kubernetes/kops · error

error associating AdditionalCIDR to VPC: %v

Error message

error associating AdditionalCIDR to VPC: %v

What it means

Wraps failure of the EC2 AssociateVpcCidrBlock call kOps issues to associate an additional IPv4 CIDR block with the VPC during RenderAWS of VPCCIDRBlock. It happens only when changes.CIDRBlock != nil, i.e. the CIDR must be newly associated. The underlying SDK error is passed through with %v.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpccidrblock.go:137

func (_ *VPCCIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCCIDRBlock) error {
	ctx := context.TODO()
	shared := aws.ToBool(e.Shared)
	if shared && a == nil {
		// VPC not owned by kOps, no changes will be applied
		// Verify that the CIDR block was found.
		return fmt.Errorf("CIDR block %q not found", aws.ToString(e.CIDRBlock))
	}

	if changes.CIDRBlock != nil {
		request := &ec2.AssociateVpcCidrBlockInput{
			VpcId:     e.VPC.ID,
			CidrBlock: e.CIDRBlock,
		}

		_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
		if err != nil {
			return fmt.Errorf("error associating AdditionalCIDR to VPC: %v", err)
		}
	}

	return nil // no tags
}

type terraformVPCCIDRBlock struct {
	VPCID     *terraformWriter.Literal `cty:"vpc_id"`
	CIDRBlock *string                  `cty:"cidr_block"`
}

func (_ *VPCCIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCCIDRBlock) error {
	shared := aws.ToBool(e.Shared)
	if shared && a == nil {
		// VPC not owned by kOps, no changes will be applied
		// Verify that the CIDR block was found.
		return fmt.Errorf("CIDR block %q not found", aws.ToString(e.CIDRBlock))
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Increase the VPC CIDR association quota or remove an unused associated CIDR
2. Grant ec2:AssociateVpcCidrBlock to the provisioning IAM role
3. Check the new CIDR does not overlap existing VPC CIDRs or peerings, and the VPC is in 'available' state
4. If VPC is RAM-shared, associate the CIDR in the owner account instead

Example fix

// before
_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
if err != nil { return fmt.Errorf("error associating AdditionalCIDR to VPC: %v", err) }
// after: pre-validate quota/state before calling
if len(a.VPC.CidrBlocks) >= 5 { return fmt.Errorf("VPC %s already has max CIDRs", e.VPC.ID) }

out, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})
assoc := len(out.Vpcs[0].CidrBlockAssociationSet)
if assoc >= 5 { return fmt.Errorf("VPC %s has %d CIDRs; quota reached", vpcID, assoc) }
if !iamAllows("ec2:AssociateVpcCidrBlock") { return errors.New("missing ec2:AssociateVpcCidrBlock") }

_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
if err != nil {
	if awsup.AWSErrorCode(err) == "InvalidVpcState" || awsup.AWSErrorCode(err) == "Throttling" {
		return fi.NewTryAgainLaterError("retry CIDR association").WithError(err)
	}
	return err
}

When it happens

Trigger: RenderAWS on a non-shared VPCCIDRBlock where changes.CIDRBlock is set and t.Cloud.EC2().AssociateVpcCidrBlock returns an error (quota exceeded, permission, invalid state).

Common situations: Account hit the 5-secondary-CIDR-per-VPC limit (IPv4) or 5/50 total; missing ec2:AssociateVpcCidrBlock permission; VPC shared via RAM but owned by another account; overlapping CIDR range.

Related errors

• error creating VPC: %v
• unexpected target type for deletion: %T
• IPv6 CIDR block provided by Amazon not found
• error associating Amazon IPv6 provided CIDR block to VPC: %v
• CIDR block %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/579486628454b9d3. Report an issue: GitHub.