unable to infer NetworkCIDR from Network ID, please specify

Error message

unable to infer NetworkCIDR from Network ID, please specify --network-cidr

What it means

Follow-on guard in PerformAssignments for AWS shared VPCs: the VPC was found, but it reported no CIDR block, so kOps cannot infer the cluster network range. The user must supply it explicitly in this situation.

Source

Thrown at upup/pkg/fi/cloudup/defaults.go:90

	if cloud.ProviderID() == kops.CloudProviderGCE {
		if err := gce.PerformNetworkAssignments(ctx, c, cloud); err != nil {
			return err
		}
	}

	if cloud.ProviderID() == kops.CloudProviderAWS && c.Spec.Networking.NetworkCIDR == "" {
		if c.SharedVPC() {
			vpcInfo, err := cloud.FindVPCInfo(c.Spec.Networking.NetworkID)
			if err != nil {
				return err
			}
			if vpcInfo == nil {
				return fmt.Errorf("unable to find Network ID %q", c.Spec.Networking.NetworkID)
			}
			c.Spec.Networking.NetworkCIDR = vpcInfo.CIDR
			if c.Spec.Networking.NetworkCIDR == "" {
				return fmt.Errorf("unable to infer NetworkCIDR from Network ID, please specify --network-cidr")
			}
		} else {
			// TODO: Choose non-overlapping networking CIDRs for VPCs, using vpcInfo
			c.Spec.Networking.NetworkCIDR = defaultAWSNetworkCIDR
		}

		// Amazon VPC CNI uses the same network
		if c.Spec.Networking.AmazonVPC != nil && c.Spec.Networking.NonMasqueradeCIDR != "::/0" {
			c.Spec.Networking.NonMasqueradeCIDR = c.Spec.Networking.NetworkCIDR
		}
	}

	if cloud.ProviderID() == kops.CloudProviderAzure && c.Spec.Networking.NetworkCIDR == "" {
		if c.SharedVPC() {
			if c.Spec.CloudProvider.Azure == nil || c.Spec.CloudProvider.Azure.ResourceGroupName == "" {
				return fmt.Errorf("missing required --azure-resource-group-name when specifying Network ID")
			}
			vpcInfo, err := cloud.(azure.AzureCloud).FindVNetInfo(c.Spec.Networking.NetworkID, c.Spec.CloudProvider.Azure.ResourceGroupName)

View on GitHub (pinned to 4c8573c808)

Solutions

Pass --network-cidr (or set spec.networking.networkCIDR) matching the shared VPC's CIDR
Verify the VPC actually has an associated IPv4 CIDR block

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/defaults.go:90 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/af200603c972599d. Report an issue: GitHub.