kubernetes/kops · error

overflowed CIDR while incrementing IP

Error message

overflowed CIDR while incrementing IP

What it means

incrementIP increments the CIDR's base IP byte-wise; after incrementing it re-checks ipNet.Contains(ip). If the incremented IP falls outside the original network — i.e. the increment overflowed past the last address of the CIDR — this error is thrown. It means there is no next address within the given CIDR block.

Source

Thrown at upup/pkg/fi/cloudup/defaults.go:313

		klog.V(8).Info("Not setting up Proxy Excludes")
	}

	return egressProxy, nil
}

func incrementIP(ip net.IP, cidr string) (string, error) {
	_, ipNet, err := net.ParseCIDR(cidr)
	if err != nil {
		return "", err
	}
	for i := len(ip) - 1; i >= 0; i-- {
		ip[i]++
		if ip[i] != 0 {
			break
		}
	}
	if !ipNet.Contains(ip) {
		return "", fmt.Errorf("overflowed CIDR while incrementing IP")
	}
	return ip.String(), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Choose a conventional nonMasqueradeCIDR with ample host space, e.g. 100.64.0.0/10
2. Ensure the CIDR host bits allow incrementing (not a broadcast-only or /32 block)
3. Validate the CIDR externally (ipcalc or net.ParseCIDR + check available addresses) before applying the spec

Example fix

// before
nonMasqueradeCIDR: 255.255.255.255/32
// after
nonMasqueradeCIDR: 100.64.0.0/10

base, ipNet, _ := net.ParseCIDR(cidr)
last := make(net.IP, len(ipNet.IP))
for i := range ipNet.IP { last[i] = ipNet.IP[i] | ^ipNet.Mask[i] }
if base.Equal(last) {
    return fmt.Errorf("CIDR %s has no incrementable range", cidr)
}

When it happens

Trigger: incrementIP (called from assignProxy) given a CIDR whose last address is the base IP or where incrementing the base IP exits the network, such as 255.255.255.255/32 or a network base equal to the broadcast/top of range.

Common situations: Misconfigured NonMasqueradeCIDR at the very top of an address space; degenerate single-address CIDRs; buggy CIDR values hand-entered in cluster specs.

Related errors

• unable to get first ip address in Non Masquerade CIDR
• error parsing ServiceClusterIPRange %q: %v
• unexpected IP address type for ServiceClusterIPRange: %s
• unable to parse Non Masquerade CIDR
• Invalid NetworkCIDR: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5656950f80841ab7. Report an issue: GitHub.