aws/amazon-vpc-cni-k8s

Issue with count of unmanaged ENIs

Closed

#3,544 opened on Dec 11, 2025

View on GitHubContributor guide
 (7 comments) (2 reactions) (1 assignee)Go (823 forks)auto 404
buggood first issue

Repository metrics

Stars
 (2,450 stars)
PR merge metrics
 (Avg merge 10d 13h) (29 merged PRs in 30d)

Description

What happened:

  Warning  FailedCreatePodSandBox  2m6s (x62 over 15m)  kubelet            (combined from similar events): Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "f44b32fc51168ef2352e384a3d853da635c5fa0b469121f1aede7a924004b870": plugin type="aws-cni" name="aws-cni" failed (add): add cmd: failed to assign an IP address to container

This code notices unmanaged ENIs and increments the count, but never decrements it: https://github.com/aws/amazon-vpc-cni-k8s/blob/a2c18c1cb0ff32c36157b6dae4aacc5d5f243b3d/pkg/ipamd/ipamd.go#L2104

In our workflow we attach and detach unmanaged ENIs from our nodes for during some operations. Doing so can result in the aws-cni eventually failing to assign IPs to containers.

Attach logs

What you expected to happen: Detaching an unmanaged ENI should decrement the count.

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

  • Kubernetes version (use kubectl version):
  • CNI Version
  • OS (e.g: cat /etc/os-release):
  • Kernel (e.g. uname -a):

Contributor guide

Research direction
Examine the unmanaged ENI count logic in pkg/ipamd/ipamd.go. Find where the count is incremented (around line 2104) and trace the detach code path. Add a decrement when an unmanaged ENI is detached, with proper synchronization, and write a unit test for this behavior.
Tech stack
go
Domain
backendnetworking
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoKubernetes
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75