
import _ "github.com/cilium/cilium/operator/pkg/networkpolicy/external-groups"
// after
import _ "github.com/cilium/cilium/operator/pkg/networkpolicy/external-groups/aws" // registers the AWS provider

providers, err := provider.RegisteredProviders()
if err != nil || len(providers) == 0 {
    return fmt.Errorf("operator has no Group providers registered; external Groups policies unsupported")
}

func hasGroupProviders() bool { return len(providers) > 0 }

cidrs, err := provider.GetCidrSet(ctx, group)
if err != nil {
    if strings.Contains(err.Error(), "No registered Group providers") {
        // skip external group resolution or fail fast with actionable message
    }
    return err
}

When it happens

Trigger: Calling GetCidrSet with an api.Groups rule when the 'providers' map has no entries — i.e. no provider registered itself via the registration hook before the first network policy referencing external groups is processed.

Common situations: Running a Cilium operator build that excludes cloud provider integrations (e.g. generic build on AWS), missing a cell/module import that performs provider registration, or misconfigured cluster where the operator's cloud discovery is disabled while policies still use ToGroups/FromGroups rules.

Related errors

• Cannot retrieve data from %s provider: %w
• CiliumNetworkPolicy rule cannot have NodeSelector, use Ciliu
• ⚠️ unable to restart Cilium Operator pods: %w
• failed to get features status from %s: %w
• failed to collect cilium-operator gops stats: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/877d5825626cad85. Report an issue: GitHub.