{"record":{"id":"c0b0f5e2c30d850d","repo":"kubernetes/kops","slug":"expected-podcidr-to-be-set-for-ipalias-kubenet","errorCode":null,"errorMessage":"expected PodCIDR to be set for IPAlias / kubenet","messagePattern":"expected PodCIDR to be set for IPAlias / kubenet","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/gcemodel/firewall.go","lineNumber":173,"sourceCode":"\t\tt := &gcetasks.FirewallRule{\n\t\t\tName:       s(b.NameForFirewallRule(\"node-to-master\")),\n\t\t\tLifecycle:  b.Lifecycle,\n\t\t\tNetwork:    network,\n\t\t\tSourceTags: []string{b.GCETagForRole(kops.InstanceGroupRoleNode)},\n\t\t\tTargetTags: append(b.GCETagsForAPIServerTargets(), b.GCETagForRole(\"Master\")),\n\t\t\tAllowed:    nodeToMasterAllowed,\n\t\t}\n\t\tc.AddTask(t)\n\t}\n\n\tif b.NetworkingIsIPAlias() || b.NetworkingIsGCERoutes() {\n\t\tif b.IsIPv6Only() {\n\t\t\t// We can use tags for IPv6, and this is covered by prior rules\n\t\t} else {\n\t\t\t// When using IP alias or custom routes, SourceTags for identifying traffic don't work, and we must recognize by CIDR\n\n\t\t\tif b.Cluster.Spec.Networking.PodCIDR == \"\" {\n\t\t\t\treturn fmt.Errorf(\"expected PodCIDR to be set for IPAlias / kubenet\")\n\t\t\t}\n\n\t\t\tnetwork, err := b.LinkToNetwork()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tb.AddFirewallRulesTasks(c, \"pod-cidrs-to-node\", &gcetasks.FirewallRule{\n\t\t\t\tLifecycle:    b.Lifecycle,\n\t\t\t\tNetwork:      network,\n\t\t\t\tSourceRanges: []string{b.Cluster.Spec.Networking.PodCIDR},\n\t\t\t\tTargetTags:   []string{b.GCETagForRole(kops.InstanceGroupRoleNode)},\n\t\t\t\tAllowed:      allProtocols,\n\t\t\t})\n\n\t\t\t// Source tags cannot match pod-sourced traffic, so without this rule pods cannot\n\t\t\t// reach pods hosted on control plane nodes. Grant the same restricted access as\n\t\t\t// nodes so host ports such as etcd stay protected.\n\t\t\tb.AddFirewallRulesTasks(c, \"pod-cidrs-to-master\", &gcetasks.FirewallRule{","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/gcemodel/firewall.go#L155-L191","documentation":"Building GCE firewall rules for IPAlias/kubenet networking found the PodCIDR unset; non-IPv6 IP-alias clusters must have a pod CIDR allocation so node firewall rules can reference pod ranges.","triggerScenarios":"Thrown at pkg/model/gcemodel/firewall.go:173 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the cluster spec defines a pod network CIDR for IPAlias/kubenet networking","Check the networkID/podCIDR settings via kops edit cluster","Re-run kops update"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}