{"record":{"id":"5656950f80841ab7","repo":"kubernetes/kops","slug":"overflowed-cidr-while-incrementing-ip","errorCode":null,"errorMessage":"overflowed CIDR while incrementing IP","messagePattern":"overflowed CIDR while incrementing IP","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/defaults.go","lineNumber":313,"sourceCode":"\t\tklog.V(8).Info(\"Not setting up Proxy Excludes\")\n\t}\n\n\treturn egressProxy, nil\n}\n\nfunc incrementIP(ip net.IP, cidr string) (string, error) {\n\t_, ipNet, err := net.ParseCIDR(cidr)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tfor i := len(ip) - 1; i >= 0; i-- {\n\t\tip[i]++\n\t\tif ip[i] != 0 {\n\t\t\tbreak\n\t\t}\n\t}\n\tif !ipNet.Contains(ip) {\n\t\treturn \"\", fmt.Errorf(\"overflowed CIDR while incrementing IP\")\n\t}\n\treturn ip.String(), nil\n}\n","sourceCodeStart":295,"sourceCodeEnd":317,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/defaults.go#L295-L317","documentation":"incrementIP increments the CIDR's base IP byte-wise; after incrementing it re-checks ipNet.Contains(ip). If the incremented IP falls outside the original network — i.e. the increment overflowed past the last address of the CIDR — this error is thrown. It means there is no next address within the given CIDR block.","triggerScenarios":"incrementIP (called from assignProxy) given a CIDR whose last address is the base IP or where incrementing the base IP exits the network, such as 255.255.255.255/32 or a network base equal to the broadcast/top of range.","commonSituations":"Misconfigured NonMasqueradeCIDR at the very top of an address space; degenerate single-address CIDRs; buggy CIDR values hand-entered in cluster specs.","solutions":["Choose a conventional nonMasqueradeCIDR with ample host space, e.g. 100.64.0.0/10","Ensure the CIDR host bits allow incrementing (not a broadcast-only or /32 block)","Validate the CIDR externally (ipcalc or net.ParseCIDR + check available addresses) before applying the spec"],"exampleFix":"// before\nnonMasqueradeCIDR: 255.255.255.255/32\n// after\nnonMasqueradeCIDR: 100.64.0.0/10","handlingStrategy":"validation","validationCode":"base, ipNet, _ := net.ParseCIDR(cidr)\nlast := make(net.IP, len(ipNet.IP))\nfor i := range ipNet.IP { last[i] = ipNet.IP[i] | ^ipNet.Mask[i] }\nif base.Equal(last) {\n    return fmt.Errorf(\"CIDR %s has no incrementable range\", cidr)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm CIDR has more than one address before increment logic","Reject broadcast-only or top-of-range base IPs","Run ipcalc checks in CI on cluster spec CIDRs"],"tags":["networking","cidr","overflow","ip-address"],"backgroundTag":"cidr-overflow","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}