kubernetes/kops · error

cannot allocate CIDR of size %v

Error message

cannot allocate CIDR of size %v

What it means

Allocate walks the parent CIDR and returns the first free subnet matching the requested mask size. If it exhausts every candidate position without finding a non-overlapping subnet (or the requested mask cannot fit in the parent at all), it fails with this error naming the requested mask size.

Source

Thrown at pkg/util/subnet/cidrmap.go:111

		if err := incrementIP(candidate.IP, mask); err != nil {
			return nil, err
		}

		// Check we're still in the range we're drawing from
		if !cidrsOverlap(cidr, &candidate) {
			klog.Infof("candidate CIDR %v is not in CIDR %v", candidate, cidr)
			break
		}

		if !c.isInUse(&candidate) {
			if err := c.MarkInUse(candidate.String()); err != nil {
				return nil, err
			}
			return &candidate, nil
		}
	}

	return nil, fmt.Errorf("cannot allocate CIDR of size %v", mask)
}

func (c *CIDRMap) isInUse(n *net.IPNet) bool {
	for i := range c.used {
		if cidrsOverlap(&c.used[i], n) {
			return true
		}
	}
	return false
}

// cidrsOverlap returns true if and only if the two CIDRs are non-disjoint
func cidrsOverlap(l, r *net.IPNet) bool {
	return l.Contains(r.IP) || r.Contains(l.IP)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reduce requested subnet size (use a larger prefix number, e.g. /20 instead of /16) or enlarge the parent CIDR
2. Check what is already marked in-use (cluster spec subnets, VPC CIDRs) and free/consolidate overlaps
3. Verify the mask fits the parent range mathematically before allocating (host bits available >= requested size)

Example fix

// before
// parent 10.0.0.0/16, requesting a /16-sized subnet
subnet, err := cidrMap.Allocate("10.0.0.0/16", net.CIDRMask(16, 32))
// after
subnet, err := cidrMap.Allocate("10.0.0.0/16", net.CIDRMask(20, 32))

// Check requested mask fits in parent before Allocate
_, parent, _ := net.ParseCIDR(from)
ones, _ := parent.Mask.Size()
reqOnes, reqBits := mask.Size()
if reqOnes < ones || reqBits != len(parent.IP)*8 {
	return fmt.Errorf("mask /%d too large for parent /%d", reqOnes, ones)
}

When it happens

Trigger: Calling Allocate with a mask so large (subnets bigger than the parent range) or a parent range so fragmented by in-use CIDRs that no subnet of the requested size fits.

Common situations: Requesting /16 subnets from a /16 parent, an IPv4 parent when a huge mask is requested, or many pre-existing subnets (via MarkInUse) that fragment the space in small VPCs.

Related errors

• could not find any non-overlapping CIDRs in parent NetworkCI
• insufficient (little) CIDRs remaining for automatic CIDR all
• insufficient (big) CIDRs remaining for automatic CIDR alloca
• failed to parse network CIDR %q: %w
• failed to parse subnet CIDR %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/27eff1813181ce37. Report an issue: GitHub.