{"record":{"id":"5cbfd1abd31e1f81","repo":"kubernetes/kops","slug":"invalid-networkcidr-q","errorCode":null,"errorMessage":"Invalid NetworkCIDR: %q","messagePattern":"Invalid NetworkCIDR: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/subnets.go","lineNumber":124,"sourceCode":"\t}\n\n\tif needZones {\n\t\tfor i := range c.Spec.Networking.Subnets {\n\t\t\tsubnet := &c.Spec.Networking.Subnets[i]\n\t\t\tif subnet.ID != \"\" && subnet.Zone == \"\" {\n\t\t\t\treturn fmt.Errorf(\"could not determine the zone of subnet %q; specify the zone in the cluster spec\", subnet.Name)\n\t\t\t}\n\t\t}\n\t}\n\n\tif allSubnetsHaveCIDRs(c) {\n\t\tklog.V(4).Infof(\"All subnets have CIDRs; skipping assignment logic\")\n\t\treturn nil\n\t}\n\n\t_, cidr, err := net.ParseCIDR(c.Spec.Networking.NetworkCIDR)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Invalid NetworkCIDR: %q\", c.Spec.Networking.NetworkCIDR)\n\t}\n\n\t// We split the network range into 2, 4 or 8 subnets\n\t// But we then reserve the lowest one for the private block\n\t// (and we split _that_ into 8 further subnets, leaving the first one unused/for future use)\n\n\tvar bigSubnets []*kops.ClusterSubnetSpec\n\tvar littleSubnets []*kops.ClusterSubnetSpec\n\n\tvar reserved []*net.IPNet\n\tfor i := range c.Spec.Networking.Subnets {\n\t\tsubnet := &c.Spec.Networking.Subnets[i]\n\t\tif subnet.CIDR != \"\" {\n\t\t\t_, cidrSubnet, err := net.ParseCIDR(subnet.CIDR)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid subnet %q CIDR: %q\", subnet.Name, subnet.CIDR)\n\t\t\t}\n\t\t\t// Skip additional subnets","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/subnets.go#L106-L142","documentation":"kOps needs to auto-allocate subnet CIDRs by splitting the cluster's NetworkCIDR, but `spec.networking.networkCIDR` is not a parseable CIDR (net.ParseCIDR failed). kOps wraps the failure with this message instead of the parse error.","triggerScenarios":"Cluster spec contains a malformed networkCIDR such as `10.0.0.0/8/`, `10.0.0.0`, `10.0.0.0/33`, or an empty value while some subnet lacks a CIDR (the assignment path only runs when CIDRs are missing).","commonSituations":"Hand-edited cluster.yaml with a typo; templating that substituted an empty CIDR; leaving networkCIDR blank assuming kOps would auto-generate it (it does not — it must be valid to split).","solutions":["Set `spec.networking.networkCIDR` to a valid CIDR, e.g. `10.0.0.0/16`, in the cluster spec.","Re-run `kops update cluster`; alternatively give every subnet an explicit `cidr` so the split path is skipped.","Validate the string with `python3 -c \"import ipaddress; ipaddress.ip_network('10.0.0.0/16')\"` or similar before applying."],"exampleFix":"// before\nnetworking:\n  networkCIDR: \"10.0.0.0\"   # missing prefix length\n// after\nnetworking:\n  networkCIDR: 10.0.0.0/16","handlingStrategy":"validation","validationCode":"if _, _, err := net.ParseCIDR(spec.Networking.NetworkCIDR); err != nil {\n    return fmt.Errorf(\"networkCIDR %q is not valid CIDR: %w\", spec.Networking.NetworkCIDR, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Lint cluster specs with `kops validate` or JSON schema before applying.","Never leave networkCIDR empty when relying on automatic subnet CIDR splitting.","Test templated specs render a valid CIDR (with prefix length) in CI."],"tags":["cidr","networking","config-validation"],"backgroundTag":"invalid-network-cidr","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}