What causes "CIDR group '%s' doesn't exists" in apache/cassandra?

Verify the group exists first (e.g. SELECT from system_auth.cidr_groups or use getCidrsOfCidrGroup) before dropping.

apache/cassandra · error · RuntimeException

CIDR group '%s' doesn't exists

Error message

CIDR group '%s' doesn't exists

What it means

CIDRGroupsMappingManager.dropCidrGroup fetches the CIDR list for the given group name; if the group does not exist (empty set) it throws RuntimeException("CIDR group '<name>' doesn't exists") instead of silently succeeding. The group must exist in the CIDR groups mapping table before it can be dropped.

Source

Thrown at src/java/org/apache/cassandra/auth/CIDRGroupsMappingManager.java:203

        process(query, CassandraAuthorizer.authWriteConsistencyLevel());
    }

    @VisibleForTesting
    void dropCidrGroupIfExists(String cidrGroupName)
    {
        String query = String.format("DELETE FROM %s.%s WHERE cidr_group = '%s'",
                                     SchemaConstants.AUTH_KEYSPACE_NAME,
                                     AuthKeyspace.CIDR_GROUPS,
                                     cidrGroupName);

        process(query, CassandraAuthorizer.authWriteConsistencyLevel());
    }

    public void dropCidrGroup(String cidrGroupName)
    {
        Set<String> cidrs = getCidrsOfCidrGroupAsStrings(cidrGroupName);
        if (cidrs.isEmpty())
            throw new RuntimeException("CIDR group '" + cidrGroupName + "' doesn't exists");

        dropCidrGroupIfExists(cidrGroupName);
    }

    public void recreateCidrGroupsMapping(Map<String, List<String>> cidrGroupsMapping)
    {
        Set<String> existingMappings = getAvailableCidrGroups();

        // Overwrites mappings of existing cidr groups and inserts new cidr groups
        for (Map.Entry<String, List<String>> cidrGroupMapping : cidrGroupsMapping.entrySet())
        {
            String cidrGroupName = cidrGroupMapping.getKey();
            updateCidrGroup(cidrGroupName, cidrGroupMapping.getValue());
            existingMappings.remove(cidrGroupName);
        }

        // Delete old CIDR groups which do not exist in new mappings
        for (String cidrGroupName : existingMappings)

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Verify the group exists first (e.g. SELECT from system_auth.cidr_groups or use getCidrsOfCidrGroup) before dropping.
Use dropCidrGroupIfExists if idempotent behavior is desired.
Correct the CIDR group name typo.

Example fix

// before
manager.dropCidrGroup("mygroup"); // throws if missing
// after
if (!manager.getCidrsOfCidrGroupAsStrings("mygroup").isEmpty())
    manager.dropCidrGroup("mygroup");

Defensive patterns

Strategy: validation

Validate before calling

if (manager.getCidrsOfCidrGroupAsStrings(groupName).isEmpty()) { /* group missing; skip or create first */ }

Try / catch

try { manager.dropCidrGroup(name); } catch (RuntimeException e) { if (e.getMessage().contains("doesn't exists")) log.info("CIDR group already absent: " + name); else throw e; }

Prevention

Make drop operations idempotent by checking existence first or using dropCidrGroupIfExists.
List existing CIDR groups before scripting drops.
Validate group names against the system_auth.cidr_groups content.

When it happens

Trigger: Calling dropCidrGroup with a name that has no entry in system_auth.cidr_groups (e.g. via CQLSH CIDR management commands or JMX), or after the group was already dropped.

Common situations: Scripts that drop CIDR groups unconditionally without checking existence; typos in group names; running DROP on a fresh cluster where no CIDR groups were created.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/d5747e04f7cb1e3c. Report an issue: GitHub.