{"record":{"id":"4046e2f285a16048","repo":"kubernetes/kops","slug":"unexpected-number-of-network-interfaces-for-instan","errorCode":null,"errorMessage":"unexpected number of network interfaces for instance %q: %v","messagePattern":"unexpected number of network interfaces for instance %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops-controller/controllers/awsipam.go","lineNumber":137,"sourceCode":"\t\t\treturn ctrl.Result{}, err\n\t\t}\n\t\tinstanceID := strings.Split(providerURL.Path, \"/\")[2]\n\t\teni, err := r.ec2Client.DescribeNetworkInterfaces(ctx, &ec2.DescribeNetworkInterfacesInput{\n\t\t\tFilters: []ec2types.Filter{\n\t\t\t\t{\n\t\t\t\t\tName: new(\"attachment.instance-id\"),\n\t\t\t\t\tValues: []string{\n\t\t\t\t\t\tinstanceID,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn ctrl.Result{}, err\n\t\t}\n\n\t\tif len(eni.NetworkInterfaces) != 1 {\n\t\t\treturn ctrl.Result{}, fmt.Errorf(\"unexpected number of network interfaces for instance %q: %v\", instanceID, len(eni.NetworkInterfaces))\n\t\t}\n\n\t\tif len(eni.NetworkInterfaces[0].Ipv6Prefixes) != 1 {\n\t\t\treturn ctrl.Result{}, fmt.Errorf(\"unexpected amount of ipv6 prefixes on interface %q: %v\", *eni.NetworkInterfaces[0].NetworkInterfaceId, len(eni.NetworkInterfaces[0].Ipv6Prefixes))\n\t\t}\n\n\t\tipv6Address := aws.ToString(eni.NetworkInterfaces[0].Ipv6Prefixes[0].Ipv6Prefix)\n\t\tpodCIDRs := []string{ipv6Address}\n\t\tif err := patchNodePodCIDRs(r.coreV1Client, ctx, node, podCIDRs); err != nil {\n\t\t\treturn ctrl.Result{}, err\n\t\t}\n\t}\n\n\treturn ctrl.Result{}, nil\n}\n\nfunc (r *AWSIPAMReconciler) SetupWithManager(mgr ctrl.Manager) error {\n\treturn ctrl.NewControllerManagedBy(mgr).","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops-controller/controllers/awsipam.go#L119-L155","documentation":"In Reconcile, the controller looks up the network interface(s) attached to the node's EC2 instance via DescribeNetworkInterfaces with an attachment.instance-id filter, and expects exactly one attached ENI. This error is thrown when the API returns zero or more than one interface, meaning the single-ENI assumption behind the IPv6 prefix delegation logic is violated.","triggerScenarios":"DescribeNetworkInterfaces(attachment.instance-id == instanceID) returns len(NetworkInterfaces) != 1: the instance has additional attached ENIs (multi-NI instance, CNI-chained ENIs, load-balancer or EFA attachments), the filter matched the primary ENI of another role, or it matched none because the instance was terminated or the ProviderID-encoded instance ID is wrong.","commonSituations":"Nodes with extra ENIs attached for storage, monitoring, or EFA workloads; a malformed ProviderID like aws:///zone/<wrong-id> after node replacement; a stale/terminated instance id queried before EC2 state propagates; clusters where the AWS CNI or another controller attaches secondary ENIs to nodes.","solutions":["Detach extra network interfaces from the instance so only the primary ENI remains attached.","Verify node.Spec.ProviderID encodes the correct instance ID (format aws:///<zone>/<i-...>) and that the instance still exists in EC2.","If the node legitimately needs multiple ENIs, do not use this IPv6-prefix IPAM controller; assign podCIDRs another way (e.g. cloud-controller-manager or static cluster config).","Re-check after a short delay — transient states during instance launch/termination can briefly return an unexpected interface count; rely on controller-runtime requeue/backoff."],"exampleFix":"// before\nif len(eni.NetworkInterfaces) != 1 {\n\treturn ctrl.Result{}, fmt.Errorf(\"unexpected number of network interfaces for instance %q: %v\", instanceID, len(eni.NetworkInterfaces))\n}\n// after\nif len(eni.NetworkInterfaces) == 0 {\n\tklog.Warningf(\"no network interfaces yet for instance %q; requeueing\", instanceID)\n\treturn ctrl.Result{RequeueAfter: 10 * time.Second}, nil\n}\nif len(eni.NetworkInterfaces) > 1 {\n\treturn ctrl.Result{}, fmt.Errorf(\"unexpected number of network interfaces for instance %q: %v\", instanceID, len(eni.NetworkInterfaces))\n}","handlingStrategy":"validation","validationCode":"resp, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{\n\tInstanceIds: []string{instanceID},\n})\nif err != nil || len(resp.Reservations) == 0 {\n\treturn fmt.Errorf(\"instance %s not found or describe failed\", instanceID)\n}\n// only proceed when the instance has exactly one attached ENI\n","typeGuard":"func singleENI(eni *ec2.DescribeNetworkInterfacesOutput) bool {\n\treturn eni != nil && len(eni.NetworkInterfaces) == 1\n}","tryCatchPattern":"result, err := r.Reconcile(ctx, req)\nif err != nil && strings.Contains(err.Error(), \"unexpected number of network interfaces\") {\n\t// log and alert instead of hot-looping; do not requeue immediately\n\tklog.Errorf(\"instance topology not single-ENI: %v\", err)\n\treturn ctrl.Result{}, nil\n}","preventionTips":["Keep nodes single-ENI: avoid attaching extra ENIs (EFA, multi-homed workloads) to nodes managed by this IPAM controller.","Validate ProviderID format (aws:///<zone>/<i-id>) when nodes register, so the instance-id filter never matches a wrong/stale ID.","Confirm the node instance still exists in EC2 before treating 0 interfaces as fatal.","Monitor for this error as a signal that another controller (CNI, LB) is attaching ENIs to nodes."],"tags":["aws","ec2","eni","ipv6"],"backgroundTag":"unexpected-network-interface-count","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}