insufficient (big) CIDRs remaining for automatic CIDR alloca

Error message

insufficient (big) CIDRs remaining for automatic CIDR allocation to subnet %q

What it means

'Big' subnets (Public/Private) get CIDRs assigned from the pool of non-overlapping big CIDRs carved from the parent networkCIDR. When that pool is exhausted before all big subnets have a CIDR, kOps fails rather than allocating overlapping space.

Source

Thrown at upup/pkg/fi/cloudup/subnets.go:245

			}
			subnet.CIDR = littleCIDRs[0].String()
			klog.Infof("Assigned CIDR %s to subnet %s", subnet.CIDR, subnet.Name)

			littleCIDRs = littleCIDRs[1:]
		}
	}

	// Assign CIDRs to big subnets
	for _, subnet := range bigSubnets {
		if subnet.CIDR != "" {
			continue
		}
		if subnet.IPv6CIDR != "" && subnet.Type == kops.SubnetTypePrivate {
			continue
		}

		if len(bigCIDRs) == 0 {
			return fmt.Errorf("insufficient (big) CIDRs remaining for automatic CIDR allocation to subnet %q", subnet.Name)
		}
		subnet.CIDR = bigCIDRs[0].String()
		klog.Infof("Assigned CIDR %s to subnet %s", subnet.CIDR, subnet.Name)

		bigCIDRs = bigCIDRs[1:]
	}

	return nil
}

// allSubnetsHaveCIDRs returns true iff each subnet in the cluster has a non-empty CIDR
func allSubnetsHaveCIDRs(c *kops.Cluster) bool {
	for i := range c.Spec.Networking.Subnets {
		subnet := &c.Spec.Networking.Subnets[i]
		if subnet.CIDR != "" {
			continue
		}

View on GitHub (pinned to 4c8573c808)

Solutions

Enlarge cluster.spec.networkCIDR or add additionalNetworkCIDRs to grow the big CIDR pool
Assign explicit, non-overlapping CIDRs to the remaining subnets
Delete or consolidate unused subnets so the existing pool suffices

Example fix

// before
spec:
  networkCIDR: 10.0.0.0/24  # 4 subnets requested
// after
spec:
  networkCIDR: 10.0.0.0/16

Defensive patterns

Strategy: validation

Validate before calling

big := 0
for _, s := range subnets {
	if (s.Type == kops.SubnetTypePublic || s.Type == kops.SubnetTypePrivate) && s.CIDR == "" { big++ }
}
// compare big against count of non-overlapping big CIDRs carved from networkCIDR

Try / catch

if err := PerformAssignments(c, cloud); err != nil {
	if strings.Contains(err.Error(), "insufficient (big) CIDRs") { /* enlarge networkCIDR or assign explicit CIDRs */ }
	return err
}

Prevention

Use a networkCIDR large enough for one subnet per AZ (e.g. /16 for many AZs)
Pre-assign explicit CIDRs when exceeding 8-ish subnets
Review subnet additions against remaining CIDR headroom

When it happens

Trigger: More Public/Private subnets without explicit CIDRs than non-overlapping big CIDRs available after removing reserved subnets, during PerformAssignments in `kops update cluster`.

Common situations: Adding AZs beyond what the networkCIDR can carve; subnets skipped due to IPv6-only private config reducing the pool; small networkCIDR (e.g. /27) with many private subnets.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ff454029412c2ec3. Report an issue: GitHub.