kubernetes/kops · error

unable to get first ip address in Non Masquerade CIDR

Error message

unable to get first ip address in Non Masquerade CIDR

What it means

After successfully parsing NonMasqueradeCIDR, assignProxy calls incrementIP to get the first address after the network base (used as a proxy-exclude default). If incrementIP fails, this wrapped error is returned. With a valid CIDR this rarely fails, so it usually indicates an internal edge case such as a /32 (or /128) CIDR with no incrementable host space.

Source

Thrown at upup/pkg/fi/cloudup/defaults.go:249

func assignProxy(cluster *kops.Cluster) (*kops.EgressProxySpec, error) {
	egressProxy := cluster.Spec.Networking.EgressProxy
	// Add default no_proxy values if we are using a http proxy
	if egressProxy != nil {

		var egressSlice []string
		if egressProxy.ProxyExcludes != "" {
			egressSlice = strings.Split(egressProxy.ProxyExcludes, ",")
		}

		ip, _, err := net.ParseCIDR(cluster.Spec.Networking.NonMasqueradeCIDR)
		if err != nil {
			return nil, fmt.Errorf("unable to parse Non Masquerade CIDR")
		}

		firstIP, err := incrementIP(ip, cluster.Spec.Networking.NonMasqueradeCIDR)
		if err != nil {
			return nil, fmt.Errorf("unable to get first ip address in Non Masquerade CIDR")
		}

		// run through the basic list
		for _, exclude := range []string{
			"127.0.0.1",
			"localhost",
			cluster.Spec.ClusterDNSDomain, // TODO we may want this for public loadbalancers
			cluster.Spec.API.PublicName,
			cluster.ObjectMeta.Name,
			firstIP,
			cluster.Spec.Networking.NonMasqueradeCIDR,
		} {
			if exclude == "" {
				continue
			}
			if !strings.Contains(egressProxy.ProxyExcludes, exclude) {
				egressSlice = append(egressSlice, exclude)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use a standard subnet-sized nonMasqueradeCIDR (e.g. /8, /16, /10) instead of a /32
2. Check that the CIDR's base IP is the network address and has room to increment
3. If this occurs with a normal CIDR, verify kOps version — upgrade, as it may be an incrementIP edge-case bug

Example fix

// before
networking:
  nonMasqueradeCIDR: 10.0.0.1/32
// after
networking:
  nonMasqueradeCIDR: 10.0.0.0/16

_, ipNet, err := net.ParseCIDR(cidr)
if err != nil { return err }
if ones, _ := ipNet.Mask.Size(); ones >= 31 {
    return fmt.Errorf("CIDR %s too small for IP increment", cidr)
}

When it happens

Trigger: assignProxy invoked with a valid but degenerate NonMasqueradeCIDR where incrementIP cannot produce an in-net next IP (e.g. single-host CIDR like 10.0.0.1/32) or an unexpected incrementIP failure.

Common situations: Clusters configured with point-to-point /32 nonMasquerade CIDRs; specs with unusual narrow CIDR ranges in proxy/egress setups.

Related errors

• unable to parse Non Masquerade CIDR
• overflowed CIDR while incrementing IP
• error parsing ServiceClusterIPRange %q: %v
• unexpected IP address type for ServiceClusterIPRange: %s
• Invalid NetworkCIDR: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0eaa1c17b4eca2d3. Report an issue: GitHub.