What causes "unable to parse CIDR for interface %s: %w" in k3s-io/k3s?

Inspect what the interface actually reports: ip addr show dev

unable to parse CIDR for interface %s: %w

Error message

unable to parse CIDR for interface %s: %w

What it means

For every address on the interface the code formats addr.String() and re-parses it with net.ParseCIDR; a parse failure returns this error. The kernel normally reports interface addresses in 'ip/prefix' form, so a failure indicates an address entry that is a bare IP or otherwise not CIDR-shaped - atypical address entries on that interface.

Source

Thrown at pkg/util/net.go:287

func getIPFromInterface(ifaceName string) (string, error) {
	iface, err := net.InterfaceByName(ifaceName)
	if err != nil {
		return "", err
	}
	addrs, err := iface.Addrs()
	if err != nil {
		return "", err
	}
	if iface.Flags&net.FlagUp == 0 {
		return "", fmt.Errorf("the interface %s is not up", ifaceName)
	}

	globalUnicasts := []string{}
	globalUnicastsIPv6 := []string{}
	for _, addr := range addrs {
		ip, _, err := net.ParseCIDR(addr.String())
		if err != nil {
			return "", fmt.Errorf("unable to parse CIDR for interface %s: %w", iface.Name, err)
		}
		// if not IPv4 adding it on IPv6 list
		if ip.To4() == nil {
			if ip.IsGlobalUnicast() {
				globalUnicastsIPv6 = append(globalUnicastsIPv6, ip.String())
			}
			continue
		}
		if ip.IsGlobalUnicast() {
			globalUnicasts = append(globalUnicasts, ip.String())
		}
	}

	if len(globalUnicasts) > 1 {
		return "", fmt.Errorf("multiple global unicast addresses defined for %s, please set ip from one of %v", ifaceName, globalUnicasts)
	}
	if len(globalUnicasts) == 1 && len(globalUnicastsIPv6) == 0 {
		return globalUnicasts[0], nil

View on GitHub (pinned to 6ba341e396)

Solutions

Inspect what the interface actually reports: ip addr show dev <iface>
Remove the odd address or point the interface option at a clean interface
If a tunnel/p2p device was matched by mistake, correct the interface name in config
If a plain global-unicast interface triggers this, capture `ip addr` output and report upstream

Defensive patterns

Strategy: validation

Validate before calling

func addrsParseAsCIDR(name string) error {
	iface, err := net.InterfaceByName(name)
	if err != nil {
		return err
	}
	addrs, _ := iface.Addrs()
	for _, a := range addrs {
		if _, _, err := net.ParseCIDR(a.String()); err != nil {
			return fmt.Errorf("address %q on %s is not CIDR form", a.String(), name)
		}
	}
	return nil
}

Try / catch

if err := util.GetIPFromInterface(name); err != nil {
	if strings.Contains(err.Error(), "unable to parse CIDR for interface") {
		// dump `ip addr show dev <name>` and inspect the odd address entry
	}
	return err
}

Prevention

Avoid pointing the node at p2p/tunnel interfaces with non-prefix addresses
Inspect ip addr output when adding unusual address types to a node
Report repro cases upstream - this path indicates non-standard address reporting

When it happens

Trigger: Interfaces carrying address entries whose String() form is not 'ip/len': some point-to-point tunnels, unusual address families, or platform/Go combinations that report non-standard addr strings.

Common situations: Exotic devices (ppp, some tunnel setups) matched by name by mistake; Go stdlib differences across versions when enumerating unusual address types; unusual address families on an interface selected in config.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/8471708c81189a96. Report an issue: GitHub.