kubernetes/kops · error

finding primary network interface: %w

Error message

finding primary network interface: %w

What it means

On AWS, markSecondaryENIsUnmanaged writes a systemd-networkd config that leaves the primary ENI managed; it first resolves the primary interface name via primaryInterfaceName, which queries EC2 IMDS for the primary MAC and matches it against /sys/class/net physical interfaces. Any failure there (IMDS unavailable, no matching interface, multiple matches) is wrapped in this error.

Source

Thrown at nodeup/pkg/model/networking/eni_networking.go:163

// boot time. The file uses the udev property "INTERFACE" for this, because a negated "Name="
// test also agrees with the alternative names of an interface.
//
// The file name starts with 75. This puts the file after the per-interface files
// ("10-netplan-*" on Debian, "70-*" on AL2023) and before the AL2023 catch-all file
// "80-ec2.network". systemd-networkd uses the first file that agrees with an interface. Thus,
// if the primary network interface has a per-interface file, systemd-networkd uses that file.
func markSecondaryENIsUnmanaged(c *fi.NodeupModelBuilderContext, dist distributions.Distribution) error {
	if !(dist.IsAmazonLinux() ||
		(dist.IsDebian() && dist.Version() >= 12)) {
		return nil
	}

	primary, err := primaryInterfaceName(c.Context())
	if err != nil {
		// Do not make the file if the primary network interface is not known. A match that
		// includes the primary network interface causes systemd-networkd to ignore it, and
		// then systemd-resolved has no DNS servers for it.
		return fmt.Errorf("finding primary network interface: %w", err)
	}

	contents := fmt.Sprintf(`
[Match]
Driver=ena
Property=!INTERFACE=%s

[Link]
Unmanaged=yes
`, primary)

	c.AddTask(&nodetasks.File{
		Path:            "/etc/systemd/network/75-eni-secondary.network",
		Contents:        fi.NewStringResource(contents),
		Type:            nodetasks.FileType_File,
		AfterPackages:   true,
		OnChangeExecute: [][]string{{"systemctl", "restart", "systemd-networkd"}},
	})

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify IMDS is reachable: curl -H 'X-aws-ec2-metadata-token: ...' http://169.254.169.254/latest/meta-data/mac
2. Raise the IMDSv2 hop limit if nested/containers are involved: aws ec2 modify-instance-metadata-options --http-put-response-hop-limit 2
3. Ensure exactly one physical interface in /sys/class/net has the primary MAC (remove bonds/extra virtual devices or fix their MACs)
4. Confirm the instance has an ENA primary interface and the nodeup context is a real EC2 instance

Example fix

// before
aws ec2 modify-instance-metadata-options --instance-id i-123 --http-tokens required --http-put-response-hop-limit 1
// after
aws ec2 modify-instance-metadata-options --instance-id i-123 --http-put-response-hop-limit 2

mac, err := imdsFetch("mac") // curl IMDS with IMDSv2 token
if err != nil {
    return fmt.Errorf("IMDS unreachable; markSecondaryENIsUnmanaged would fail: %w", err)
}
matches := 0
entries, _ := os.ReadDir("/sys/class/net")
for _, e := range entries {
    if addr, err := os.ReadFile("/sys/class/net/" + e.Name() + "/address"); err == nil &&
        strings.EqualFold(strings.TrimSpace(string(addr)), mac) {
        matches++
    }
}
if matches != 1 {
    return fmt.Errorf("expected exactly 1 interface with MAC %s, found %d", mac, matches)
}

primary, err := primaryInterfaceName(c.Context())
if err != nil {
    klog.Warningf("skipping secondary-ENI unmanaged file: %v", err) // caller already chose not to write the file
    return nil
}

When it happens

Trigger: primaryInterfaceName(c.Context()) fails during nodeup Build on an AWS instance: IMDS 'mac' metadata request fails (IMDSv2 hop limit, IMDS disabled, network timeout), no physical interface in /sys/class/net matches the primary MAC, or more than one matches.

Common situations: Instances with IMDS access blocked (metadata-options http-tokens/put-response-hop-limit misconfig); bond/team setups where the primary MAC belongs to multiple entries; unusual ENA interface naming; running nodeup outside a real EC2 instance.

Related errors

• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• loading AWS config: %w
• multiple physical network interfaces found with MAC address
• error reading instance-id from AWS metadata: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c733d93176382d13. Report an issue: GitHub.