{"record":{"id":"8d7e3e7ff18c902e","repo":"kubernetes/kops","slug":"ipv6-ranges-should-be-in-a-ipv6-named-rule-found","errorCode":null,"errorMessage":"ipv6 ranges should be in a ipv6-named rule (found %s in %s)","messagePattern":"ipv6 ranges should be in a ipv6-named rule \\(found (.+?) in (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/firewallrule.go","lineNumber":137,"sourceCode":"\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sourceRange %q is not valid: %w\", sourceRange, err)\n\t\t}\n\n\t\tif e.Family == \"\" {\n\t\t\t// This is our own requirement, just for consistency checking.\n\t\t\t// Previous we used the name, but that was confused when the cluster name was ipv6.example.com\n\t\t\treturn fmt.Errorf(\"must set Family when using SourceRanges\")\n\t\t}\n\n\t\tif cidr.IP.To4() != nil {\n\t\t\t// IPv4\n\t\t\tif e.Family != AddressFamilyIPv4 {\n\t\t\t\treturn fmt.Errorf(\"ipv4 ranges should not be in a ipv6-named rule (found %s in %s)\", sourceRange, name)\n\t\t\t}\n\t\t} else {\n\t\t\t// IPv6\n\t\t\tif e.Family != AddressFamilyIPv6 {\n\t\t\t\treturn fmt.Errorf(\"ipv6 ranges should be in a ipv6-named rule (found %s in %s)\", sourceRange, name)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *FirewallRule) CheckChanges(a, e, changes *FirewallRule) error {\n\tif e.Network == nil {\n\t\treturn fi.RequiredField(\"Network\")\n\t}\n\treturn nil\n}\n\nfunc parseFirewallAllowed(rule string) (*compute.FirewallAllowed, error) {\n\to := &compute.FirewallAllowed{}\n\n\ttokens := strings.Split(rule, \":\")","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/firewallrule.go#L119-L155","documentation":"Normalize() on a GCE FirewallRule validates that every source range's IP family matches the rule name's ipv4/ipv6 designation. This error means a CIDR block parsed as IPv6 was placed in a rule whose name does not carry the ipv6 suffix/designation. kOps derives firewall rule names from cluster naming conventions, so the name and the range list must agree.","triggerScenarios":"A FirewallRule task in the cluster spec has a source range like 'fd00::/8' (AddressFamilyIPv6) but the rule name lacks the ipv6 marker; Normalize() is invoked during task validation before rendering to GCE.","commonSituations":"Hand-edited cluster specs adding IPv6 source ranges to legacy IPv4-named rules; upgrading a cluster to dual-stack without renaming rules; templated manifests where ranges were swapped but names were not.","solutions":["Rename the firewall rule so it carries the ipv6 designation (include 'ipv6' in the rule name per kOps GCE naming convention).","Change the source range to an IPv4 CIDR if the rule is intended to be IPv4.","If both families are needed, split into two rules: one ipv4-named with IPv4 ranges, one ipv6-named with IPv6 ranges."],"exampleFix":"// before\nname: \"https-to-nodes\"\nsourceRanges: [\"fd00::/8\"]\n// after\nname: \"https-to-nodes-ipv6\"\nsourceRanges: [\"fd00::/8\"]","handlingStrategy":"validation","validationCode":"func validateFamilyMatchesName(ruleName string, sourceRanges []string) error {\n  for _, r := range sourceRanges {\n    _, ipnet, err := net.ParseCIDR(r)\n    if err != nil { return fmt.Errorf(\"bad CIDR %q: %w\", r, err) }\n    isV6 := ipnet.IP.To16() != nil && ipnet.IP.To4() == nil\n    nameIsV6 := strings.Contains(ruleName, \"ipv6\")\n    if isV6 != nameIsV6 {\n      return fmt.Errorf(\"range %q (%s) does not match rule name %q\", r, family(isV6), ruleName)\n    }\n  }\n  return nil\n}","typeGuard":"func isIPv6CIDR(r string) bool {\n  _, ipnet, err := net.ParseCIDR(r)\n  return err == nil && ipnet.IP.To4() == nil\n}","tryCatchPattern":null,"preventionTips":["Always include 'ipv4' or 'ipv6' in GCE firewall rule names to match kOps conventions.","Split dual-stack rules into separate ipv4/ipv6 rules at spec authoring time.","Add a lint step on cluster manifests that checks CIDR family vs rule name."],"tags":["gce","firewall","ipv6","validation"],"backgroundTag":"firewall-rule-family-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}