cilium/cilium · error

unable to update instance type to adapter limits from Alibab

Error message

unable to update instance type to adapter limits from AlibabaCloud API: %w

What it means

During Init, the AlibabaCloud allocator calls limits.UpdateFromAPI to populate the instance-type-to-adapter-limits table (how many IPs/ENIs each ECS instance type supports) via the AlibabaCloud SDK. Failure of this API sync aborts startup with this wrapped error.

Source

Thrown at operator/pkg/ipam/allocator/alibabacloud/alibabacloud.go:84

		return err
	}
	// Send API requests to "vpc" network endpoints instead of the default "public" network
	// endpoints, so the ECS instance hosting cilium-operator doesn't require public network access
	// to reach alibabacloud API.
	// vpc endpoints are spliced to the format: <product>-<network>.<region_id>.aliyuncs.com
	// e.g. ecs-vpc.cn-shanghai.aliyuncs.com
	// ref https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/docs/11-Endpoint-EN.md
	vpcClient.Network = "vpc"
	ecsClient.Network = "vpc"

	vpcClient.GetConfig().WithScheme("HTTPS")
	ecsClient.GetConfig().WithScheme("HTTPS")

	a.client = api.NewClient(a.rootLogger, vpcClient, ecsClient, a.AlibabaMetrics, a.LimitIPAMAPIQPS,
		a.LimitIPAMAPIBurst, operatorOption.Config.IPAMInstanceTags)

	if err := limits.UpdateFromAPI(ctx, a.client); err != nil {
		return fmt.Errorf("unable to update instance type to adapter limits from AlibabaCloud API: %w", err)
	}

	return nil
}

// Start kicks off ENI allocation, the initial connection to AlibabaCloud
// APIs is done in a blocking manner. Provided this is successful, a controller is
// started to manage allocation based on CiliumNode custom resources
func (a *AllocatorAlibabaCloud) Start(ctx context.Context, getterUpdater allocator.CiliumNodeGetterUpdater, iMetrics nodemanager.MetricsAPI) (allocator.NodeEventHandler, error) {
	a.logger.Info("Starting AlibabaCloud ENI allocator...")

	instances := ipam.NewInstancesManager(a.rootLogger, a.client)
	nodeManager, err := nodemanager.NewNodeManager(a.logger, instances, getterUpdater, iMetrics,
		a.ParallelAllocWorkers, a.AlibabaCloudReleaseExcessIPs, 0, false)
	if err != nil {
		return nil, fmt.Errorf("unable to initialize AlibabaCloud node manager: %w", err)
	}

View on GitHub (pinned to ac7b90affa)

Solutions

1. Check the wrapped cause in operator logs (auth vs permission vs network)
2. Verify AlibabaCloud credentials secret and that the AccessKey is active
3. Grant RAM policy ecs:DescribeInstanceTypes (and VPC read APIs) to the credentials' RAM user/role
4. Confirm egress connectivity to the ECS API endpoint for your region
5. Verify metadata service returns the correct region ID (RegionID dependency of Init)

Example fix

// before: RAM policy lacking ECS read access
// after: attach policy to the RAM user used by cilium-operator
{
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ecs:DescribeInstanceTypes", "ecs:DescribeNetworkInterfaces"],
    "Resource": "*"
  }],
  "Version": "1"
}

// preflight before operator start
creds := os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_ID")
secret := os.Getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET")
if creds == "" || secret == "" {
    return errors.New("AlibabaCloud credentials not configured")
}
// verify RAM permission with a lightweight call
client, _ := ecs.NewClientWithAccessKey(regionID, creds, secret)
if _, err := client.DescribeInstanceTypes(request); err != nil {
    return fmt.Errorf("RAM lacks ecs:DescribeInstanceTypes: %w", err)
}

if err := allocator.Init(ctx, logger); err != nil {
    var sdkErr *sdkerrors.ServerError
    if errors.As(err, &sdkErr) && sdkErr.RequestId() != "" {
        log.Error(err, "AlibabaCloud API rejected limits sync", "requestId", sdkErr.RequestId())
        return fmt.Errorf("check credentials/RAM policy: %w", err)
    }
    return err
}

When it happens

Trigger: AllocatorAlibabaCloud.Init -> limits.UpdateFromAPI(ctx, a.client); the underlying AlibabaCloud API call fails: invalid credentials (AccessKey/Secret), no RAM permissions for ecs:DescribeInstanceTypes, network egress blocked, wrong region ID from metadata, or API rate limiting.

Common situations: Missing or expired AccessKeySecret in the operator secret; RAM policy not granting ECS read APIs; cluster in a region where metadata service returns a different region than intended; private clusters without egress to ecs.<region>.aliyuncs.com endpoints.

Related errors

• number of tags in instance-tags-filter exceeds the limit %d
• not ready
• no cilium agent pods found
• unable to detect minimum Cilium version
• unable to retrieve ENIs

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/41317b770fa384d8. Report an issue: GitHub.