kubernetes/kops · error

unable to parse Non Masquerade CIDR

Error message

unable to parse Non Masquerade CIDR

What it means

assignProxy parses cluster.Spec.Networking.NonMasqueradeCIDR with net.ParseCIDR to compute a first usable IP for egress proxy excludes. When the CIDR string is empty or malformed (e.g. missing prefix length, extra characters), ParseCIDR fails and this error is returned, aborting proxy assignment.

Source

Thrown at upup/pkg/fi/cloudup/defaults.go:244

		return "", fmt.Errorf("KubernetesVersion not specified, and unable to download latest version from %q: %v", stableURL, err)
	}
	latestVersion := strings.TrimSpace(string(b))
	return latestVersion, nil
}

func assignProxy(cluster *kops.Cluster) (*kops.EgressProxySpec, error) {
	egressProxy := cluster.Spec.Networking.EgressProxy
	// Add default no_proxy values if we are using a http proxy
	if egressProxy != nil {

		var egressSlice []string
		if egressProxy.ProxyExcludes != "" {
			egressSlice = strings.Split(egressProxy.ProxyExcludes, ",")
		}

		ip, _, err := net.ParseCIDR(cluster.Spec.Networking.NonMasqueradeCIDR)
		if err != nil {
			return nil, fmt.Errorf("unable to parse Non Masquerade CIDR")
		}

		firstIP, err := incrementIP(ip, cluster.Spec.Networking.NonMasqueradeCIDR)
		if err != nil {
			return nil, fmt.Errorf("unable to get first ip address in Non Masquerade CIDR")
		}

		// run through the basic list
		for _, exclude := range []string{
			"127.0.0.1",
			"localhost",
			cluster.Spec.ClusterDNSDomain, // TODO we may want this for public loadbalancers
			cluster.Spec.API.PublicName,
			cluster.ObjectMeta.Name,
			firstIP,
			cluster.Spec.Networking.NonMasqueradeCIDR,
		} {
			if exclude == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set a valid nonMasqueradeCIDR in spec.networking, e.g. 100.64.0.0/10 or 10.0.0.0/8
2. Validate the value with `netCIDR` syntax: address + /prefix (net.ParseCIDR rules)
3. Re-run `kops create -f cluster.yaml` after fixing; or `kops replace -f` / `kops edit cluster` for existing clusters

Example fix

// before (cluster.yaml)
networking:
  nonMasqueradeCIDR: ""
// after
networking:
  nonMasqueradeCIDR: 100.64.0.0/10

if _, _, err := net.ParseCIDR(cluster.Spec.Networking.NonMasqueradeCIDR); err != nil {
    return fmt.Errorf("invalid nonMasqueradeCIDR %q: %v", cluster.Spec.Networking.NonMasqueradeCIDR, err)
}

When it happens

Trigger: PerformAssignments/TestPopulateClusterSpec_Proxy on a cluster spec where EgressProxy is set and spec.networking.nonMasqueradeCIDR is empty, "", or not valid CIDR syntax (e.g. "10.0.0.0" without /8, "10.0.0.0/33").

Common situations: Hand-edited cluster.yaml dropping the nonMasqueradeCIDR field; typos in the CIDR; migrating specs between kOps versions where the field became required for proxy setups.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unable to get first ip address in Non Masquerade CIDR
• cannot mix egress values in private or IPv6-capable subnets
• error parsing ServiceClusterIPRange %q: %v
• unexpected IP address type for ServiceClusterIPRange: %s
• no networking mode set

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bb4e727a6cf5d3bb. Report an issue: GitHub.