kubernetes/kops · error

error associating Amazon IPv6 provided CIDR block to VPC: %v

Error message

error associating Amazon IPv6 provided CIDR block to VPC: %v

What it means

Wraps any failure from the EC2 AssociateVpcCidrBlock call that associates the Amazon-provided IPv6 /56 CIDR block (AmazonProvidedIpv6CidrBlock=true) with the kOps-managed VPC. RenderAWS performs this mutation because the VPC exists but does not yet have the Amazon-provided IPv6 pool associated. The error is a pass-through of the underlying AWS SDK error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpcamazonipv6cidrblock.go:105

func (_ *VPCAmazonIPv6CIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {
	ctx := context.TODO()
	shared := aws.ToBool(e.Shared)
	if shared && a == nil {
		// VPC not owned by kOps, no changes will be applied
		// Verify that the Amazon IPv6 provided CIDR block was found.
		return fmt.Errorf("IPv6 CIDR block provided by Amazon not found")
	}

	request := &ec2.AssociateVpcCidrBlockInput{
		VpcId:                       e.VPC.ID,
		AmazonProvidedIpv6CidrBlock: aws.Bool(true),
	}

	// Response doesn't contain the new CIDR block
	_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
	if err != nil {
		return fmt.Errorf("error associating Amazon IPv6 provided CIDR block to VPC: %v", err)
	}

	return nil // no tags
}

func (_ *VPCAmazonIPv6CIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {
	// At the moment, this can only be done via the aws_vpc resource
	return nil
}

func findVPCIPv6CIDR(cloud awsup.AWSCloud, vpcID *string) (*string, error) {
	vpc, err := cloud.DescribeVPC(aws.ToString(vpcID))
	if err != nil {
		return nil, err
	}

	var byoIPv6CidrBlock *string

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the IAM policy for the kOps controller/user includes ec2:AssociateVpcCidrBlock
2. Check the VPC doesn't already have an Amazon-provided IPv6 CIDR (reconcile state: kops replace/update cluster)
3. Verify the VPC is owned by the account, not shared via RAM, and is in 'available' state
4. Read the wrapped %v AWS SDK error for the specific cause (e.g. InvalidVpcState, UnauthorizedOperation)

Example fix

// before
_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
// after (region-level fix: grant permission / retry on InvalidVpcState)
if awsup.AWSErrorCode(err) == "InvalidVpcState" {
	return fi.NewTryAgainLaterError("waiting for VPC to become available").WithError(err)
}

// before apply, confirm permission and VPC state
if !iamAllows("ec2:AssociateVpcCidrBlock") { return errors.New("IAM policy missing ec2:AssociateVpcCidrBlock") }
vpc, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})
if *vpc.Vpcs[0].State != "available" { return errors.New("VPC not available") }

if err != nil {
	if awsup.AWSErrorCode(err) == "InvalidVpcState" || awsup.AWSErrorCode(err) == "Throttling" {
		return fi.NewTryAgainLaterError("retrying VPC IPv6 association").WithError(err)
	}
	return fmt.Errorf("error associating Amazon IPv6 provided CIDR block to VPC: %v", err)
}

When it happens

Trigger: RenderAWS of VPCAmazonIPv6CIDRBlock invokes t.Cloud.EC2().AssociateVpcCidrBlock with AmazonProvidedIpv6CidrBlock=true and the SDK returns any error (permission denied, VPC limit, wrong state).

Common situations: EC2 IAM policy lacks ec2:AssociateVpcCidrBlock; VPC already has the maximum number of CIDR associations; VPC is shared (RAM) and not owned by the account; the VPC was deleted concurrently.

Related errors

• VPC ID is required when EgressOnlyInternetGateway is shared
• EgressOnlyInternetGateway for shared VPC was not found
• error creating EgressOnlyInternetGateway: %v
• error creating VPC: %v
• IPv6 CIDR block provided by Amazon not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4b5ee4772c178d4f. Report an issue: GitHub.