{"record":{"id":"0ee12ff5989ce37e","repo":"kubernetes/kops","slug":"cidr-block-q-not-found","errorCode":null,"errorMessage":"CIDR block %q not found","messagePattern":"CIDR block %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpccidrblock.go","lineNumber":126,"sourceCode":"\t\tif changes.VPC != nil {\n\t\t\treturn fi.CannotChangeField(\"VPC\")\n\t\t}\n\n\t\tif changes.CIDRBlock != nil {\n\t\t\treturn fi.CannotChangeField(\"CIDRBlock\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *VPCCIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCCIDRBlock) error {\n\tctx := context.TODO()\n\tshared := aws.ToBool(e.Shared)\n\tif shared && a == nil {\n\t\t// VPC not owned by kOps, no changes will be applied\n\t\t// Verify that the CIDR block was found.\n\t\treturn fmt.Errorf(\"CIDR block %q not found\", aws.ToString(e.CIDRBlock))\n\t}\n\n\tif changes.CIDRBlock != nil {\n\t\trequest := &ec2.AssociateVpcCidrBlockInput{\n\t\t\tVpcId:     e.VPC.ID,\n\t\t\tCidrBlock: e.CIDRBlock,\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error associating AdditionalCIDR to VPC: %v\", err)\n\t\t}\n\t}\n\n\treturn nil // no tags\n}\n\ntype terraformVPCCIDRBlock struct {","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpccidrblock.go#L108-L144","documentation":"RenderAWS for VPCCIDRBlock errors when the task is marked Shared and the actual VPCCIDRBlock was not found (a == nil), meaning the configured CIDR block does not exist on the target VPC. kOps refuses to proceed since it cannot create or verify a shared block it does not own.","triggerScenarios":"shared=true on the VPCCIDRBlock task and Find returns nil actual; e.g. cluster spec references an additional CIDR block not associated with the VPC.","commonSituations":"Typo in spec additionalNetworkCIDRs; CIDR block was disassociated manually from the VPC; cluster was re-targeted to a different VPC that lacks the CIDR.","solutions":["Associate the missing CIDR block with the VPC (aws ec2 associate-vpc-cidr-block) or add it via kOps cluster spec additionalNetworkCIDRs","Verify the CIDR in additionalNetworkCIDRs exactly matches a CIDR associated to the VPC","If the block is unmanaged/unneeded, remove it from the cluster spec"],"exampleFix":"// cluster.yaml\n// before\nadditionalNetworkCIDRs:\n- 10.99.0.0/16   # not associated with the VPC\n// after\nadditionalNetworkCIDRs:\n- 10.10.0.0/16   # CIDR actually associated with the VPC","handlingStrategy":"validation","validationCode":"out, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})\nfound := false\nfor _, cb := range out.Vpcs[0].CidrBlockAssociationSet {\n\tif aws.ToString(cb.CidrBlock) == desiredCIDR && aws.ToString(cb.CidrBlockState.State) == \"associated\" { found = true }\n}\nif shared && !found { return fmt.Errorf(\"CIDR %s not associated with VPC %s\", desiredCIDR, vpcID) }","typeGuard":null,"tryCatchPattern":"if err := render(); err != nil {\n\tif strings.Contains(err.Error(), \"CIDR block\") && strings.Contains(err.Error(), \"not found\") {\n\t\t// reconcile: associate the CIDR first, then re-run apply\n\t}\n\treturn err\n}","preventionTips":["Keep additionalNetworkCIDRs in the cluster spec in sync with the VPC's actual associated CIDRs","Before enabling shared=true, run aws ec2 describe-vpcs and confirm the CIDR exists","Avoid manual disassociation of CIDRs managed by kOps","Pin the VPC id in the spec so applies always target the same VPC"],"tags":["aws","vpc","cidr","shared-resource"],"backgroundTag":"resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}