{"record":{"id":"41317b770fa384d8","repo":"cilium/cilium","slug":"unable-to-update-instance-type-to-adapter-limits-f","errorCode":null,"errorMessage":"unable to update instance type to adapter limits from AlibabaCloud API: %w","messagePattern":"unable to update instance type to adapter limits from AlibabaCloud API: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"operator/pkg/ipam/allocator/alibabacloud/alibabacloud.go","lineNumber":84,"sourceCode":"\t\treturn err\n\t}\n\t// Send API requests to \"vpc\" network endpoints instead of the default \"public\" network\n\t// endpoints, so the ECS instance hosting cilium-operator doesn't require public network access\n\t// to reach alibabacloud API.\n\t// vpc endpoints are spliced to the format: <product>-<network>.<region_id>.aliyuncs.com\n\t// e.g. ecs-vpc.cn-shanghai.aliyuncs.com\n\t// ref https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/docs/11-Endpoint-EN.md\n\tvpcClient.Network = \"vpc\"\n\tecsClient.Network = \"vpc\"\n\n\tvpcClient.GetConfig().WithScheme(\"HTTPS\")\n\tecsClient.GetConfig().WithScheme(\"HTTPS\")\n\n\ta.client = api.NewClient(a.rootLogger, vpcClient, ecsClient, a.AlibabaMetrics, a.LimitIPAMAPIQPS,\n\t\ta.LimitIPAMAPIBurst, operatorOption.Config.IPAMInstanceTags)\n\n\tif err := limits.UpdateFromAPI(ctx, a.client); err != nil {\n\t\treturn fmt.Errorf(\"unable to update instance type to adapter limits from AlibabaCloud API: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// Start kicks off ENI allocation, the initial connection to AlibabaCloud\n// APIs is done in a blocking manner. Provided this is successful, a controller is\n// started to manage allocation based on CiliumNode custom resources\nfunc (a *AllocatorAlibabaCloud) Start(ctx context.Context, getterUpdater allocator.CiliumNodeGetterUpdater, iMetrics nodemanager.MetricsAPI) (allocator.NodeEventHandler, error) {\n\ta.logger.Info(\"Starting AlibabaCloud ENI allocator...\")\n\n\tinstances := ipam.NewInstancesManager(a.rootLogger, a.client)\n\tnodeManager, err := nodemanager.NewNodeManager(a.logger, instances, getterUpdater, iMetrics,\n\t\ta.ParallelAllocWorkers, a.AlibabaCloudReleaseExcessIPs, 0, false)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to initialize AlibabaCloud node manager: %w\", err)\n\t}\n","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/operator/pkg/ipam/allocator/alibabacloud/alibabacloud.go#L66-L102","documentation":"During Init, the AlibabaCloud allocator calls limits.UpdateFromAPI to populate the instance-type-to-adapter-limits table (how many IPs/ENIs each ECS instance type supports) via the AlibabaCloud SDK. Failure of this API sync aborts startup with this wrapped error.","triggerScenarios":"AllocatorAlibabaCloud.Init -> limits.UpdateFromAPI(ctx, a.client); the underlying AlibabaCloud API call fails: invalid credentials (AccessKey/Secret), no RAM permissions for ecs:DescribeInstanceTypes, network egress blocked, wrong region ID from metadata, or API rate limiting.","commonSituations":"Missing or expired AccessKeySecret in the operator secret; RAM policy not granting ECS read APIs; cluster in a region where metadata service returns a different region than intended; private clusters without egress to ecs.<region>.aliyuncs.com endpoints.","solutions":["Check the wrapped cause in operator logs (auth vs permission vs network)","Verify AlibabaCloud credentials secret and that the AccessKey is active","Grant RAM policy ecs:DescribeInstanceTypes (and VPC read APIs) to the credentials' RAM user/role","Confirm egress connectivity to the ECS API endpoint for your region","Verify metadata service returns the correct region ID (RegionID dependency of Init)"],"exampleFix":"// before: RAM policy lacking ECS read access\n// after: attach policy to the RAM user used by cilium-operator\n{\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Action\": [\"ecs:DescribeInstanceTypes\", \"ecs:DescribeNetworkInterfaces\"],\n    \"Resource\": \"*\"\n  }],\n  \"Version\": \"1\"\n}","handlingStrategy":"validation","validationCode":"// preflight before operator start\ncreds := os.Getenv(\"ALIBABA_CLOUD_ACCESS_KEY_ID\")\nsecret := os.Getenv(\"ALIBABA_CLOUD_ACCESS_KEY_SECRET\")\nif creds == \"\" || secret == \"\" {\n    return errors.New(\"AlibabaCloud credentials not configured\")\n}\n// verify RAM permission with a lightweight call\nclient, _ := ecs.NewClientWithAccessKey(regionID, creds, secret)\nif _, err := client.DescribeInstanceTypes(request); err != nil {\n    return fmt.Errorf(\"RAM lacks ecs:DescribeInstanceTypes: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := allocator.Init(ctx, logger); err != nil {\n    var sdkErr *sdkerrors.ServerError\n    if errors.As(err, &sdkErr) && sdkErr.RequestId() != \"\" {\n        log.Error(err, \"AlibabaCloud API rejected limits sync\", \"requestId\", sdkErr.RequestId())\n        return fmt.Errorf(\"check credentials/RAM policy: %w\", err)\n    }\n    return err\n}","preventionTips":["Attach ecs:DescribeInstanceTypes to the operator's RAM user","Rotate AccessKeys before expiry; use RAM roles over static keys","Allow egress to ecs.<region>.aliyuncs.com","Verify metadata service region ID matches expected region"],"tags":["alibabacloud","ipam","api","configuration"],"backgroundTag":"cloud-api-auth-failure","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}