diff --git a/pkg/controller/node/cidr_set.go b/pkg/controller/node/cidr_set.go
index c4d9aaa8900..3ceec242e7d 100644
--- a/pkg/controller/node/cidr_set.go
+++ b/pkg/controller/node/cidr_set.go
@@ -79,7 +79,7 @@ func (s *cidrSet) allocateNext() (*net.IPNet, error) {
 }
 
 func (s *cidrSet) getBeginingAndEndIndices(cidr *net.IPNet) (begin, end int, err error) {
-	begin, end = 0, s.maxCIDRs
+	begin, end = 0, s.maxCIDRs-1
 	cidrMask := cidr.Mask
 	maskSize, _ := cidrMask.Size()
 
diff --git a/pkg/controller/node/cidr_set_test.go b/pkg/controller/node/cidr_set_test.go
index 67d59a76d0b..ff1db26a9a2 100644
--- a/pkg/controller/node/cidr_set_test.go
+++ b/pkg/controller/node/cidr_set_test.go
@@ -249,7 +249,7 @@ func TestOccupy(t *testing.T) {
 			subNetMaskSize:    16,
 			subNetCIDRStr:     "127.0.0.0/8",
 			expectedUsedBegin: 0,
-			expectedUsedEnd:   256,
+			expectedUsedEnd:   255,
 			expectErr:         false,
 		},
 		{
@@ -257,7 +257,7 @@ func TestOccupy(t *testing.T) {
 			subNetMaskSize:    16,
 			subNetCIDRStr:     "127.0.0.0/2",
 			expectedUsedBegin: 0,
-			expectedUsedEnd:   256,
+			expectedUsedEnd:   255,
 			expectErr:         false,
 		},
 		{