ERROR REFERENCE
The EKS VPC CNI could not set up pod networking
Kubernetes could not create a pod sandbox through the Amazon VPC CNI.
This wrapper identifies the failing layer, not the root cause. Find the
matching aws-node or ipamd error before changing
the workload or node group.
WHAT IT MEANS
The kubelet wrapper is only the first signal
Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "pod-sandbox": plugin type="aws-cni" name="aws-cni" failed (add): add cmd: failed to assign an IP address to container
The Amazon VPC CNI allocates VPC IP addresses to Pods and creates or
uses elastic network interfaces on the node. The nested aws-node
log usually distinguishes subnet or prefix exhaustion, ENI or instance
limits, CNI permissions, subnet selection, and add-on health.
NEXT CHECK
Follow the nested CNI error
-
Capture the context. Record the Pod, node,
Availability Zone, and timestamp, then inspect the matching
aws-nodeDaemonSet oripamdlog around that event. -
Check IP and ENI capacity. When the nested message
names unavailable IPs or prefixes, inspect the node subnet with
aws ec2 describe-subnets --subnet-ids <subnet-id> --region <region>and compare the instance's ENI/IP limits and CNI mode. -
Separate permission and add-on failures. For
UnauthorizedOperationorAccessDenied, verify the VPC CNI or node role's least-privilege EC2 actions. Ifaws-nodeis unhealthy, check the DaemonSet, add-on version, and node readiness first. -
Retry after the nested cause is fixed. If a complete
CreateNetworkInterfaceresponse is present, follow that more specific error instead of this wrapper handoff.
AUTOMATE THE TRIAGE
Keep the check in your normal workflow
SAM Doctor recognizes the AWS VPC CNI pod-sandbox wrapper with low
confidence and points at the nested aws-node evidence.
Runs locally; no AWS or Kubernetes access, no log upload.
python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdownRELATED
Related errors
- EC2 CreateNetworkInterface failed - follow this more specific guide when the nested EC2 response is present.
- Access denied - inspect the named EC2 action only when the nested error actually reports a denial.
- A resource did not stabilize - a separate CloudFormation lifecycle handoff, not a CNI root cause.
OFFICIAL REFERENCE
Amazon VPC CNI for EKS
Assign IPs to Pods with the Amazon VPC CNI - the add-on creates ENIs and assigns VPC IP addresses to Pods.
Assign more IP addresses with prefixes - review prefix delegation when node IP capacity is the limiting signal.