k3s-io/k3s · error

cluster-cidr: %v and node-ip: %v, must share the same IP ver

Error message

cluster-cidr: %v and node-ip: %v, must share the same IP version (IPv4, IPv6 or dual-stack)

What it means

Error "cluster-cidr: %v and node-ip: %v, must share the same IP version (IPv4, IPv6 or dual-stack)" thrown in k3s-io/k3s.

Source

Thrown at pkg/agent/run.go:87

	dualNode, err := utilsnet.IsDualStackIPs(nodeConfig.AgentConfig.NodeIPs)
	if err != nil {
		return errors.WithMessage(err, "failed to validate node-ip")
	}
	serviceIPv4 := utilsnet.IsIPv4CIDR(nodeConfig.AgentConfig.ServiceCIDR)
	clusterIPv4 := utilsnet.IsIPv4CIDR(nodeConfig.AgentConfig.ClusterCIDR)
	nodeIPv4 := utilsnet.IsIPv4String(nodeConfig.AgentConfig.NodeIP)
	serviceIPv6 := utilsnet.IsIPv6CIDR(nodeConfig.AgentConfig.ServiceCIDR)
	clusterIPv6 := utilsnet.IsIPv6CIDR(nodeConfig.AgentConfig.ClusterCIDR)
	nodeIPv6 := utilsnet.IsIPv6String(nodeConfig.AgentConfig.NodeIP)

	// check that cluster-cidr and service-cidr have the same IP versions
	if (serviceIPv6 != clusterIPv6) || (dualCluster != dualService) || (serviceIPv4 != clusterIPv4) {
		return fmt.Errorf("cluster-cidr: %v and service-cidr: %v, must share the same IP version (IPv4, IPv6 or dual-stack)", nodeConfig.AgentConfig.ClusterCIDRs, nodeConfig.AgentConfig.ServiceCIDRs)
	}

	// check that node-ip has the IP versions set in cluster-cidr
	if (clusterIPv6 && !(nodeIPv6 || dualNode)) || (dualCluster && !dualNode) || (clusterIPv4 && !(nodeIPv4 || dualNode)) {
		return fmt.Errorf("cluster-cidr: %v and node-ip: %v, must share the same IP version (IPv4, IPv6 or dual-stack)", nodeConfig.AgentConfig.ClusterCIDRs, nodeConfig.AgentConfig.NodeIPs)
	}

	enableIPv6 := dualCluster || clusterIPv6
	enableIPv4 := dualCluster || clusterIPv4

	// dualStack or IPv6 are not supported on Windows node
	if (goruntime.GOOS == "windows") && enableIPv6 {
		return errors.New("dual-stack or IPv6 are not supported on Windows node")
	}

	conntrackConfig, err := getConntrackConfig(nodeConfig)
	if err != nil {
		return errors.WithMessage(err, "failed to validate kube-proxy conntrack configuration")
	}
	// The net/bridge/bridge-nf-call-{ip,ip6}tables sysctls are only required by kube-proxy
	// and flannel. When both are disabled the node is using an alternative CNI, so leave
	// these sysctls untouched for the administrator to manage. See
	// https://github.com/k3s-io/k3s/issues/14022. The flannel backend is compared against the

View on GitHub (pinned to 6ba341e396)

When it happens

Trigger: Thrown at pkg/agent/run.go:87 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/ef4417df6a183ca9. Report an issue: GitHub.