What causes "cidr: %s" in thanos-io/thanos?

Fix the offending part shown in the wrapped message to be a valid CIDR, e.g. '10.0.0.0/8'

cidr

Error message

cidr: %s

What it means

This error is produced by CIDRSliceCSV.Set when one comma-separated element of the input string fails to parse as a valid CIDR block. The underlying error from CIDR.Set (typically a net.ParseCIDR failure) is wrapped with the offending part so the developer can see exactly which field of the CSV value was invalid. It surfaces when parsing configuration flags or YAML (via UnmarshalYAML) that contains a list of CIDRs.

Solutions

Fix the offending part shown in the wrapped message to be a valid CIDR, e.g. '10.0.0.0/8'
Ensure every element has a /prefix length; convert bare IPs by appending the correct mask (e.g. '/32' for a single IPv4 host)
Replace dotted netmasks with prefix lengths (255.255.0.0 -> /16)
Remove stray whitespace or empty segments from the comma-separated value

Example fix

// before
cidr-ingest-urls: 10.0.0.1, 192.168.0.0/16
// after
cidr-ingest-urls: 10.0.0.1/32,192.168.0.0/16

Defensive patterns

Strategy: validation

Validate before calling

for _, part := range strings.Split(input, ",") {
    if _, _, err := net.ParseCIDR(strings.TrimSpace(part)); err != nil {
        return fmt.Errorf("invalid CIDR %q: %w", part, err)
    }
}

Try / catch

var cfg flagext.CIDRSliceCSV
if err := cfg.Set(input); err != nil {
    var wrapped string
    if strings.Contains(err.Error(), "cidr: ") {
        wrapped = strings.SplitN(err.Error(), "cidr: ", 2)[1]
    }
    return fmt.Errorf("bad CIDR config at element %q: %w", wrapped, err)
}

Prevention

Validate all CIDR entries with net.ParseCIDR before writing them into config files
Always include a /prefix length; never use bare IPs or dotted netmasks
Trim whitespace around CSV elements
Add config schema validation at startup so bad values fail fast with a clear message

When it happens

Trigger: Calling Set on a flag or unmarshalling YAML into CIDRSliceCSV where any comma-separated part is not a valid CIDR (e.g. '10.0.0.0/8,not-a-cidr', missing prefix like '10.0.0.1', or an IPv6/mask mismatch like '10.0.0.0/33').

Common situations: Typos in network prefixes in config files, using a bare IP without a /mask suffix, netmasks in dotted form (255.255.0.0) instead of prefix length, or copy-pasting an address list that includes whitespace or invalid entries.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/458c1b9459681673. Report an issue: GitHub.

Appendix: source

Thrown at internal/cortex/util/flagext/cidr.go:57

// String implements flag.Value
func (c CIDRSliceCSV) String() string {
	values := make([]string, 0, len(c))
	for _, cidr := range c {
		values = append(values, cidr.String())
	}

	return strings.Join(values, ",")
}

// Set implements flag.Value
func (c *CIDRSliceCSV) Set(s string) error {
	parts := strings.SplitSeq(s, ",")

	for part := range parts {
		cidr := &CIDR{}
		if err := cidr.Set(part); err != nil {
			return errors.Wrapf(err, "cidr: %s", part)
		}

		*c = append(*c, *cidr)
	}

	return nil
}

// UnmarshalYAML implements yaml.Unmarshaler.
func (c *CIDRSliceCSV) UnmarshalYAML(unmarshal func(any) error) error {
	var s string
	if err := unmarshal(&s); err != nil {
		return err
	}

	// An empty string means no CIDRs has been configured.
	if s == "" {
		*c = nil

View on GitHub (pinned to 35b8b99117)