SAM Doctor

ERROR REFERENCE

Pod sandbox network setup failed

FailedCreatePodSandBox with failed to setup network for sandbox identifies the CNI network stage, but not the plugin's root cause. Preserve the complete event and inspect the node-level plugin evidence before changing the workload or granting AWS permissions.

WHAT IT MEANS

The kubelet could not create the pod's network namespace

Warning  FailedCreatePodSandBox  kubelet  Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "<sandbox-id>": plugin type="<cni-plugin>" failed (add): <nested cause>

The nested cause is the useful evidence. It may name a CNI daemon, node kernel or veth problem, an IP or ENI limit, an API connectivity issue, or a policy agent. A bare sandbox wrapper does not establish an IAM failure.

NEXT CHECK

Find the plugin and its matching node log

  1. Capture the full event. Keep the pod, namespace, node, timestamp, plugin type, and nested error together.
  2. Inspect the plugin on that node: 
    kubectl get events --all-namespaces --field-selector reason=FailedCreatePodSandBox --sort-by=.lastTimestamp
kubectl -n kube-system get pods -o wide
    Read the plugin DaemonSet or host-network log at the same timestamp.
  3. Follow the nested cause. For EKS, inspect aws-node and ipamd; use the more specific VPC CNI, network-policy, EC2, or access-denied guide when its marker appears. Do not broaden IAM for this wrapper alone.

AUTOMATE THE TRIAGE

Keep the handoff in your normal workflow

SAM Doctor recognizes this bare sandbox-network wrapper with low confidence and preserves the plugin-specific next check. It runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED