{"record":{"id":"0eaa1c17b4eca2d3","repo":"kubernetes/kops","slug":"unable-to-get-first-ip-address-in-non-masquerade-c","errorCode":null,"errorMessage":"unable to get first ip address in Non Masquerade CIDR","messagePattern":"unable to get first ip address in Non Masquerade CIDR","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/defaults.go","lineNumber":249,"sourceCode":"\nfunc assignProxy(cluster *kops.Cluster) (*kops.EgressProxySpec, error) {\n\tegressProxy := cluster.Spec.Networking.EgressProxy\n\t// Add default no_proxy values if we are using a http proxy\n\tif egressProxy != nil {\n\n\t\tvar egressSlice []string\n\t\tif egressProxy.ProxyExcludes != \"\" {\n\t\t\tegressSlice = strings.Split(egressProxy.ProxyExcludes, \",\")\n\t\t}\n\n\t\tip, _, err := net.ParseCIDR(cluster.Spec.Networking.NonMasqueradeCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to parse Non Masquerade CIDR\")\n\t\t}\n\n\t\tfirstIP, err := incrementIP(ip, cluster.Spec.Networking.NonMasqueradeCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to get first ip address in Non Masquerade CIDR\")\n\t\t}\n\n\t\t// run through the basic list\n\t\tfor _, exclude := range []string{\n\t\t\t\"127.0.0.1\",\n\t\t\t\"localhost\",\n\t\t\tcluster.Spec.ClusterDNSDomain, // TODO we may want this for public loadbalancers\n\t\t\tcluster.Spec.API.PublicName,\n\t\t\tcluster.ObjectMeta.Name,\n\t\t\tfirstIP,\n\t\t\tcluster.Spec.Networking.NonMasqueradeCIDR,\n\t\t} {\n\t\t\tif exclude == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif !strings.Contains(egressProxy.ProxyExcludes, exclude) {\n\t\t\t\tegressSlice = append(egressSlice, exclude)\n\t\t\t}","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/defaults.go#L231-L267","documentation":"After successfully parsing NonMasqueradeCIDR, assignProxy calls incrementIP to get the first address after the network base (used as a proxy-exclude default). If incrementIP fails, this wrapped error is returned. With a valid CIDR this rarely fails, so it usually indicates an internal edge case such as a /32 (or /128) CIDR with no incrementable host space.","triggerScenarios":"assignProxy invoked with a valid but degenerate NonMasqueradeCIDR where incrementIP cannot produce an in-net next IP (e.g. single-host CIDR like 10.0.0.1/32) or an unexpected incrementIP failure.","commonSituations":"Clusters configured with point-to-point /32 nonMasquerade CIDRs; specs with unusual narrow CIDR ranges in proxy/egress setups.","solutions":["Use a standard subnet-sized nonMasqueradeCIDR (e.g. /8, /16, /10) instead of a /32","Check that the CIDR's base IP is the network address and has room to increment","If this occurs with a normal CIDR, verify kOps version — upgrade, as it may be an incrementIP edge-case bug"],"exampleFix":"// before\nnetworking:\n  nonMasqueradeCIDR: 10.0.0.1/32\n// after\nnetworking:\n  nonMasqueradeCIDR: 10.0.0.0/16","handlingStrategy":"validation","validationCode":"_, ipNet, err := net.ParseCIDR(cidr)\nif err != nil { return err }\nif ones, _ := ipNet.Mask.Size(); ones >= 31 {\n    return fmt.Errorf(\"CIDR %s too small for IP increment\", cidr)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid /32 or /31 nonMasqueradeCIDRs in cluster specs","Use standard CIDR sizes (/8, /10, /16) for nonMasquerade ranges","Test populate with kops toolkit before applying unusual CIDRs"],"tags":["networking","cidr","proxy","ip-address"],"backgroundTag":"invalid-cidr","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}