kubernetes/kops · error

sourceRange %q is not valid: %w

Error message

sourceRange %q is not valid: %w

What it means

Validation error from FirewallRule.Normalize raised while splitting source ranges into IPv4/IPv6 groups. A value in e.SourceRanges failed CIDR parsing; the %w wraps the underlying net.ParseCIDR-style error naming the malformed range.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/firewallrule.go:120

		if len(e.SourceRanges) == 0 && len(e.SourceTags) == 0 {
			return fmt.Errorf("either SourceRanges or SourceTags should be specified when Disabled is false")
		}
	}

	// Treat it as an error if SourceRanges _and_ SourceTags both set;
	// this is interpreted as OR, not AND, which is likely not what was intended.
	if len(e.SourceRanges) != 0 && len(e.SourceTags) != 0 {
		return fmt.Errorf("SourceRanges and SourceTags should not both be specified")
	}

	name := fi.ValueOf(e.Name)

	// Make sure we've split the ipv4 / ipv6 addresses.
	// A single firewall rule can't mix ipv4 and ipv6 addresses, so we split them into two rules.
	for _, sourceRange := range e.SourceRanges {
		_, cidr, err := net.ParseCIDR(sourceRange)
		if err != nil {
			return fmt.Errorf("sourceRange %q is not valid: %w", sourceRange, err)
		}

		if e.Family == "" {
			// This is our own requirement, just for consistency checking.
			// Previous we used the name, but that was confused when the cluster name was ipv6.example.com
			return fmt.Errorf("must set Family when using SourceRanges")
		}

		if cidr.IP.To4() != nil {
			// IPv4
			if e.Family != AddressFamilyIPv4 {
				return fmt.Errorf("ipv4 ranges should not be in a ipv6-named rule (found %s in %s)", sourceRange, name)
			}
		} else {
			// IPv6
			if e.Family != AddressFamilyIPv6 {
				return fmt.Errorf("ipv6 ranges should be in a ipv6-named rule (found %s in %s)", sourceRange, name)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

  1. Correct the malformed CIDR in the firewall rule spec (e.g. add the prefix length: 10.0.0.0/8 not 10.0.0.0)
  2. Ensure each source range is a valid IPv4 or IPv6 CIDR — lone IPs are not accepted here

Example fix

// before
sourceRanges: ["10.0.0.1"]
// after
sourceRanges: ["10.0.0.1/32"]
Defensive patterns

Strategy: validation

Validate before calling

for _, r := range rule.SourceRanges {
  if _, _, err := net.ParseCIDR(r); err != nil {
    return fmt.Errorf("sourceRange %q is not valid CIDR: %w", r, err)
  }
}

Prevention

When it happens

Trigger: A sourceRanges entry like "10.0.0.1" (bare IP without prefix) or "10.0.0.0/33" fails net.ParseCIDR inside the loop over e.SourceRanges.

Common situations: Typing a single IP without /32; typos in prefix length; IPv6 addresses with wrong notation; values generated by broken tooling/templating.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d726ca06c44426e3. Report an issue: GitHub.