cilium/cilium · error

invalid CIDR '%s'

Error message

invalid CIDR '%s'

What it means

One of the CIDR prefixes in ipam.Cidrs failed the netip.Prefix validity check. The agent supplied an IPAM CIDR string that cannot be parsed/validated as a network prefix, so route coalescing for the new interface cannot proceed.

Source

Thrown at plugins/cilium-cni/cmd/interface.go:32

	"github.com/cilium/cilium/api/v1/models"
	linuxrouting "github.com/cilium/cilium/pkg/datapath/linux/routing"
	"github.com/cilium/cilium/pkg/ip"
)

func interfaceAdd(logger *slog.Logger, ipConfig *current.IPConfig, ipam *models.IPAMAddressResponse, conf *models.DaemonConfigurationStatus) error {
	if ipam == nil {
		return fmt.Errorf("missing IPAM configuration")
	}
	// If the gateway IP is not available, it is already set up
	if !ipam.Gateway.IsValid() {
		return nil
	}

	var allCIDRs []*net.IPNet

	for _, cidr := range ipam.Cidrs {
		if !cidr.IsValid() {
			return fmt.Errorf("invalid CIDR '%s'", cidr)
		}
		// Mask explicitly: net.ParseCIDR, which this loop replaces, returned
		// the masked network, and ip.CoalesceCIDRs below expects that shape.
		allCIDRs = append(allCIDRs, netipx.PrefixIPNet(cidr.Masked()))
	}

	// Coalesce CIDRs into minimum set needed for route rules
	// The routes set up here will be cleaned up by linuxrouting.Delete.
	// Therefor the code here should be kept in sync with the deletion code.
	ipv4CIDRs, ipv6CIDRs := ip.CoalesceCIDRs(allCIDRs)
	coalescedCIDRs := make([]string, 0, len(allCIDRs))
	var masq bool

	if ipConfig.Address.IP.To4() != nil {
		for _, cidr := range ipv4CIDRs {
			coalescedCIDRs = append(coalescedCIDRs, cidr.String())
		}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Inspect the IPAM response (cilium-dbg or agent logs) and find the offending CIDR string
2. Fix the IPAM pool/config producing the malformed CIDR
3. Restart cilium-agent to refresh IPAM state if the value came from stale caches
4. Report/upgrade if a cloud IPAM integration (ENI/Azure) is emitting invalid prefixes

Example fix

// before (IPAM config)
"cidrs": ["10.0.0.0/33"]
// after
"cidrs": ["10.0.0.0/24"]

// Validate CIDRs as netip.Prefix before handing them to the CNI path
for _, c := range cidrStrings {
    p, err := netip.ParsePrefix(c)
    if err != nil {
        return fmt.Errorf("IPAM config CIDR %q invalid: %v", c, err)
    }
    _ = p.Masked()
}

if err := cniAdd(args); err != nil {
    if strings.Contains(err.Error(), "invalid CIDR") {
        // dump the IPAM response to logs and fail fast with the offending value
        return fmt.Errorf("fix IPAM pool; response cidrs: %v", ipamResp.Cidrs)
    }
    return err
}

When it happens

Trigger: CNI ADD where the IPAM response's Cidrs array contains a malformed or zero-value prefix — corrupt agent state, hand-edited IPAM config, or a plugin populating Cidrs with raw unparsed strings.

Common situations: Custom IPAM plugins or CRDs emitting CIDRs with host bits/typos ('10.0.0.0/33', '10.0.0.5/24' variants a strict parser rejects); upgrading agents that changed CIDR serialization; ENI/Azure metadata returning unexpected values.

Related errors

• not ready
• no cilium agent pods found
• unable to detect minimum Cilium version
• unable to initialize IPv4 allocator: %w
• unable to initialize IPv6 allocator: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/3eebbb23c4b91ca7. Report an issue: GitHub.