kubernetes/kops · error

multiple physical network interfaces found with MAC address

Error message

multiple physical network interfaces found with MAC address %q: %v

What it means

nodeup's findPhysicalInterfaceByMAC scans the host's network interfaces looking for the one whose hardware MAC matches the MAC of the primary (eth0) ENI, in order to derive the primary interface name. When more than one non-virtual interface reports the same MAC address, the result is ambiguous, so it refuses to guess and returns this error. This typically indicates duplicated or leaked MACs across devices (e.g. veth/bond artifacts misclassified as physical) on an AWS instance.

Source

Thrown at nodeup/pkg/model/networking/eni_networking.go:240

		if _, err := os.Stat(filepath.Join(sysClassNet, name, "device")); err != nil {
			continue
		}
		address, err := os.ReadFile(filepath.Join(sysClassNet, name, "address"))
		if err != nil {
			continue
		}
		if strings.EqualFold(strings.TrimSpace(string(address)), mac) {
			matches = append(matches, name)
		}
	}

	switch len(matches) {
	case 1:
		return matches[0], nil
	case 0:
		return "", fmt.Errorf("no physical network interface found with MAC address %q", mac)
	default:
		return "", fmt.Errorf("multiple physical network interfaces found with MAC address %q: %v", mac, matches)
	}
}

// narrowCloudIfupdownHelperRule rewrites Debian 11's
// /etc/udev/rules.d/75-cloud-ifupdown.rules to exclude AWS VPC CNI veths.
// The package-shipped rule matches ENV{INTERFACE}=="eth*|en*", which catches
// real ENIs (ens*) and CNI veths (eni*) alike. For each new netdev,
// /etc/network/cloud-ifupdown-helper generates a DHCP ifupdown stanza and
// starts ifup@$IFACE.service. On CNI veths DHCP times out, ifdown then takes
// the veth DOWN, and pod networking is broken.
//
// The rule and helper are written by cloud-init at first boot and are not
// owned by any dpkg package, so overwriting the file is safe.
//
// Debian 11 only.
func narrowCloudIfupdownHelperRule(c *fi.NodeupModelBuilderContext, dist distributions.Distribution) {
	if dist != distributions.DistributionDebian11 {
		return

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the node with `ip -o link` and find which duplicate devices share the MAC; remove or reconfigure the offending device (e.g. delete veth/macvlan links) and rerun nodeup.
2. Check that the instance uses a standard Amazon Linux/Ubuntu AMI without extra network device provisioning daemons that clone the ENI MAC.
3. Verify bonding/teaming configuration isn't duplicating the primary ENI MAC; if intentional, adjust the instance networking setup so only one physical link holds the MAC.
4. If a kernel/driver artifact is responsible, upgrade the AMI/kernel or blacklist the offending module, then reboot the instance.

Example fix

// before: ambiguous match returned as-is
case 1:
	return matches[0], nil
case 0:
	return "", fmt.Errorf("no physical network interface found with MAC address %q", mac)
// after (host-side remediation): delete duplicate device so only one match exists
$ ip link delete dup0  # or remove the bonding/macvlan slave duplicating the ENI MAC

// Before bootstrap, on the instance:
// ip -o link | awk -F': ' '{print $2, $(NF-2)}'  # list ifaces + MACs
// Ensure exactly one physical device carries the ENI MAC:
const primaryMAC = metadataENIMAC
matches := listNonVirtualInterfacesByMAC(primaryMAC)
if len(matches) != 1 {
	return fmt.Errorf("cannot determine primary interface: %d matches for MAC %s", len(matches), primaryMAC)
}

func isUnambiguousMACMatch(matches []net.Interface) bool {
	return len(matches) == 1
}

name, err := findPhysicalInterfaceByMAC(mac)
if err != nil {
	if strings.Contains(err.Error(), "multiple physical network interfaces") {
		// inspect `ip -o link`, remove duplicate device or fall back to eth0
		name = "eth0"
	}
	klog.Errorf("primary interface lookup failed: %v", err)
}

When it happens

Trigger: Called from primaryInterfaceName during nodeup bootstrap of an AWS instance: listing host interfaces by MAC yields len(matches) > 1 — i.e. two or more links (excluding virtual ones) expose the primary ENI's MAC address.

Common situations: Custom CNI/daemon-created interfaces or udev-managed links that carry the same MAC; MACvlan/ipvlan or bonding setups duplicating the ENI MAC; kernel modules (e.g. anaconda/xen artifacts on some AMIs) registering extra devices with the same hardware address; container network namespaces leaking devices into the host view.

Related errors

• finding primary network interface: %w
• unexpected number of network interfaces for instance %q: %v
• failed to load AWS config: %w
• failed to get local-ipv4 address from ec2 metadata: %w
• error loading AWS config: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/89e2416e5d3f729a. Report an issue: GitHub.