{"record":{"id":"97d3c3c331e8a9c3","repo":"kubernetes/kops","slug":"ipv6-cidr-block-provided-by-amazon-not-found","errorCode":null,"errorMessage":"IPv6 CIDR block provided by Amazon not found","messagePattern":"IPv6 CIDR block provided by Amazon not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpcamazonipv6cidrblock.go","lineNumber":94,"sourceCode":"\t\treturn fi.RequiredField(\"VPC\")\n\t}\n\n\tif a != nil && changes != nil {\n\t\tif changes.VPC != nil {\n\t\t\treturn fi.CannotChangeField(\"VPC\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *VPCAmazonIPv6CIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {\n\tctx := context.TODO()\n\tshared := aws.ToBool(e.Shared)\n\tif shared && a == nil {\n\t\t// VPC not owned by kOps, no changes will be applied\n\t\t// Verify that the Amazon IPv6 provided CIDR block was found.\n\t\treturn fmt.Errorf(\"IPv6 CIDR block provided by Amazon not found\")\n\t}\n\n\trequest := &ec2.AssociateVpcCidrBlockInput{\n\t\tVpcId:                       e.VPC.ID,\n\t\tAmazonProvidedIpv6CidrBlock: aws.Bool(true),\n\t}\n\n\t// Response doesn't contain the new CIDR block\n\t_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error associating Amazon IPv6 provided CIDR block to VPC: %v\", err)\n\t}\n\n\treturn nil // no tags\n}\n\nfunc (_ *VPCAmazonIPv6CIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {\n\t// At the moment, this can only be done via the aws_vpc resource","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpcamazonipv6cidrblock.go#L76-L112","documentation":"For VPCAmazonIPv6CIDRBlock, when the task is marked shared and no actual CIDR block was found on the VPC, kOps cannot create/verify the Amazon-provided IPv6 CIDR (it won't modify a VPC it doesn't own), so it returns this error. It means the expected AmazonProvidedIpv6CidrBlock association is absent.","triggerScenarios":"Shared VPC does not have an Amazon-provided IPv6 CIDR associated (AssociateVpcCidrBlock never run, or egress-only IGW/CIDR removed), so the find returned no matching actual state.","commonSituations":"Reusing a legacy IPv4-only VPC for an IPv6-enabled cluster; someone disassociated the IPv6 CIDR; account hasn't enabled IPv6 for the VPC before sharing it into kOps.","solutions":["Associate an Amazon-provided IPv6 CIDR first: `aws ec2 associate-vpc-cidr-block --vpc-id <id> --amazon-provided-ipv6-cidr-block`","Or point the cluster at a VPC that already has the IPv6 CIDR","Or unshare (remove shared:true) so kOps manages the CIDR itself"],"exampleFix":"// before: shared VPC without IPv6 CIDR\nsharedVPC: vpc-x  # no ipv6 cidr\n// after\naws ec2 associate-vpc-cidr-block --vpc-id vpc-x --amazon-provided-ipv6-cidr-block","handlingStrategy":"validation","validationCode":"vpc, _ := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})\nif len(vpc.Vpcs) == 1 && !hasAmazonProvidedIPv6CIDR(vpc.Vpcs[0]) {\n\treturn fmt.Errorf(\"shared VPC %s lacks Amazon-provided IPv6 CIDR; associate one before apply\", vpcID)\n}","typeGuard":"func hasAmazonProvidedIPv6CIDR(v awstypes.Vpc) bool {\n\tfor _, a := range v.Ipv6CidrBlockAssociationSet {\n\t\tif a.Ipv6CidrBlockState != nil && a.Ipv6CidrBlockState.State == awstypes.Ipv6CidrBlockStateCodeAssociated {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","tryCatchPattern":"err := kopsApply()\nif err != nil && strings.Contains(err.Error(), \"IPv6 CIDR block provided by Amazon not found\") {\n\t// remediate: associate IPv6 CIDR on the shared VPC or pick another VPC\n}","preventionTips":["Associate the Amazon-provided IPv6 CIDR before sharing a VPC for IPv6 clusters","Verify Ipv6CidrBlockAssociationSet on shared VPCs during onboarding","Never disassociate IPv6 CIDRs from VPCs backing live clusters","Decide upfront whether kOps or the network team owns IPv6 association"],"tags":["aws","vpc","ipv6","cidr","shared-vpc"],"backgroundTag":"missing-ipv6-cidr-association","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}