{"record":{"id":"d857bf7aa394e0ae","repo":"cilium/cilium","slug":"the-provided-network-does-not-match-the-current-ra","errorCode":null,"errorMessage":"the provided network does not match the current range","messagePattern":"the provided network does not match the current range","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ipam/service/ipallocator/allocator.go","lineNumber":30,"sourceCode":"\n\t\"github.com/cilium/cilium/pkg/ipam/service/allocator\"\n)\n\n// Interface manages the allocation of IP addresses out of a range. Interface\n// should be threadsafe.\ntype Interface interface {\n\tAllocate(netip.Addr) error\n\tAllocateNext() (netip.Addr, error)\n\tRelease(netip.Addr) error\n\tForEach(func(netip.Addr))\n\tCIDR() netip.Prefix\n\tHas(addr netip.Addr) bool\n}\n\nvar (\n\tErrFull              = errors.New(\"range is full\")\n\tErrAllocated         = errors.New(\"provided IP is already allocated\")\n\tErrMismatchedNetwork = errors.New(\"the provided network does not match the current range\")\n)\n\ntype ErrNotInRange struct {\n\tValidRange string\n}\n\nfunc (e *ErrNotInRange) Error() string {\n\treturn fmt.Sprintf(\"provided IP is not in the valid range. The range of valid IPs is %s\", e.ValidRange)\n}\n\n// CIDRRangeOption is a functional option for NewCIDRRange.\ntype CIDRRangeOption func(*cidrRangeOptions)\n\ntype cidrRangeOptions struct {\n\tallowFirstIP bool\n\tallowLastIP  bool\n}\n","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/ipam/service/ipallocator/allocator.go#L12-L48","documentation":"ErrMismatchedNetwork is returned by the IPAM allocator's Restore function when the persisted allocation state being restored belongs to a different network range than the range the allocator is currently configured for. The allocator refuses to restore mismatched state to prevent allocating IPs outside the current range.","triggerScenarios":"Calling Restore (e.g. from an IPAM backing store like a KVstore-backed allocator) with persisted allocation data whose network/prefix does not equal the allocator's current range, typically after the node's allocated CIDR changed.","commonSituations":"Operator changed node's PodCIDR or the daemon's --cluster-ipv4-cidr / node IPAM pool between restarts; restoring a stale allocation dump from etcd/kvstore after re-configuration; moving a node between IPAM pools.","solutions":["Verify the persisted allocation range matches the node's currently assigned allocation prefix; re-sync the node's CIDR from the control plane","Delete the stale allocation state for this node (kvstore key) so it can be re-created with the correct range","Revert the CIDR/configuration change so the allocator range matches the persisted state again"],"exampleFix":"// before: restoring stale state for old range\nalloc.Restore(ctx, oldRange, staleAllocator)\n// after: ensure the range passed matches the allocator's current range\ncurrentRange, _ := types.NewPrefixFromNetIPNet(node.AllocatedIPv4CIDR)\nalloc.Restore(ctx, currentRange, staleAllocator)","handlingStrategy":"validation","validationCode":"// Ensure persisted range matches before restoring\nfunc canRestore(alloc *Allocator, persistedRange netip.Prefix, current types.Prefix) bool {\n    cur, err := netip.ParsePrefix(current.String())\n    if err != nil { return false }\n    return persistedRange == cur\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the node's IPAM CIDR stable across restarts","Compare persisted allocation range with the current range before calling Restore","Clear stale per-node allocation state after intentional CIDR changes"],"tags":["ipam","networking","cidr","state-restore"],"backgroundTag":"ipam-range-mismatch","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}