{"record":{"id":"92bb6b85a99346a6","repo":"kubernetes/kops","slug":"failed-to-parse-subnet-cidr-q-w","errorCode":null,"errorMessage":"failed to parse subnet CIDR %q: %w","messagePattern":"failed to parse subnet CIDR %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/nodemodel/nodeupconfigbuilder.go","lineNumber":419,"sourceCode":"\t\t\t\t// address is unroutable from them even though it is inside the network CIDR. Handing\n\t\t\t\t// one out only stalls bootstrap on an address that can never answer.\n\t\t\t\tif cluster.Spec.IsIPv6Only() && !ip.Is6() {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tif cidr.Contains(ip) || ip.Is6() {\n\t\t\t\t\tcontrolPlaneIPs = append(controlPlaneIPs, additionalIP)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\tcase kops.CloudProviderGCE:\n\t\t// Use the IP address of the internal load balancer (forwarding-rule)\n\t\t// Note that on GCE subnets have IP ranges, networks do not\n\t\tfor _, apiserverIP := range apiserverAddresses {\n\t\t\tfor _, subnet := range cluster.Spec.Networking.Subnets {\n\t\t\t\tcidr, err := netip.ParsePrefix(subnet.CIDR)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to parse subnet CIDR %q: %w\", subnet.CIDR, err)\n\t\t\t\t}\n\t\t\t\tip, err := netip.ParseAddr(apiserverIP)\n\t\t\t\tif err != nil {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tif cidr.Contains(ip) {\n\t\t\t\t\tcontrolPlaneIPs = append(controlPlaneIPs, apiserverIP)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\tcase kops.CloudProviderDO, kops.CloudProviderScaleway, kops.CloudProviderAzure, kops.CloudProviderMetal:\n\t\t// Use any IP address that is found (including public ones)\n\t\tcontrolPlaneIPs = append(controlPlaneIPs, apiserverAddresses...)\n\t}\n\n\treturn controlPlaneIPs, nil\n}","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/nodemodel/nodeupconfigbuilder.go#L401-L437","documentation":"On GCE, kOps determines which API server addresses are reachable from nodes by checking each address against the CIDR of every cluster subnet. This error is thrown when a subnet's CIDR string in cluster.spec.networking.subnets cannot be parsed as a valid CIDR prefix by netip.ParsePrefix.","triggerScenarios":"Building the nodeup config (BuildConfig) for a GCE cluster where one of cluster.spec.networking.subnets[].cidr is malformed: a bare IP like 10.0.10.0 without /24, an empty string, an IPv6 literal without prefix length, or a region/name mistakenly placed in the cidr field.","commonSituations":"Hand-edited cluster manifest for GCE where subnet.cidr was omitted or set to the subnet name instead of a range; IPv6 subnets filled in with a bare address; tooling/terraform exporting subnet fields into the wrong key; copy-pasting an AWS-style subnet spec into a GCE cluster.","solutions":["Fix the bad subnet entry: `kops edit cluster`, set each subnets[].cidr to a valid prefix (e.g. us-west1 subnet: 10.0.16.0/20), then `kops update cluster`.","Read the wrapped netip error and quoted CIDR in the message to identify exactly which subnet entry is malformed.","Verify against `gcloud compute networks subnets list` that the CIDRs match the actual GCE subnet ranges.","Recreate the cluster spec if the field is empty and let kops/cloud integration populate subnets correctly (delete/re-create subnet entries rather than editing blindly)."],"exampleFix":"// before (cluster.yaml)\nnetworking:\n  subnets:\n  - name: us-west1\n    type: Private\n    cidr: \"\"\n// after\nnetworking:\n  subnets:\n  - name: us-west1\n    type: Private\n    cidr: 10.0.16.0/20","handlingStrategy":"validation","validationCode":"import \"net/netip\"\n\nfunc validateSubnetCIDRs(subnets []kops.ClusterSubnetSpec) error {\n    for _, subnet := range subnets {\n        if _, err := netip.ParsePrefix(subnet.CIDR); err != nil {\n            return fmt.Errorf(\"subnet %q has invalid CIDR %q: %w\", subnet.Name, subnet.CIDR, err)\n        }\n    }\n    return nil\n}","typeGuard":"func hasValidSubnetCIDRs(subnets []kops.ClusterSubnetSpec) bool {\n    if len(subnets) == 0 {\n        return false\n    }\n    for _, s := range subnets {\n        if _, err := netip.ParsePrefix(s.CIDR); err != nil {\n            return false\n        }\n    }\n    return true\n}","tryCatchPattern":"ips, err := selectControlPlaneIPs(cluster, apiserverAddresses)\nif err != nil {\n    var perr *net.ParseError\n    if errors.As(err, &perr) {\n        return fmt.Errorf(\"GCE subnet spec contains invalid CIDR (fix subnets[].cidr): %w\", err)\n    }\n    return err\n}","preventionTips":["Cross-check subnets[].cidr against `gcloud compute networks subnets list --format=json` before building configs","Never put subnet names or regions into the cidr field; it must be an IP prefix","For IPv6 subnets ensure the CIDR includes a prefix length (e.g. /64)","Run `kops update cluster --dry-run` in CI to catch malformed subnet specs early"],"tags":["network","cidr","gce","subnet","configuration"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}