kubernetes/kops · error

IPv6 CIDR block provided by Amazon not found

Error message

IPv6 CIDR block provided by Amazon not found

What it means

For VPCAmazonIPv6CIDRBlock, when the task is marked shared and no actual CIDR block was found on the VPC, kOps cannot create/verify the Amazon-provided IPv6 CIDR (it won't modify a VPC it doesn't own), so it returns this error. It means the expected AmazonProvidedIpv6CidrBlock association is absent.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpcamazonipv6cidrblock.go:94

		return fi.RequiredField("VPC")
	}

	if a != nil && changes != nil {
		if changes.VPC != nil {
			return fi.CannotChangeField("VPC")
		}
	}

	return nil
}

func (_ *VPCAmazonIPv6CIDRBlock) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {
	ctx := context.TODO()
	shared := aws.ToBool(e.Shared)
	if shared && a == nil {
		// VPC not owned by kOps, no changes will be applied
		// Verify that the Amazon IPv6 provided CIDR block was found.
		return fmt.Errorf("IPv6 CIDR block provided by Amazon not found")
	}

	request := &ec2.AssociateVpcCidrBlockInput{
		VpcId:                       e.VPC.ID,
		AmazonProvidedIpv6CidrBlock: aws.Bool(true),
	}

	// Response doesn't contain the new CIDR block
	_, err := t.Cloud.EC2().AssociateVpcCidrBlock(ctx, request)
	if err != nil {
		return fmt.Errorf("error associating Amazon IPv6 provided CIDR block to VPC: %v", err)
	}

	return nil // no tags
}

func (_ *VPCAmazonIPv6CIDRBlock) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCAmazonIPv6CIDRBlock) error {
	// At the moment, this can only be done via the aws_vpc resource

View on GitHub (pinned to 4c8573c808)

Solutions

1. Associate an Amazon-provided IPv6 CIDR first: `aws ec2 associate-vpc-cidr-block --vpc-id <id> --amazon-provided-ipv6-cidr-block`
2. Or point the cluster at a VPC that already has the IPv6 CIDR
3. Or unshare (remove shared:true) so kOps manages the CIDR itself

Example fix

// before: shared VPC without IPv6 CIDR
sharedVPC: vpc-x  # no ipv6 cidr
// after
aws ec2 associate-vpc-cidr-block --vpc-id vpc-x --amazon-provided-ipv6-cidr-block

vpc, _ := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})
if len(vpc.Vpcs) == 1 && !hasAmazonProvidedIPv6CIDR(vpc.Vpcs[0]) {
	return fmt.Errorf("shared VPC %s lacks Amazon-provided IPv6 CIDR; associate one before apply", vpcID)
}

func hasAmazonProvidedIPv6CIDR(v awstypes.Vpc) bool {
	for _, a := range v.Ipv6CidrBlockAssociationSet {
		if a.Ipv6CidrBlockState != nil && a.Ipv6CidrBlockState.State == awstypes.Ipv6CidrBlockStateCodeAssociated {
			return true
		}
	}
	return false
}

err := kopsApply()
if err != nil && strings.Contains(err.Error(), "IPv6 CIDR block provided by Amazon not found") {
	// remediate: associate IPv6 CIDR on the shared VPC or pick another VPC
}

When it happens

Trigger: Shared VPC does not have an Amazon-provided IPv6 CIDR associated (AssociateVpcCidrBlock never run, or egress-only IGW/CIDR removed), so the find returned no matching actual state.

Common situations: Reusing a legacy IPv4-only VPC for an IPv6-enabled cluster; someone disassociated the IPv6 CIDR; account hasn't enabled IPv6 for the VPC before sharing it into kOps.

Related errors

• error associating Amazon IPv6 provided CIDR block to VPC: %v
• VPC ID is required when EgressOnlyInternetGateway is shared
• EgressOnlyInternetGateway for shared VPC was not found
• error creating EgressOnlyInternetGateway: %v
• VPC with id %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/97d3c3c331e8a9c3. Report an issue: GitHub.