kubernetes/kops · error

expected PodCIDR to be set for IPAlias / kubenet

Error message

expected PodCIDR to be set for IPAlias / kubenet

What it means

Building GCE firewall rules for IPAlias/kubenet networking found the PodCIDR unset; non-IPv6 IP-alias clusters must have a pod CIDR allocation so node firewall rules can reference pod ranges.

Source

Thrown at pkg/model/gcemodel/firewall.go:173

		t := &gcetasks.FirewallRule{
			Name:       s(b.NameForFirewallRule("node-to-master")),
			Lifecycle:  b.Lifecycle,
			Network:    network,
			SourceTags: []string{b.GCETagForRole(kops.InstanceGroupRoleNode)},
			TargetTags: append(b.GCETagsForAPIServerTargets(), b.GCETagForRole("Master")),
			Allowed:    nodeToMasterAllowed,
		}
		c.AddTask(t)
	}

	if b.NetworkingIsIPAlias() || b.NetworkingIsGCERoutes() {
		if b.IsIPv6Only() {
			// We can use tags for IPv6, and this is covered by prior rules
		} else {
			// When using IP alias or custom routes, SourceTags for identifying traffic don't work, and we must recognize by CIDR

			if b.Cluster.Spec.Networking.PodCIDR == "" {
				return fmt.Errorf("expected PodCIDR to be set for IPAlias / kubenet")
			}

			network, err := b.LinkToNetwork()
			if err != nil {
				return err
			}
			b.AddFirewallRulesTasks(c, "pod-cidrs-to-node", &gcetasks.FirewallRule{
				Lifecycle:    b.Lifecycle,
				Network:      network,
				SourceRanges: []string{b.Cluster.Spec.Networking.PodCIDR},
				TargetTags:   []string{b.GCETagForRole(kops.InstanceGroupRoleNode)},
				Allowed:      allProtocols,
			})

			// Source tags cannot match pod-sourced traffic, so without this rule pods cannot
			// reach pods hosted on control plane nodes. Grant the same restricted access as
			// nodes so host ports such as etcd stay protected.
			b.AddFirewallRulesTasks(c, "pod-cidrs-to-master", &gcetasks.FirewallRule{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure the cluster spec defines a pod network CIDR for IPAlias/kubenet networking
2. Check the networkID/podCIDR settings via kops edit cluster
3. Re-run kops update

When it happens

Trigger: Thrown at pkg/model/gcemodel/firewall.go:173 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c0b0f5e2c30d850d. Report an issue: GitHub.