kubernetes/kops · error

CIDR block %q not found

Error message

CIDR block %q not found

What it means

RenderAWS for VPCCIDRBlock errors when the task is marked Shared and the actual VPCCIDRBlock was not found (a == nil), meaning the configured CIDR block does not exist on the target VPC. kOps refuses to proceed since it cannot create or verify a shared block it does not own.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpccidrblock.go:126

		if changes.VPC != nil {
			return fi.CannotChangeField("VPC")
		}

		if changes.CIDRBlock != nil {
			return fi.CannotChangeField("CIDRBlock")
		}
	}

	return nil
}

func (_ *VPCCIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCCIDRBlock) error {
	ctx := context.TODO()
	shared := aws.ToBool(e.Shared)
	if shared && a == nil {
		// VPC not owned by kOps, no changes will be applied
		// Verify that the CIDR block was found.
		return fmt.Errorf("CIDR block %q not found", aws.ToString(e.CIDRBlock))
	}

	if changes.CIDRBlock != nil {
		request := &ec2.AssociateVpcCidrBlockInput{
			VpcId:     e.VPC.ID,
			CidrBlock: e.CIDRBlock,
		}

		_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
		if err != nil {
			return fmt.Errorf("error associating AdditionalCIDR to VPC: %v", err)
		}
	}

	return nil // no tags
}

type terraformVPCCIDRBlock struct {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Associate the missing CIDR block with the VPC (aws ec2 associate-vpc-cidr-block) or add it via kOps cluster spec additionalNetworkCIDRs
2. Verify the CIDR in additionalNetworkCIDRs exactly matches a CIDR associated to the VPC
3. If the block is unmanaged/unneeded, remove it from the cluster spec

Example fix

// cluster.yaml
// before
additionalNetworkCIDRs:
- 10.99.0.0/16   # not associated with the VPC
// after
additionalNetworkCIDRs:
- 10.10.0.0/16   # CIDR actually associated with the VPC

out, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})
found := false
for _, cb := range out.Vpcs[0].CidrBlockAssociationSet {
	if aws.ToString(cb.CidrBlock) == desiredCIDR && aws.ToString(cb.CidrBlockState.State) == "associated" { found = true }
}
if shared && !found { return fmt.Errorf("CIDR %s not associated with VPC %s", desiredCIDR, vpcID) }

if err := render(); err != nil {
	if strings.Contains(err.Error(), "CIDR block") && strings.Contains(err.Error(), "not found") {
		// reconcile: associate the CIDR first, then re-run apply
	}
	return err
}

When it happens

Trigger: shared=true on the VPCCIDRBlock task and Find returns nil actual; e.g. cluster spec references an additional CIDR block not associated with the VPC.

Common situations: Typo in spec additionalNetworkCIDRs; CIDR block was disassociated manually from the VPC; cluster was re-targeted to a different VPC that lacks the CIDR.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• VPC ID is required when EgressOnlyInternetGateway is shared
• EgressOnlyInternetGateway for shared VPC was not found
• error creating VPC: %v
• unexpected target type for deletion: %T
• IPv6 CIDR block provided by Amazon not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0ee12ff5989ce37e. Report an issue: GitHub.