{"record":{"id":"d58110e9243949f6","repo":"kubernetes/kops","slug":"invalid-subnet-q-cidr-q","errorCode":null,"errorMessage":"invalid subnet %q CIDR: %q","messagePattern":"invalid subnet %q CIDR: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/subnets.go","lineNumber":140,"sourceCode":"\t_, cidr, err := net.ParseCIDR(c.Spec.Networking.NetworkCIDR)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Invalid NetworkCIDR: %q\", c.Spec.Networking.NetworkCIDR)\n\t}\n\n\t// We split the network range into 2, 4 or 8 subnets\n\t// But we then reserve the lowest one for the private block\n\t// (and we split _that_ into 8 further subnets, leaving the first one unused/for future use)\n\n\tvar bigSubnets []*kops.ClusterSubnetSpec\n\tvar littleSubnets []*kops.ClusterSubnetSpec\n\n\tvar reserved []*net.IPNet\n\tfor i := range c.Spec.Networking.Subnets {\n\t\tsubnet := &c.Spec.Networking.Subnets[i]\n\t\tif subnet.CIDR != \"\" {\n\t\t\t_, cidrSubnet, err := net.ParseCIDR(subnet.CIDR)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid subnet %q CIDR: %q\", subnet.Name, subnet.CIDR)\n\t\t\t}\n\t\t\t// Skip additional subnets\n\t\t\tif !cidr.Contains(cidrSubnet.IP) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\t\tswitch subnet.Type {\n\t\tcase kops.SubnetTypeDualStack, kops.SubnetTypePublic, kops.SubnetTypePrivate:\n\t\t\tbigSubnets = append(bigSubnets, subnet)\n\n\t\tcase kops.SubnetTypeUtility:\n\t\t\tlittleSubnets = append(littleSubnets, subnet)\n\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"subnet %q has unknown type %q\", subnet.Name, subnet.Type)\n\t\t}\n\n\t\tif subnet.CIDR != \"\" {","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/subnets.go#L122-L158","documentation":"This error is thrown by kOps' automatic subnet CIDR assignment logic when a subnet in the cluster spec declares a CIDR that net.ParseCIDR cannot parse. It aborts cluster spec validation so that a malformed CIDR never reaches cloud provisioning.","triggerScenarios":"Running `kops update cluster` (or other commands that call PerformAssignments) with cluster.spec.networking.subnets[i].cidr set to a malformed string, e.g. '10.0.0.0/33' or '10.0.0.0' (missing prefix length).","commonSituations":"Hand-edited cluster.yaml with a typo'd CIDR; copy-pasted IPv6 notation into an IPv4 field; forgetting the /prefix suffix; template placeholders like {{ cidr }} left unrendered.","solutions":["Fix the subnet CIDR in the cluster spec to a valid CIDR (e.g. 10.0.0.0/24) using `kops edit cluster` or editing the manifest","Validate with `kops validate cluster --name <cluster>` or `kops replace -f` to catch parse errors early","If the CIDR should be auto-assigned, remove the cidr field from the subnet entirely and let assignCIDRsToSubnets allocate it"],"exampleFix":"// before\nsubnets:\n- name: us-east-1a\n  cidr: 10.0.1.0/33\n// after\nsubnets:\n- name: us-east-1a\n  cidr: 10.0.1.0/24","handlingStrategy":"validation","validationCode":"for _, s := range c.Spec.Networking.Subnets {\n\tif s.CIDR != \"\" {\n\t\tif _, _, err := net.ParseCIDR(s.CIDR); err != nil {\n\t\t\treturn fmt.Errorf(\"subnet %q: bad CIDR %q: %w\", s.Name, s.CIDR, err)\n\t\t}\n\t}\n}","typeGuard":"func isValidCIDR(s string) bool {\n\t_, _, err := net.ParseCIDR(s)\n\treturn s == \"\" || err == nil\n}","tryCatchPattern":"if err := PerformAssignments(c, cloud); err != nil {\n\tvar target *SubnetCIDRError\n\tif errors.As(err, &target) { /* fix manifest */ }\n\treturn err\n}","preventionTips":["Never hand-edit subnet CIDRs without running net.ParseCIDR (or `ipaddr` check) first","Omit cidr to let kOps auto-allocate from networkCIDR","Round-trip the manifest through `kops get -o yaml` before applying"],"tags":["network","cidr","validation","kops"],"backgroundTag":"invalid-cidr-notation","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}