kubernetes/kops · error

Invalid NetworkCIDR: %q

Error message

Invalid NetworkCIDR: %q

What it means

kOps needs to auto-allocate subnet CIDRs by splitting the cluster's NetworkCIDR, but `spec.networking.networkCIDR` is not a parseable CIDR (net.ParseCIDR failed). kOps wraps the failure with this message instead of the parse error.

Source

Thrown at upup/pkg/fi/cloudup/subnets.go:124

	}

	if needZones {
		for i := range c.Spec.Networking.Subnets {
			subnet := &c.Spec.Networking.Subnets[i]
			if subnet.ID != "" && subnet.Zone == "" {
				return fmt.Errorf("could not determine the zone of subnet %q; specify the zone in the cluster spec", subnet.Name)
			}
		}
	}

	if allSubnetsHaveCIDRs(c) {
		klog.V(4).Infof("All subnets have CIDRs; skipping assignment logic")
		return nil
	}

	_, cidr, err := net.ParseCIDR(c.Spec.Networking.NetworkCIDR)
	if err != nil {
		return fmt.Errorf("Invalid NetworkCIDR: %q", c.Spec.Networking.NetworkCIDR)
	}

	// We split the network range into 2, 4 or 8 subnets
	// But we then reserve the lowest one for the private block
	// (and we split _that_ into 8 further subnets, leaving the first one unused/for future use)

	var bigSubnets []*kops.ClusterSubnetSpec
	var littleSubnets []*kops.ClusterSubnetSpec

	var reserved []*net.IPNet
	for i := range c.Spec.Networking.Subnets {
		subnet := &c.Spec.Networking.Subnets[i]
		if subnet.CIDR != "" {
			_, cidrSubnet, err := net.ParseCIDR(subnet.CIDR)
			if err != nil {
				return fmt.Errorf("invalid subnet %q CIDR: %q", subnet.Name, subnet.CIDR)
			}
			// Skip additional subnets

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set `spec.networking.networkCIDR` to a valid CIDR, e.g. `10.0.0.0/16`, in the cluster spec.
2. Re-run `kops update cluster`; alternatively give every subnet an explicit `cidr` so the split path is skipped.
3. Validate the string with `python3 -c "import ipaddress; ipaddress.ip_network('10.0.0.0/16')"` or similar before applying.

Example fix

// before
networking:
  networkCIDR: "10.0.0.0"   # missing prefix length
// after
networking:
  networkCIDR: 10.0.0.0/16

if _, _, err := net.ParseCIDR(spec.Networking.NetworkCIDR); err != nil {
    return fmt.Errorf("networkCIDR %q is not valid CIDR: %w", spec.Networking.NetworkCIDR, err)
}

When it happens

Trigger: Cluster spec contains a malformed networkCIDR such as `10.0.0.0/8/`, `10.0.0.0`, `10.0.0.0/33`, or an empty value while some subnet lacks a CIDR (the assignment path only runs when CIDRs are missing).

Common situations: Hand-edited cluster.yaml with a typo; templating that substituted an empty CIDR; leaving networkCIDR blank assuming kOps would auto-generate it (it does not — it must be valid to split).

Related errors

• error parsing ServiceClusterIPRange %q: %v
• unexpected IP address type for ServiceClusterIPRange: %s
• unable to parse Non Masquerade CIDR
• unable to get first ip address in Non Masquerade CIDR
• overflowed CIDR while incrementing IP

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5cbfd1abd31e1f81. Report an issue: GitHub.