Network policy shows both v4 and v6 CIDR even though Cluster/instance and everything is v4

Amazon network policy endpoint shows that there is V4 and V6 cidr even though the Cluster/Instance/Pod and everything is v4. This is a day 1 issue and needs to be fixed the code should be more like if you have v6 enabled then the policy should have v6, if it doesnt have a v6 CIDR enabled network policy shouldn't have it and take over ports. VPC CNI 1.18.x has 24 open port limitation and if we add both v4 and v6 then you have 12 ports each

Example policy

apiVersion: networking.k8s.aws/v1alpha1
kind: PolicyEndpoint
metadata:
creationTimestamp: "2024-10-03T14:48:49Z"
generateName: policy_name
generation: 19
name: -vl8w4
namespace: default
ownerReferences:
- apiVersion: networking.k8s.io/v1
blockOwnerDeletion: true
controller: true
kind: NetworkPolicy
name: policy_name
uid: 7f6a8d5b-5f5b-491f-8761-945f26094d8f
resourceVersion: "221306648"
uid: 5685a8f2-1e18-44db-8eab-87ad61198aa5
spec:
egress:
- cidr: 0.0.0.0/0
ports:
- port: 49
protocol: TCP
- port: 53
protocol: TCP
- port: 53
protocol: UDP
- port: 443
protocol: TCP
- port: 465
protocol: TCP
- port: 514
protocol: TCP
- port: 3306
protocol: TCP
- port: 6379
protocol: TCP
- cidr: ::/0
ports:
- port: 49
protocol: TCP
- port: 53
protocol: TCP
- port: 53
protocol: UDP
- port: 443
protocol: TCP
- port: 465
protocol: TCP
- port: 514
protocol: TCP
- port: 3306
protocol: TCP
- port: 6379
protocol: TCP
- cidr:
- cidr:
- cidr:
ingress:
- cidr:
- cidr: 0.0.0.0/0
ports:
- port: 7000
protocol: TCP
- port: 8080
protocol: TCP
- cidr: ::/0
ports:
- port: 7000
protocol: TCP
- port: 8080
protocol: TCP
- cidr:
- cidr:
podIsolation:
- Ingress
- Egress
podSelector:
matchLabels:
orch: name
podSelectorEndpoints:
- hostIP:
name:
namespace: default
podIP:
- hostIP:
name:
namespace: default
podIP:
policyRef:
name:
namespace: default

Thanks,

Vignesh

Start by locating the controller code that generates PolicyEndpoint ingress and egress CIDR entries, then trace how IPv4 and IPv6 enablement is determined. Use the example in this issue as the expected shape: an IPv4-only cluster should not receive ::/0 rules or duplicate port entries; identify or add coverage for that behavior.

Written by the indexing model from the issue text.