Skip to content

✨ IPv6 support for self-managed clusters #5603

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 23 commits into
base: main
Choose a base branch
from
+33,480 −5,671
Open

✨ IPv6 support for self-managed clusters #5603

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
7949ccb
validations: allow IPv6 configurations for unmanaged clusters
tthvo Jul 22, 2025
c1bafb0
ec2: enable primary IPv6 on ENI for EC2 instances
tthvo Jul 22, 2025
842f85a
ec2: support option HTTPProtocolIPv6 for EC2 IMDS
tthvo Jul 22, 2025
60308b2
routing: ensure routes to eigw are up to date
tthvo Jul 22, 2025
7826e7e
subnets: configure default subnets to use NAT64/DNS64
tthvo Jul 23, 2025
987bc9c
securitygroup: ensure icmpv6 is supported
tthvo Jul 23, 2025
7bbae60
securitygroup: allow setting allowed IPv6 CIDR for node NodePort serv…
tthvo Jul 28, 2025
cd6c178
securitygroup: allow configuring IPv6 source CIDRs for bastion SSH
tthvo Jul 28, 2025
1ebffda
crd: add IPv6 of bastion host to cluster status
tthvo Jul 30, 2025
2c7e1e4
template: manifest templates for IPv6-enabled cluster
tthvo Jul 29, 2025
da96854
cni: customized calico manifests for single-stack IPv6
tthvo Jul 29, 2025
cd7c9b2
docs: add documentations for enabling IPv6 in non-eks clusters
tthvo Jul 29, 2025
def75f2
validations: validate vpc and subnet CIDR
tthvo Aug 5, 2025
9851222
docs: update doc for enabling ipv6
tthvo Aug 6, 2025
ea41d67
cni: document the requirement for calico ipv6 support
tthvo Aug 8, 2025
bfbbb84
subnets: wait till IPv6 CIDR is associated with subnets
tthvo Sep 19, 2025
4d38ed3
sg: allow both ipv4 and ipv6 cidrs to API LB if vpc ipv6 block is def…
tthvo Sep 29, 2025
e5e3ad3
crd: clarify isIpv6 field on subnet spec
tthvo Jul 29, 2025
04d4286
api: add spec field to configure target group ipType
tthvo Oct 2, 2025
b8ca23a
subnets: auto-assign IPv6 CIDR blocks to subnets when not specified
tthvo Oct 6, 2025
3292f75
vpc: ipam pool under vpc.ipv6 should be used for VPC IPv6 CIDR
tthvo Oct 9, 2025
78cb9d4
subnets: only enable DNS64 for IPv6-only subnets
tthvo Oct 10, 2025
061134a
docs: add dualstack cluster support documentation
tthvo Oct 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions api/v1beta2/awsmachinetemplate_webhook_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,7 @@ func TestAWSMachineTemplateValidateUpdate(t *testing.T) {
InstanceType: "test",
InstanceMetadataOptions: &InstanceMetadataOptions{
HTTPEndpoint: InstanceMetadataEndpointStateEnabled,
HTTPProtocolIPv6: InstanceMetadataEndpointStateDisabled,
HTTPPutResponseHopLimit: 1,
HTTPTokens: HTTPTokensStateOptional,
InstanceMetadataTags: InstanceMetadataEndpointStateDisabled,
Expand Down
12 changes: 12 additions & 0 deletions api/v1beta2/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,15 @@ type InstanceMetadataOptions struct {
// +kubebuilder:default=enabled
HTTPEndpoint InstanceMetadataState `json:"httpEndpoint,omitempty"`

// Enables or disables the IPv6 endpoint for the instance metadata service.
// This applies only if you enabled the HTTP metadata endpoint.
//
// Default: disabled
//
// +kubebuilder:validation:Enum:=enabled;disabled
// +kubebuilder:default=disabled
HTTPProtocolIPv6 InstanceMetadataState `json:"httpProtocolIpv6,omitempty"`
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: Should this be HTTPIPv6Endpoint or HTTPEndpointIPv6 to be consistent with HTTPEndpoint for IPv4?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahh, the name HTTPProtocolIPv6 is actually used to match the corresponding AWS metadata option field, for example:

$ aws ec2 modify-instance-metadata-options --instance-id i-1234567890 \
    --http-endpoint=disabled --http-protocol-ipv6=enabled
{
    "InstanceId": "i-1234567890",
    "InstanceMetadataOptions": {
        "State": "pending",
        "HttpTokens": "required",
        "HttpPutResponseHopLimit": 2,
        "HttpEndpoint": "disabled",
        "HttpProtocolIpv6": "enabled",
        "InstanceMetadataTags": "disabled"
    }
}

https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-instance-metadata-options.html

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that's the convention here in capa 👀 so we should keep it this way?


// The desired HTTP PUT response hop limit for instance metadata requests. The
// larger the number, the further instance metadata requests can travel.
//
Expand Down Expand Up @@ -411,6 +420,9 @@ func (obj *InstanceMetadataOptions) SetDefaults() {
if obj.HTTPEndpoint == "" {
obj.HTTPEndpoint = InstanceMetadataEndpointStateEnabled
}
if obj.HTTPProtocolIPv6 == "" {
obj.HTTPProtocolIPv6 = InstanceMetadataEndpointStateDisabled
}
if obj.HTTPPutResponseHopLimit == 0 {
obj.HTTPPutResponseHopLimit = 1
}
Expand Down
22 changes: 22 additions & 0 deletions config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1307,6 +1307,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down Expand Up @@ -3582,6 +3593,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down
11 changes: 11 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2284,6 +2284,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down
11 changes: 11 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachinepools.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -707,6 +707,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down
11 changes: 11 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachines.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -902,6 +902,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down
11 changes: 11 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachinetemplates.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -821,6 +821,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down
11 changes: 11 additions & 0 deletions config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -716,6 +716,17 @@ spec:
- enabled
- disabled
type: string
httpProtocolIpv6:
default: disabled
description: |-
Enables or disables the IPv6 endpoint for the instance metadata service.
This applies only if you enabled the HTTP metadata endpoint.

Default: disabled
enum:
- enabled
- disabled
type: string
httpPutResponseHopLimit:
default: 1
description: |-
Expand Down
1 change: 1 addition & 0 deletions controllers/awsmachine_controller_unit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2733,6 +2733,7 @@ func TestAWSMachineReconcilerReconcileDefaultsToLoadBalancerTypeClassic(t *testi
},
MetadataOptions: &ec2types.InstanceMetadataOptionsResponse{
HttpEndpoint: ec2types.InstanceMetadataEndpointState(string(infrav1.InstanceMetadataEndpointStateEnabled)),
HttpProtocolIpv6: ec2types.InstanceMetadataProtocolState(string(infrav1.InstanceMetadataEndpointStateDisabled)),
HttpPutResponseHopLimit: aws.Int32(1),
HttpTokens: ec2types.HttpTokensState(string(infrav1.HTTPTokensStateOptional)),
InstanceMetadataTags: ec2types.InstanceMetadataTagsState(string(infrav1.InstanceMetadataEndpointStateDisabled)),
Expand Down
5 changes: 5 additions & 0 deletions pkg/cloud/services/ec2/instances.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -969,6 +969,7 @@ func (s *Service) SDKToInstance(v types.Instance) (*infrav1.Instance, error) {
metadataOptions.HTTPEndpoint = infrav1.InstanceMetadataState(string(v.MetadataOptions.HttpEndpoint))
metadataOptions.HTTPTokens = infrav1.HTTPTokensState(string(v.MetadataOptions.HttpTokens))
metadataOptions.InstanceMetadataTags = infrav1.InstanceMetadataState(string(v.MetadataOptions.InstanceMetadataTags))
metadataOptions.HTTPProtocolIPv6 = infrav1.InstanceMetadataState(v.MetadataOptions.HttpProtocolIpv6)
if v.MetadataOptions.HttpPutResponseHopLimit != nil {
metadataOptions.HTTPPutResponseHopLimit = int64(*v.MetadataOptions.HttpPutResponseHopLimit)
}
Expand Down Expand Up @@ -1124,6 +1125,7 @@ func (s *Service) ModifyInstanceMetadataOptions(instanceID string, options *infr
HttpPutResponseHopLimit: utils.ToInt32Pointer(&options.HTTPPutResponseHopLimit),
HttpTokens: types.HttpTokensState(string(options.HTTPTokens)),
InstanceMetadataTags: types.InstanceMetadataTagsState(string(options.InstanceMetadataTags)),
HttpProtocolIpv6: types.InstanceMetadataProtocolState(string(options.HTTPProtocolIPv6)),
InstanceId: aws.String(instanceID),
}

Expand Down Expand Up @@ -1277,6 +1279,9 @@ func getInstanceMetadataOptionsRequest(metadataOptions *infrav1.InstanceMetadata
if metadataOptions.HTTPEndpoint != "" {
request.HttpEndpoint = types.InstanceMetadataEndpointState(string(metadataOptions.HTTPEndpoint))
}
if metadataOptions.HTTPProtocolIPv6 != "" {
request.HttpProtocolIpv6 = types.InstanceMetadataProtocolState(string(metadataOptions.HTTPProtocolIPv6))
}
if metadataOptions.HTTPPutResponseHopLimit != 0 {
request.HttpPutResponseHopLimit = utils.ToInt32Pointer(&metadataOptions.HTTPPutResponseHopLimit)
}
Expand Down
4 changes: 4 additions & 0 deletions pkg/cloud/services/ec2/launchtemplate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -928,11 +928,15 @@ func (s *Service) SDKToLaunchTemplate(d types.LaunchTemplateVersion) (*expinfrav
HTTPPutResponseHopLimit: utils.ToInt64Value(v.MetadataOptions.HttpPutResponseHopLimit),
HTTPTokens: infrav1.HTTPTokensState(string(v.MetadataOptions.HttpTokens)),
HTTPEndpoint: infrav1.InstanceMetadataEndpointStateEnabled,
HTTPProtocolIPv6: infrav1.InstanceMetadataEndpointStateDisabled,
InstanceMetadataTags: infrav1.InstanceMetadataEndpointStateDisabled,
}
if v.MetadataOptions.HttpEndpoint == types.LaunchTemplateInstanceMetadataEndpointStateDisabled {
i.InstanceMetadataOptions.HTTPEndpoint = infrav1.InstanceMetadataEndpointStateDisabled
}
if v.MetadataOptions.HttpProtocolIpv6 == types.LaunchTemplateInstanceMetadataProtocolIpv6Enabled {
i.InstanceMetadataOptions.HTTPProtocolIPv6 = infrav1.InstanceMetadataEndpointStateEnabled
}
if v.MetadataOptions.InstanceMetadataTags == types.LaunchTemplateInstanceMetadataTagsStateEnabled {
i.InstanceMetadataOptions.InstanceMetadataTags = infrav1.InstanceMetadataEndpointStateEnabled
}
Expand Down