kubernetes/kops · error

subnet %q has unexpected CIDR %q

Error message

subnet %q has unexpected CIDR %q

What it means

After classifying a subnet, kOps parses any user-specified subnet CIDR so it can reserve it against overlap with the parent NetworkCIDR. This error means the subnet's CIDR failed net.ParseCIDR — same parse failure family as error 3420, but raised on the later pass that collects reserved CIDRs.

Source

Thrown at upup/pkg/fi/cloudup/subnets.go:161

			if !cidr.Contains(cidrSubnet.IP) {
				continue
			}
		}
		switch subnet.Type {
		case kops.SubnetTypeDualStack, kops.SubnetTypePublic, kops.SubnetTypePrivate:
			bigSubnets = append(bigSubnets, subnet)

		case kops.SubnetTypeUtility:
			littleSubnets = append(littleSubnets, subnet)

		default:
			return fmt.Errorf("subnet %q has unknown type %q", subnet.Name, subnet.Type)
		}

		if subnet.CIDR != "" {
			_, subnetCIDR, err := net.ParseCIDR(subnet.CIDR)
			if err != nil {
				return fmt.Errorf("subnet %q has unexpected CIDR %q", subnet.Name, subnet.CIDR)
			}

			reserved = append(reserved, subnetCIDR)
		}
	}

	// Assign a consistent order
	sort.Sort(ByZone(bigSubnets))
	sort.Sort(ByZone(littleSubnets))

	// Check how many subnet slices are needed
	cidrCount := len(bigSubnets)
	if len(littleSubnets) > 0 {
		cidrCount += 1
	}
	var bigCIDRs []*net.IPNet
	if cidrCount <= 1 {
		bigCIDRs, err = subnet.SplitInto1(cidr)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct the malformed cidr value on the offending subnet to a valid CIDR within or carved from networkCIDR
2. Remove the cidr field to let kOps auto-assign a CIDR from the parent networkCIDR
3. Validate the manifest offline with a CIDR linter or `kops get cluster -o yaml` round-trip before applying

Example fix

// before
- name: nodes
  cidr: 10.0.2.0/
// after
- name: nodes
  cidr: 10.0.2.0/24

for _, s := range subnets {
	if s.CIDR != "" {
		if _, _, err := net.ParseCIDR(s.CIDR); err != nil {
			return fmt.Errorf("subnet %q CIDR %q invalid", s.Name, s.CIDR)
		}
	}
}

func parseableCIDR(s string) bool {
	_, _, err := net.ParseCIDR(s)
	return err == nil
}

if err := PerformAssignments(c, cloud); err != nil {
	if strings.Contains(err.Error(), "unexpected CIDR") { /* fix the named subnet's CIDR */ }
	return err
}

When it happens

Trigger: PerformAssignments invoked with a subnet that passes type validation but whose cidr field is an unparsable CIDR string, e.g. '10.0.0.0/' or 'banana'.

Common situations: Partially-edited cluster specs where a CIDR was truncated; templated manifests that emitted empty or malformed CIDRs; mixing IPv6 CIDRs into an IPv4 cluster's subnet list.

Related errors

• invalid subnet %q CIDR: %q
• error parsing network cidr %q: %v
• error parsing CIDR %q: %v
• unable to resolve Kubernetes cluster API URL dns: %v
• could not find any non-overlapping CIDRs in parent NetworkCI

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/dd5fc4e4d64f5d9b. Report an issue: GitHub.