{"record":{"id":"6c92660706d28f6a","repo":"cilium/cilium","slug":"invalid-vtep-cidr-v","errorCode":null,"errorMessage":"Invalid VTEP CIDR: %v","messagePattern":"Invalid VTEP CIDR: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/vtep/cell.go","lineNumber":120,"sourceCode":"\t\tlen(r.VTEPEndpoint) != len(r.VTEPMAC) {\n\t\treturn nil, fmt.Errorf(\"VTEP configuration must have the same number of Endpoint, VTEP and MAC configurations (Found %d endpoints, %d MACs, %d CIDR ranges)\", len(r.VTEPEndpoint), len(r.VTEPMAC), len(r.VTEPCIDR))\n\t}\n\n\tfor _, ep := range r.VTEPEndpoint {\n\t\tendpoint, err := netip.ParseAddr(ep)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Invalid VTEP IP: %v\", ep)\n\t\t}\n\t\tif !endpoint.Is4() {\n\t\t\treturn nil, fmt.Errorf(\"Invalid VTEP IPv4 address %v\", endpoint)\n\t\t}\n\t\tconfig.vtepEndpoints = append(config.vtepEndpoints, endpoint)\n\t}\n\n\tfor _, v := range r.VTEPCIDR {\n\t\texternalCIDR, err := netip.ParsePrefix(v)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Invalid VTEP CIDR: %v\", v)\n\t\t}\n\t\tconfig.vtepCIDRs = append(config.vtepCIDRs, externalCIDR.Masked())\n\t}\n\n\tfor _, m := range r.VTEPMAC {\n\t\texternalMAC, err := mac.ParseMAC(m)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Invalid VTEP MAC: %v\", m)\n\t\t}\n\t\tconfig.vtepMACs = append(config.vtepMACs, externalMAC)\n\t}\n\n\treturn &config, nil\n}\n","sourceCodeStart":102,"sourceCodeEnd":135,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/vtep/cell.go#L102-L135","documentation":"For each entry in the VTEPCIDR list, validatedConfig in pkg/datapath/vtep/cell.go calls netip.ParsePrefix; an unparseable prefix string triggers this error naming the bad value. Valid entries must be address/prefix-length form; the parsed prefix is then masked and stored in the VTEP config.","triggerScenarios":"--vtep-cidr values like '10.0.0.0/33' (bad length), '10.0.0.0' (missing /len), '10.0.0.0 /24' (space), '10.0.0.0/24/24', or hostnames — anything netip.ParsePrefix rejects.","commonSituations":"Omitting the prefix length assuming a default; netmasks written as '255.255.255.0' instead of /24; whitespace or trailing commas from list splitting; typo'd octets.","solutions":["Write each CIDR as A.B.C.D/len, e.g. 10.0.0.0/24","Convert netmask notation (255.255.255.0) to prefix-length form (/24)","Trim whitespace/commas from split list entries","Keep lengths within 0–32 for IPv4 prefixes"],"exampleFix":"// before\n--vtep-cidr=10.0.0.0/255.255.255.0\n\n// after\n--vtep-cidr=10.0.0.0/24","handlingStrategy":"validation","validationCode":"for _, v := range cidrs {\n    if _, err := netip.ParsePrefix(strings.TrimSpace(v)); err != nil {\n        return fmt.Errorf(\"vtep cidr %q must be in A.B.C.D/len form\", v)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := validateVTEPConfig(cfg); err != nil {\n    return nil, fmt.Errorf(\"vtep: %w\", err)\n}","preventionTips":["Always include a prefix length (/24), never a bare address or netmask","Convert dotted netmasks to /len notation before configuring","Keep prefix lengths within 0–32"],"tags":["cilium","datapath","vtep","cidr","configuration"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}