{"record":{"id":"b1371064c41b76ff","repo":"cilium/cilium","slug":"cidr-length-must-be-in-0-128","errorCode":null,"errorMessage":"CIDR length must be in (0,128]","messagePattern":"CIDR length must be in \\(0,128\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kpr/initializer/kube_proxy_replacement.go","lineNumber":90,"sourceCode":"\t\t\t\tif ones, _ := cidr.Mask.Size(); ones == 0 {\n\t\t\t\t\terr = fmt.Errorf(\"CIDR length must be in (0,32]\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"Invalid value for --%s: %s\",\n\t\t\t\t\toption.LoadBalancerRSSv4CIDR, option.Config.LoadBalancerRSSv4CIDR)\n\t\t\t}\n\t\t\toption.Config.UnsafeDaemonConfigOption.LoadBalancerRSSv4 = *cidr\n\t\t}\n\n\t\tif option.Config.LoadBalancerRSSv6CIDR != \"\" {\n\t\t\tip, cidr, err := net.ParseCIDR(option.Config.LoadBalancerRSSv6CIDR)\n\t\t\tif ip.To4() != nil {\n\t\t\t\terr = fmt.Errorf(\"CIDR is not IPv6 based\")\n\t\t\t}\n\t\t\tif err == nil {\n\t\t\t\tif ones, _ := cidr.Mask.Size(); ones == 0 {\n\t\t\t\t\terr = fmt.Errorf(\"CIDR length must be in (0,128]\")\n\t\t\t\t}\n\t\t\t}\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"Invalid value for --%s: %s\",\n\t\t\t\t\toption.LoadBalancerRSSv6CIDR, option.Config.LoadBalancerRSSv6CIDR)\n\t\t\t}\n\t\t\toption.Config.UnsafeDaemonConfigOption.LoadBalancerRSSv6 = *cidr\n\t\t}\n\n\t\tdsrIPIP := r.lbConfig.LoadBalancerUsesDSR() && r.lbConfig.DSRDispatch == loadbalancer.DSRDispatchIPIP\n\t\tif dsrIPIP {\n\t\t\toption.Config.UnsafeDaemonConfigOption.EnableIPIPDevices = true\n\t\t\toption.Config.EnableIPIPTermination = true\n\t\t}\n\n\t\tif (option.Config.LoadBalancerRSSv4CIDR != \"\" || option.Config.LoadBalancerRSSv6CIDR != \"\") && !dsrIPIP {\n\t\t\treturn fmt.Errorf(\"Invalid value for --%s/%s: currently only supported under %s dispatch for DSR\",\n\t\t\t\toption.LoadBalancerRSSv4CIDR, option.LoadBalancerRSSv6CIDR, loadbalancer.DSRDispatchIPIP)","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/kpr/initializer/kube_proxy_replacement.go#L72-L108","documentation":"InitKubeProxyReplacementOptions validates --loadbalancer-rss-ipv6-cidr. After parsing the CIDR with net.ParseCIDR, it requires the prefix length to be strictly greater than 0 (and at most 128, which ParseCIDR already guarantees). A /0 mask is rejected because a zero-length RSS prefix is meaningless for source IP rewriting in kube-proxy-replacement mode.","triggerScenarios":"Setting --loadbalancer-rss-ipv6-cidr to an IPv6 CIDR with prefix length 0 (e.g. ::/0); net.ParseCIDR succeeds and the address is IPv6, but cidr.Mask.Size() returns ones==0, producing this error.","commonSituations":"Operators leaving the flag at a default/placeholder of ::/0, or using a documentation example with ::/0, while enabling DSR with IPIP dispatch and RSS configuration.","solutions":["Set --loadbalancer-rss-ipv6-cidr to a specific IPv6 prefix with a non-zero length, e.g. fd00::/64.","If RSS configuration is not needed, clear --loadbalancer-rss-ipv6-cidr entirely so the validation block is skipped.","Note the error is reported as 'Invalid value for --loadbalancer-rss-ipv6-cidr: <value>' to the user; check the flag value."],"exampleFix":"// before\n--loadbalancer-rss-ipv6-cidr=::/0\n// after\n--loadbalancer-rss-ipv6-cidr=fd00:10::/64","handlingStrategy":"validation","validationCode":"cidr := option.Config.LoadBalancerRSSv6CIDR\nif cidr != \"\" {\n\t_, ipnet, err := net.ParseCIDR(cidr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"bad --loadbalancer-rss-ipv6-cidr %q: %v\", cidr, err)\n\t}\n\tif ones, _ := ipnet.Mask.Size(); ones == 0 {\n\t\treturn fmt.Errorf(\"--loadbalancer-rss-ipv6-cidr %q has /0 prefix; must be in (0,128]\", cidr)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never leave the RSS CIDR flag at ::/0; use a concrete prefix like fd00::/64.","Add startup config linting that rejects zero-length prefixes for all CIDR flags."],"tags":["cilium","kube-proxy-replacement","cidr-validation","ipv6"],"backgroundTag":"invalid-cidr-prefix-length","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}