cilium/cilium · error

Invalid VTEP CIDR: %v

Error message

Invalid VTEP CIDR: %v

What it means

For each entry in the VTEPCIDR list, validatedConfig in pkg/datapath/vtep/cell.go calls netip.ParsePrefix; an unparseable prefix string triggers this error naming the bad value. Valid entries must be address/prefix-length form; the parsed prefix is then masked and stored in the VTEP config.

Source

Thrown at pkg/datapath/vtep/cell.go:120

		len(r.VTEPEndpoint) != len(r.VTEPMAC) {
		return nil, fmt.Errorf("VTEP configuration must have the same number of Endpoint, VTEP and MAC configurations (Found %d endpoints, %d MACs, %d CIDR ranges)", len(r.VTEPEndpoint), len(r.VTEPMAC), len(r.VTEPCIDR))
	}

	for _, ep := range r.VTEPEndpoint {
		endpoint, err := netip.ParseAddr(ep)
		if err != nil {
			return nil, fmt.Errorf("Invalid VTEP IP: %v", ep)
		}
		if !endpoint.Is4() {
			return nil, fmt.Errorf("Invalid VTEP IPv4 address %v", endpoint)
		}
		config.vtepEndpoints = append(config.vtepEndpoints, endpoint)
	}

	for _, v := range r.VTEPCIDR {
		externalCIDR, err := netip.ParsePrefix(v)
		if err != nil {
			return nil, fmt.Errorf("Invalid VTEP CIDR: %v", v)
		}
		config.vtepCIDRs = append(config.vtepCIDRs, externalCIDR.Masked())
	}

	for _, m := range r.VTEPMAC {
		externalMAC, err := mac.ParseMAC(m)
		if err != nil {
			return nil, fmt.Errorf("Invalid VTEP MAC: %v", m)
		}
		config.vtepMACs = append(config.vtepMACs, externalMAC)
	}

	return &config, nil
}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Write each CIDR as A.B.C.D/len, e.g. 10.0.0.0/24
2. Convert netmask notation (255.255.255.0) to prefix-length form (/24)
3. Trim whitespace/commas from split list entries
4. Keep lengths within 0–32 for IPv4 prefixes

Example fix

// before
--vtep-cidr=10.0.0.0/255.255.255.0

// after
--vtep-cidr=10.0.0.0/24

for _, v := range cidrs {
    if _, err := netip.ParsePrefix(strings.TrimSpace(v)); err != nil {
        return fmt.Errorf("vtep cidr %q must be in A.B.C.D/len form", v)
    }
}

if err := validateVTEPConfig(cfg); err != nil {
    return nil, fmt.Errorf("vtep: %w", err)
}

When it happens

Trigger: --vtep-cidr values like '10.0.0.0/33' (bad length), '10.0.0.0' (missing /len), '10.0.0.0 /24' (space), '10.0.0.0/24/24', or hostnames — anything netip.ParsePrefix rejects.

Common situations: Omitting the prefix length assuming a default; netmasks written as '255.255.255.0' instead of /24; whitespace or trailing commas from list splitting; typo'd octets.

Related errors

• VTEP sync interval must be positive (got %s)
• If VTEP is enabled, at least one VTEP device must be configu
• VTEP configuration must have the same number of Endpoint, VT
• Invalid VTEP IP: %v
• Invalid VTEP MAC: %v

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/6c92660706d28f6a. Report an issue: GitHub.