{"record":{"id":"92392a07e42d6fb9","repo":"kubernetes/kops","slug":"subnet-q-did-not-have-cidr","errorCode":null,"errorMessage":"Subnet %q did not have CIDR","messagePattern":"Subnet %q did not have CIDR","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/subnets.go","lineNumber":92,"sourceCode":"\t\t\treturn fmt.Errorf(\"VPC %q not found\", c.Spec.Networking.NetworkID)\n\t\t}\n\n\t\tsubnetByID := make(map[string]*fi.SubnetInfo)\n\t\tfor _, subnetInfo := range vpcInfo.Subnets {\n\t\t\tsubnetByID[subnetInfo.ID] = subnetInfo\n\t\t}\n\t\tfor i := range c.Spec.Networking.Subnets {\n\t\t\tsubnet := &c.Spec.Networking.Subnets[i]\n\t\t\tif subnet.ID != \"\" {\n\t\t\t\tcloudSubnet := subnetByID[subnet.ID]\n\t\t\t\tif cloudSubnet == nil {\n\t\t\t\t\treturn fmt.Errorf(\"Subnet %q not found in VPC %q\", subnet.ID, c.Spec.Networking.NetworkID)\n\t\t\t\t}\n\t\t\t\tif subnet.CIDR == \"\" {\n\t\t\t\t\tsubnet.CIDR = cloudSubnet.CIDR\n\t\t\t\t\t// IPv6-only private subnets do not have an IPv4 CIDR\n\t\t\t\t\tif subnet.CIDR == \"\" && (subnet.IPv6CIDR == \"\" || subnet.Type != kops.SubnetTypePrivate) {\n\t\t\t\t\t\treturn fmt.Errorf(\"Subnet %q did not have CIDR\", subnet.ID)\n\t\t\t\t\t}\n\t\t\t\t} else if subnet.CIDR != cloudSubnet.CIDR {\n\t\t\t\t\treturn fmt.Errorf(\"Subnet %q has configured CIDR %q, but the actual CIDR found was %q\", subnet.ID, subnet.CIDR, cloudSubnet.CIDR)\n\t\t\t\t}\n\n\t\t\t\tif needZones && subnet.Zone == \"\" {\n\t\t\t\t\tsubnet.Zone = cloudSubnet.Zone\n\t\t\t\t} else if subnet.Zone != cloudSubnet.Zone {\n\t\t\t\t\treturn fmt.Errorf(\"Subnet %q has configured Zone %q, but the actual Zone found was %q\", subnet.ID, subnet.Zone, cloudSubnet.Zone)\n\t\t\t\t}\n\n\t\t\t}\n\t\t}\n\t}\n\n\tif needZones {\n\t\tfor i := range c.Spec.Networking.Subnets {\n\t\t\tsubnet := &c.Spec.Networking.Subnets[i]","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/subnets.go#L74-L110","documentation":"kOps looked up an existing cloud subnet by ID to inherit its CIDR, but the subnet has no IPv4 CIDR. This is allowed only for IPv6-only private subnets (which have an IPv6CIDR and type Private); otherwise kOps cannot do its IPv4-based CIDR allocation and aborts.","triggerScenarios":"An AWS subnet referenced by ID that is IPv6-only (no IPv4 CIDR) but is declared in the cluster spec as a type other than Private, or declared without any IPv6CIDR.","commonSituations":"IPv6-only dualstack migrations where the subnet type in the spec was left as Public/Utility; users attaching an IPv6-only subnet from a shared VPC without setting subnet type Private.","solutions":["Set `type: Private` and provide `ipv6CIDR` for the IPv6-only subnet in the cluster spec.","Alternatively use a subnet that has an IPv4 CIDR (dualstack), or specify an explicit `cidr` for the subnet.","Re-run `kops update cluster` after editing the spec."],"exampleFix":"// before\nsubnets:\n- id: subnet-0abc\n  type: Public\n// after\nsubnets:\n- id: subnet-0abc\n  type: Private\n  ipv6CIDR: 2600:1f18:xxxx::/64","handlingStrategy":"validation","validationCode":"// IPv6-only subnets must be Private and carry ipv6CIDR\nif !hasIPv4CIDR(subnetID) && (subnet.Type != \"Private\" || subnet.IPv6CIDR == \"\") {\n    return fmt.Errorf(\"subnet %s is IPv6-only; set type=Private and ipv6CIDR\", subnetID)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set type: Private plus ipv6CIDR for any IPv6-only subnet.","Prefer dualstack subnets when IPv4 connectivity is required.","Document subnet addressing in shared-VPC onboarding docs."],"tags":["subnet","cidr","ipv6","aws"],"backgroundTag":"subnet-missing-cidr","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}