kubernetes/kops · error

error listing ENIs: %v

Error message

error listing ENIs: %v

What it means

kOps wraps the AWS SDK error from ec2 DescribeNetworkInterfaces pagination while listing ENIs in the cluster VPC for cleanup. Any page failure aborts the entire ENI listing, so dependent resource cleanup cannot proceed. The cause is in the wrapped err.

Source

Thrown at pkg/resources/aws/eni.go:89

		return nil, nil
	}

	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	vpcFilter := awsup.NewEC2Filter("vpc-id", vpcID)
	statusFilter := awsup.NewEC2Filter("status", string(ec2types.NetworkInterfaceStatusAvailable))
	enis := make(map[string]ec2types.NetworkInterface)
	klog.V(2).Info("Listing ENIs")
	for _, filters := range buildEC2FiltersForCluster(clusterName) {
		request := &ec2.DescribeNetworkInterfacesInput{
			Filters: append(filters, vpcFilter, statusFilter),
		}
		paginator := ec2.NewDescribeNetworkInterfacesPaginator(c.EC2(), request)
		for paginator.HasMorePages() {
			dnio, err := paginator.NextPage(ctx)
			if err != nil {
				return nil, fmt.Errorf("error listing ENIs: %v", err)
			}
			for _, eni := range dnio.NetworkInterfaces {
				enis[aws.ToString(eni.NetworkInterfaceId)] = eni
			}
		}
	}

	return enis, nil
}

func ListENIs(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	enis, err := DescribeENIs(cloud, vpcID, clusterName)
	if err != nil {
		return nil, err
	}

	var resourceTrackers []*resources.Resource
	for _, v := range enis {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws ec2 describe-network-interfaces --filters name=vpc-id,values=<vpc>` to reproduce
2. If RequestLimitExceeded, reduce parallel API usage or increase retries/backoff
3. Add ec2:DescribeNetworkInterfaces to the caller's policy if AccessDenied
4. Verify the VPC id filter inputs are correct

// preflight: verify describe permission and VPC id format
if !strings.HasPrefix(vpcID, "vpc-") { return fmt.Errorf("invalid vpc id %q", vpcID) }
_, err := ec2Client.DescribeNetworkInterfaces(ctx, &ec2.DescribeNetworkInterfacesInput{
  Filters: []types.Filter{{Name: aws.String("vpc-id"), Values: []string{vpcID}}}, MaxResults: aws.Int32(5),
})

func isEC2Throttled(err error) bool {
  code := awsup.AWSErrorCode(err)
  return code == "RequestLimitExceeded" || code == "ThrottlingException" || code == "TooManyRequests"
}

enis, err := ListENIs(cloud, vpcID)
if err != nil {
  if isEC2Throttled(err) { /* exponential backoff, then retry */ }
  return fmt.Errorf("cannot enumerate ENIs for cleanup: %w", err)
}

When it happens

Trigger: DescribeNetworkInterfaces fails during pagination: throttling (RequestLimitExceeded), missing ec2:DescribeNetworkInterfaces permission, invalid filter values (e.g. bad vpc-id), or network errors on large accounts with many pages.

Common situations: Large AWS accounts with thousands of ENIs hitting EC2 rate limits; restricted read-only IAM policies used for `kops delete cluster --dry-run`; specifying a wrong VPC id filter upstream.

Related errors

• unexpected number of network interfaces for instance %q: %v
• error describing instances: %v
• error listing AutoScaling LaunchTemplates: %v
• NextToken set from DescribeNatGateways, but pagination not i
• error deleting ENI %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/323558cef4e1d425. Report an issue: GitHub.