{"record":{"id":"89e2416e5d3f729a","repo":"kubernetes/kops","slug":"multiple-physical-network-interfaces-found-with-ma","errorCode":null,"errorMessage":"multiple physical network interfaces found with MAC address %q: %v","messagePattern":"multiple physical network interfaces found with MAC address %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/networking/eni_networking.go","lineNumber":240,"sourceCode":"\t\tif _, err := os.Stat(filepath.Join(sysClassNet, name, \"device\")); err != nil {\n\t\t\tcontinue\n\t\t}\n\t\taddress, err := os.ReadFile(filepath.Join(sysClassNet, name, \"address\"))\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif strings.EqualFold(strings.TrimSpace(string(address)), mac) {\n\t\t\tmatches = append(matches, name)\n\t\t}\n\t}\n\n\tswitch len(matches) {\n\tcase 1:\n\t\treturn matches[0], nil\n\tcase 0:\n\t\treturn \"\", fmt.Errorf(\"no physical network interface found with MAC address %q\", mac)\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"multiple physical network interfaces found with MAC address %q: %v\", mac, matches)\n\t}\n}\n\n// narrowCloudIfupdownHelperRule rewrites Debian 11's\n// /etc/udev/rules.d/75-cloud-ifupdown.rules to exclude AWS VPC CNI veths.\n// The package-shipped rule matches ENV{INTERFACE}==\"eth*|en*\", which catches\n// real ENIs (ens*) and CNI veths (eni*) alike. For each new netdev,\n// /etc/network/cloud-ifupdown-helper generates a DHCP ifupdown stanza and\n// starts ifup@$IFACE.service. On CNI veths DHCP times out, ifdown then takes\n// the veth DOWN, and pod networking is broken.\n//\n// The rule and helper are written by cloud-init at first boot and are not\n// owned by any dpkg package, so overwriting the file is safe.\n//\n// Debian 11 only.\nfunc narrowCloudIfupdownHelperRule(c *fi.NodeupModelBuilderContext, dist distributions.Distribution) {\n\tif dist != distributions.DistributionDebian11 {\n\t\treturn","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/networking/eni_networking.go#L222-L258","documentation":"nodeup's findPhysicalInterfaceByMAC scans the host's network interfaces looking for the one whose hardware MAC matches the MAC of the primary (eth0) ENI, in order to derive the primary interface name. When more than one non-virtual interface reports the same MAC address, the result is ambiguous, so it refuses to guess and returns this error. This typically indicates duplicated or leaked MACs across devices (e.g. veth/bond artifacts misclassified as physical) on an AWS instance.","triggerScenarios":"Called from primaryInterfaceName during nodeup bootstrap of an AWS instance: listing host interfaces by MAC yields len(matches) > 1 — i.e. two or more links (excluding virtual ones) expose the primary ENI's MAC address.","commonSituations":"Custom CNI/daemon-created interfaces or udev-managed links that carry the same MAC; MACvlan/ipvlan or bonding setups duplicating the ENI MAC; kernel modules (e.g. anaconda/xen artifacts on some AMIs) registering extra devices with the same hardware address; container network namespaces leaking devices into the host view.","solutions":["Inspect the node with `ip -o link` and find which duplicate devices share the MAC; remove or reconfigure the offending device (e.g. delete veth/macvlan links) and rerun nodeup.","Check that the instance uses a standard Amazon Linux/Ubuntu AMI without extra network device provisioning daemons that clone the ENI MAC.","Verify bonding/teaming configuration isn't duplicating the primary ENI MAC; if intentional, adjust the instance networking setup so only one physical link holds the MAC.","If a kernel/driver artifact is responsible, upgrade the AMI/kernel or blacklist the offending module, then reboot the instance."],"exampleFix":"// before: ambiguous match returned as-is\ncase 1:\n\treturn matches[0], nil\ncase 0:\n\treturn \"\", fmt.Errorf(\"no physical network interface found with MAC address %q\", mac)\n// after (host-side remediation): delete duplicate device so only one match exists\n$ ip link delete dup0  # or remove the bonding/macvlan slave duplicating the ENI MAC","handlingStrategy":"validation","validationCode":"// Before bootstrap, on the instance:\n// ip -o link | awk -F': ' '{print $2, $(NF-2)}'  # list ifaces + MACs\n// Ensure exactly one physical device carries the ENI MAC:\nconst primaryMAC = metadataENIMAC\nmatches := listNonVirtualInterfacesByMAC(primaryMAC)\nif len(matches) != 1 {\n\treturn fmt.Errorf(\"cannot determine primary interface: %d matches for MAC %s\", len(matches), primaryMAC)\n}","typeGuard":"func isUnambiguousMACMatch(matches []net.Interface) bool {\n\treturn len(matches) == 1\n}","tryCatchPattern":"name, err := findPhysicalInterfaceByMAC(mac)\nif err != nil {\n\tif strings.Contains(err.Error(), \"multiple physical network interfaces\") {\n\t\t// inspect `ip -o link`, remove duplicate device or fall back to eth0\n\t\tname = \"eth0\"\n\t}\n\tklog.Errorf(\"primary interface lookup failed: %v\", err)\n}","preventionTips":["Avoid bonding/macvlan/ipvlan devices that clone the primary ENI MAC on bootstrap nodes","Use standard Amazon Linux/Ubuntu AMIs without extra network-device provisioning daemons","Audit `ip -o link` output in golden node images to guarantee one physical device per MAC","Keep container/CNI veths excluded from physical-interface scans (udev rule narrowing already present)"],"tags":["networking","aws","eni","nodeup"],"backgroundTag":"duplicate-mac-address-interface","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}