{"record":{"id":"bb4e727a6cf5d3bb","repo":"kubernetes/kops","slug":"unable-to-parse-non-masquerade-cidr","errorCode":null,"errorMessage":"unable to parse Non Masquerade CIDR","messagePattern":"unable to parse Non Masquerade CIDR","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/defaults.go","lineNumber":244,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"KubernetesVersion not specified, and unable to download latest version from %q: %v\", stableURL, err)\n\t}\n\tlatestVersion := strings.TrimSpace(string(b))\n\treturn latestVersion, nil\n}\n\nfunc assignProxy(cluster *kops.Cluster) (*kops.EgressProxySpec, error) {\n\tegressProxy := cluster.Spec.Networking.EgressProxy\n\t// Add default no_proxy values if we are using a http proxy\n\tif egressProxy != nil {\n\n\t\tvar egressSlice []string\n\t\tif egressProxy.ProxyExcludes != \"\" {\n\t\t\tegressSlice = strings.Split(egressProxy.ProxyExcludes, \",\")\n\t\t}\n\n\t\tip, _, err := net.ParseCIDR(cluster.Spec.Networking.NonMasqueradeCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to parse Non Masquerade CIDR\")\n\t\t}\n\n\t\tfirstIP, err := incrementIP(ip, cluster.Spec.Networking.NonMasqueradeCIDR)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to get first ip address in Non Masquerade CIDR\")\n\t\t}\n\n\t\t// run through the basic list\n\t\tfor _, exclude := range []string{\n\t\t\t\"127.0.0.1\",\n\t\t\t\"localhost\",\n\t\t\tcluster.Spec.ClusterDNSDomain, // TODO we may want this for public loadbalancers\n\t\t\tcluster.Spec.API.PublicName,\n\t\t\tcluster.ObjectMeta.Name,\n\t\t\tfirstIP,\n\t\t\tcluster.Spec.Networking.NonMasqueradeCIDR,\n\t\t} {\n\t\t\tif exclude == \"\" {","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/defaults.go#L226-L262","documentation":"assignProxy parses cluster.Spec.Networking.NonMasqueradeCIDR with net.ParseCIDR to compute a first usable IP for egress proxy excludes. When the CIDR string is empty or malformed (e.g. missing prefix length, extra characters), ParseCIDR fails and this error is returned, aborting proxy assignment.","triggerScenarios":"PerformAssignments/TestPopulateClusterSpec_Proxy on a cluster spec where EgressProxy is set and spec.networking.nonMasqueradeCIDR is empty, \"\", or not valid CIDR syntax (e.g. \"10.0.0.0\" without /8, \"10.0.0.0/33\").","commonSituations":"Hand-edited cluster.yaml dropping the nonMasqueradeCIDR field; typos in the CIDR; migrating specs between kOps versions where the field became required for proxy setups.","solutions":["Set a valid nonMasqueradeCIDR in spec.networking, e.g. 100.64.0.0/10 or 10.0.0.0/8","Validate the value with `netCIDR` syntax: address + /prefix (net.ParseCIDR rules)","Re-run `kops create -f cluster.yaml` after fixing; or `kops replace -f` / `kops edit cluster` for existing clusters"],"exampleFix":"// before (cluster.yaml)\nnetworking:\n  nonMasqueradeCIDR: \"\"\n// after\nnetworking:\n  nonMasqueradeCIDR: 100.64.0.0/10","handlingStrategy":"validation","validationCode":"if _, _, err := net.ParseCIDR(cluster.Spec.Networking.NonMasqueradeCIDR); err != nil {\n    return fmt.Errorf(\"invalid nonMasqueradeCIDR %q: %v\", cluster.Spec.Networking.NonMasqueradeCIDR, err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate cluster.yaml CIDR fields before kops create","Never leave nonMasqueradeCIDR empty when egressProxy is configured","Use schema validation (`kops create -f` dry-run) to catch empty fields"],"tags":["networking","cidr","validation","proxy"],"backgroundTag":"invalid-cidr","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}