SAM Doctor

ERROR REFERENCE

EKS network policy setup failed in the VPC CNI

failed to setup network policy points at the aws-network-policy-agent stage inside the aws-node DaemonSet. It is a node-level EKS add-on or policy-enforcement failure, not a reason to change the workload's IAM role first.

WHAT IT MEANS

The pod sandbox could not receive its network policy

Failed to setup default network policy for Pod Name <pod> and NameSpace <ns>: GRPC returned - Network policy agent returned - <nil>

The kubelet may surface this as FailedCreatePodSandBox and retry with a new sandbox. The useful cause is in the network-policy-agent and VPC CNI logs at the same timestamp, such as an eBPF, veth, kernel, or PolicyEndpoint error.

NEXT CHECK

Inspect the node agent before changing the workload

  1. Capture the pod, node, namespace, and timestamp. Keep both the kubelet event and the matching aws-node log.
  2. Read the network-policy-agent container: 
    kubectl -n kube-system logs daemonset/aws-node -c aws-network-policy-agent --since=15m
    Look for the nested eBPF, veth, kernel, or PolicyEndpoint error.
  3. Check the add-on prerequisites. Verify the VPC CNI version, enableNetworkPolicy setting, node OS/kernel, and the PolicyEndpoint resources. If a retry succeeds, preserve both events and investigate a transient agent race before changing policy rules or IAM.

AUTOMATE THE TRIAGE

Keep the handoff in your normal workflow

SAM Doctor recognizes this network-policy-agent marker with medium confidence and points at the node-level evidence. It runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED