{"record":{"id":"579486628454b9d3","repo":"kubernetes/kops","slug":"error-associating-additionalcidr-to-vpc-v","errorCode":null,"errorMessage":"error associating AdditionalCIDR to VPC: %v","messagePattern":"error associating AdditionalCIDR to VPC: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpccidrblock.go","lineNumber":137,"sourceCode":"\nfunc (_ *VPCCIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCCIDRBlock) error {\n\tctx := context.TODO()\n\tshared := aws.ToBool(e.Shared)\n\tif shared && a == nil {\n\t\t// VPC not owned by kOps, no changes will be applied\n\t\t// Verify that the CIDR block was found.\n\t\treturn fmt.Errorf(\"CIDR block %q not found\", aws.ToString(e.CIDRBlock))\n\t}\n\n\tif changes.CIDRBlock != nil {\n\t\trequest := &ec2.AssociateVpcCidrBlockInput{\n\t\t\tVpcId:     e.VPC.ID,\n\t\t\tCidrBlock: e.CIDRBlock,\n\t\t}\n\n\t\t_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error associating AdditionalCIDR to VPC: %v\", err)\n\t\t}\n\t}\n\n\treturn nil // no tags\n}\n\ntype terraformVPCCIDRBlock struct {\n\tVPCID     *terraformWriter.Literal `cty:\"vpc_id\"`\n\tCIDRBlock *string                  `cty:\"cidr_block\"`\n}\n\nfunc (_ *VPCCIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCCIDRBlock) error {\n\tshared := aws.ToBool(e.Shared)\n\tif shared && a == nil {\n\t\t// VPC not owned by kOps, no changes will be applied\n\t\t// Verify that the CIDR block was found.\n\t\treturn fmt.Errorf(\"CIDR block %q not found\", aws.ToString(e.CIDRBlock))\n\t}","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpccidrblock.go#L119-L155","documentation":"Wraps failure of the EC2 AssociateVpcCidrBlock call kOps issues to associate an additional IPv4 CIDR block with the VPC during RenderAWS of VPCCIDRBlock. It happens only when changes.CIDRBlock != nil, i.e. the CIDR must be newly associated. The underlying SDK error is passed through with %v.","triggerScenarios":"RenderAWS on a non-shared VPCCIDRBlock where changes.CIDRBlock is set and t.Cloud.EC2().AssociateVpcCidrBlock returns an error (quota exceeded, permission, invalid state).","commonSituations":"Account hit the 5-secondary-CIDR-per-VPC limit (IPv4) or 5/50 total; missing ec2:AssociateVpcCidrBlock permission; VPC shared via RAM but owned by another account; overlapping CIDR range.","solutions":["Increase the VPC CIDR association quota or remove an unused associated CIDR","Grant ec2:AssociateVpcCidrBlock to the provisioning IAM role","Check the new CIDR does not overlap existing VPC CIDRs or peerings, and the VPC is in 'available' state","If VPC is RAM-shared, associate the CIDR in the owner account instead"],"exampleFix":"// before\n_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\nif err != nil { return fmt.Errorf(\"error associating AdditionalCIDR to VPC: %v\", err) }\n// after: pre-validate quota/state before calling\nif len(a.VPC.CidrBlocks) >= 5 { return fmt.Errorf(\"VPC %s already has max CIDRs\", e.VPC.ID) }","handlingStrategy":"validation","validationCode":"out, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})\nassoc := len(out.Vpcs[0].CidrBlockAssociationSet)\nif assoc >= 5 { return fmt.Errorf(\"VPC %s has %d CIDRs; quota reached\", vpcID, assoc) }\nif !iamAllows(\"ec2:AssociateVpcCidrBlock\") { return errors.New(\"missing ec2:AssociateVpcCidrBlock\") }","typeGuard":null,"tryCatchPattern":"_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\nif err != nil {\n\tif awsup.AWSErrorCode(err) == \"InvalidVpcState\" || awsup.AWSErrorCode(err) == \"Throttling\" {\n\t\treturn fi.NewTryAgainLaterError(\"retry CIDR association\").WithError(err)\n\t}\n\treturn err\n}","preventionTips":["Keep total associated CIDRs (IPv4+IPv6) under the 5/50 VPC limit","Ensure new CIDR doesn't overlap existing VPC/peered CIDRs before apply","Grant ec2:AssociateVpcCidrBlock to the provisioning role","Associate shared-VPC CIDRs in the owner account, not the consumer"],"tags":["aws","vpc","cidr","network"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}