{"record":{"id":"bc2b0c445ea3c832","repo":"cilium/cilium","slug":"invalid-reserved-range-start-q-in-pool-cidr-s","errorCode":null,"errorMessage":"invalid reserved range start %q in pool CIDR %s: %w","messagePattern":"invalid reserved range start %q in pool CIDR (.+?): %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ipam/allocator/multipool/pool_handler.go","lineNumber":191,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tconfigs = append(configs, poolCIDRConfig{\n\t\t\tcidr:           prefix,\n\t\t\treservedRanges: reservedRanges,\n\t\t})\n\t}\n\n\treturn configs, nil\n}\n\nfunc parseReservedRanges(poolCIDR netip.Prefix, ranges []v2.ReservedRange) ([]netipx.IPRange, error) {\n\treserved := make([]netipx.IPRange, 0, len(ranges))\n\tfor _, rr := range ranges {\n\t\tstart, err := netip.ParseAddr(rr.Start)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid reserved range start %q in pool CIDR %s: %w\", rr.Start, poolCIDR, err)\n\t\t}\n\n\t\tend, err := netip.ParseAddr(rr.End)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid reserved range end %q in pool CIDR %s: %w\", rr.End, poolCIDR, err)\n\t\t}\n\n\t\tr := netipx.IPRangeFrom(start, end)\n\t\tif !r.IsValid() {\n\t\t\treturn nil, fmt.Errorf(\"invalid reserved range %s-%s in pool CIDR %s\", start, end, poolCIDR)\n\t\t}\n\n\t\tif !poolCIDR.Contains(start) || !poolCIDR.Contains(end) {\n\t\t\treturn nil, fmt.Errorf(\"reserved range %s-%s is outside pool CIDR %s\", start, end, poolCIDR)\n\t\t}\n\n\t\treserved = append(reserved, r)\n\t}","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ipam/allocator/multipool/pool_handler.go#L173-L209","documentation":"parseReservedRanges could not parse the Start field of a ReservedRange as an IP address with netip.ParseAddr, while validating the reserved ranges of a pool CIDR. The offending value and the pool CIDR are included in the message, and the netip error is wrapped.","triggerScenarios":"A v2.ReservedRange in a PoolCIDRConfig (reached via buildPoolCIDRConfigs -> UpsertPool or ParsePoolSpec callers) has rr.Start set to a non-IP string: hostname, CIDR ('10.0.0.1/32'), empty string, port-suffixed value, or malformed IPv6.","commonSituations":"Typos in reserved range YAML; users putting CIDR notation instead of a bare IP in the start field; template variables left unexpanded; empty fields from partial config merge.","solutions":["Replace rr.Start with a valid bare IP literal (no /prefix, no hostname), matching the pool CIDR family.","If a whole subnet should be excluded, express it as start/end pair of first and last addresses instead of CIDR notation.","Check for unexpanded template variables or empty strings in the manifest.","Validate with netip.ParseAddr (or a YAML schema check) before applying."],"exampleFix":"// before\nreservedRanges: [{start: \"10.0.0.0/29\", end: \"10.0.0.7\"}]\n// after\nreservedRanges: [{start: \"10.0.0.0\", end: \"10.0.0.7\"}]","handlingStrategy":"validation","validationCode":"for _, rr := range ranges {\n    if _, err := netip.ParseAddr(rr.Start); err != nil {\n        return fmt.Errorf(\"ReservedRange.Start %q is not a valid IP: %w\", rr.Start, err)\n    }\n}","typeGuard":"func isBareIP(s string) bool {\n    a, err := netip.ParseAddr(s)\n    return err == nil && !a.Zone().IsZero() == false && !strings.Contains(s, \"/\")\n}","tryCatchPattern":"if _, err := netip.ParseAddr(rr.Start); err != nil {\n    return fmt.Errorf(\"invalid reserved range start %q: use a bare IP literal\", rr.Start)\n}","preventionTips":["Enter bare IPs, never CIDR notation or hostnames, in Start fields.","Expand YAML templates before validation to catch unexpanded variables.","Check that Start is non-empty and properly indented in the manifest."],"tags":["cilium","ipam","ip-parsing","config-validation"],"backgroundTag":"invalid-ip-address-format","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}