kubernetes/kops · error

error describing network interfaces: %w

Error message

error describing network interfaces: %w

What it means

Returned when EC2 DescribeNetworkInterfaces fails while searching for network interfaces belonging to a network load balancer (interface-type network_load_balancer, description prefix 'ELB net/<lbName>/'). kOps uses this to find NLB ENIs for target group / instance bookkeeping.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1567

func (c *awsCloudImplementation) FindELBV2NetworkInterfacesByName(vpcID string, loadBalancerName string) ([]ec2types.NetworkInterface, error) {
	return findELBV2NetworkInterfaces(c, vpcID, loadBalancerName)
}

func findELBV2NetworkInterfaces(c AWSCloud, vpcID, lbName string) ([]ec2types.NetworkInterface, error) {
	klog.V(2).Infof("Listing all NLB network interfaces")
	ctx := context.TODO()

	request := &ec2.DescribeNetworkInterfacesInput{
		Filters: []ec2types.Filter{
			NewEC2Filter("vpc-id", vpcID),
			NewEC2Filter("interface-type", "network_load_balancer"),
		},
	}

	response, err := c.EC2().DescribeNetworkInterfaces(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error describing network interfaces: %w", err)
	}

	var found []ec2types.NetworkInterface
	for _, ni := range response.NetworkInterfaces {
		if strings.HasPrefix(aws.ToString(ni.Description), "ELB net/"+lbName+"/") {
			found = append(found, ni)
		}
	}

	return found, nil
}

func (c *awsCloudImplementation) DescribeELBV2Tags(loadBalancerArns []string) (map[string][]elbv2types.Tag, error) {
	return describeELBV2Tags(c, loadBalancerArns)
}

func describeELBV2Tags(c AWSCloud, loadBalancerArns []string) (map[string][]elbv2types.Tag, error) {
	// TODO: Filter by cluster?

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:DescribeNetworkInterfaces to the calling IAM principal.
2. Retry — describe calls are frequently throttled; check for Throttling in the wrapped error.
3. Verify region consistency between the NLB and the AWSCloud client.
4. Confirm the LB name used to build the filter is correct.

// Confirm the NLB exists before scanning its ENIs
_, err := elbv2Client.DescribeLoadBalancers(ctx, &elbv2.DescribeLoadBalancersInput{Names: []string{lbName}})
if err != nil { /* abort ENI lookup */ }

nis, err := c.describeNLBNetworkInterfaces(ctx, lbName)
if err != nil {
    var throttle smithy.APIError
    if errors.As(err, &throttle) && strings.Contains(throttle.ErrorCode(), "Throttling") {
        time.Sleep(backoff)
        nis, err = c.describeNLBNetworkInterfaces(ctx, lbName)
    }
    if err != nil { return nil, err }
}

When it happens

Trigger: DescribeNetworkInterfaces failing due to throttling, missing ec2:DescribeNetworkInterfaces permission, invalid filter combination, or an unavailable/incorrect region/endpoint.

Common situations: Large accounts hitting EC2 describe rate limits; IAM policy lacking ENI describe; NLB created in a different region than the cloud client; transient AWS outages.

Related errors

• error describing InternetGateway %q: %v
• error describing SecurityGroup %q: %v
• error listing VPCs: %v
• DIGITALOCEAN_ACCESS_TOKEN is required
• timed out waiting for volume to detach

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5fbe0143d57f3d98. Report an issue: GitHub.