Kubernetes "Failed to create pod sandbox" - Fix CNI Errors in CI

By Daniel Zoghalchali·Latchkey

Before any container runs, the runtime creates a "pause"/sandbox container and asks the CNI plugin to wire up networking. This error means that step failed - usually the CNI could not allocate an IP, the plugin is misconfigured, or IP address space is exhausted.

What this error means

A pod is stuck in ContainerCreating and kubectl describe pod shows Warning FailedCreatePodSandBox ... failed to setup network for sandbox ... <CNI error>. No container starts because the sandbox never comes up.

kubectl describe pod

Warning  FailedCreatePodSandBox  9s  kubelet  Failed to create pod sandbox:
rpc error: code = Unknown desc = failed to setup network for sandbox "...":
plugin type="aws-cni" failed (add): add cmd: failed to assign an IP address

Diagnose it: read events, not just status

A deployment that never becomes ready has the reason in its events and in the pod state, not in the deployment status. Read both before changing the manifest.

Terminal

kubectl rollout status deploy/<name> --timeout=120s
kubectl describe deploy/<name> | sed -n "/Events/,$p"
kubectl get pods -l app=<name> -o wide
kubectl describe pod <pod> | sed -n "/Events/,$p"
kubectl logs <pod> --previous --tail=50   # the crash before the restart

Common causes

No IPs available

The node/subnet ran out of assignable pod IPs (common with the AWS VPC CNI when ENIs/IPs are exhausted), so the CNI cannot give the sandbox an address.

CNI plugin unhealthy or misconfigured

The CNI DaemonSet is crashing, missing config, or version-mismatched, so sandbox network setup fails on that node.

How to fix it

Read the CNI error and check the plugin

Terminal

kubectl describe pod <pod> | grep -A2 -i sandbox
kubectl -n kube-system get pods -o wide | grep -iE 'cni|calico|cilium|flannel'

Fix by the cause

"failed to assign an IP" → free IPs or use a larger subnet / prefix delegation (AWS VPC CNI).
Crashing CNI pods → check their logs and restore the DaemonSet to healthy.
After a fix, the pod usually transitions out of ContainerCreating on the next sandbox attempt.

How to prevent it

Size pod subnets/IP pools for peak pod density; enable prefix delegation where supported.
Monitor CNI DaemonSet health and keep it version-matched to the cluster.
Cordon nodes with exhausted IPs so new pods schedule where addresses exist.

Frequently asked questions

What causes Kubernetes "Failed to create pod sandbox"?

There are 2 common causes: no ips available and cni plugin unhealthy or misconfigured. The node/subnet ran out of assignable pod IPs (common with the AWS VPC CNI when ENIs/IPs are exhausted), so the CNI cannot give the sandbox an address.

How do I fix Kubernetes "Failed to create pod sandbox"?

There are 2 fixes depending on which cause you have: read the cni error and check the plugin and fix by the cause. Work through them in order, since the first is the most common.

What does Kubernetes "Failed to create pod sandbox" actually mean?

A pod is stuck in ContainerCreating and kubectl describe pod shows Warning FailedCreatePodSandBox ...

How do I stop Kubernetes "Failed to create pod sandbox" happening again?

Size pod subnets/IP pools for peak pod density; enable prefix delegation where supported. The prevention section lists 3 changes that keep it from recurring.