aws / aws/amazon-vpc-resource-controller-k8s

Branch ENIs not receiving IPv6 addresses in dual-stack subnets

Open
#635 2 comments 0 reactions 1 assignee Claimed by @yash97 View on GitHub
bug
Dominant language
Go
Stars
106
Forks
71
Avg merge
10h 28m
Merged PRs (30d)
6

Description

**Describe the Bug**:

Branch ENIs created by the VPC Resource Controller are not receiving IPv6 addresses when deployed in dual-stack subnets. The `CreateNetworkInterface` API call does not request IPv6 addresses, resulting in branch ENIs that only have IPv4 connectivity even when the subnet has an IPv6 CIDR block assigned.

**Observed Behavior**:

When creating branch ENIs for pods in a subnet that has both IPv4 and IPv6 CIDR blocks configured:
- Branch ENIs receive one primary IPv4 address (auto-assigned by AWS)
- Branch ENIs do NOT receive any IPv6 addresses
- Pods using these branch ENIs cannot communicate over IPv6

The controller checks the subnet's IPv6 CIDR block but does not pass IPv6 address requests to the EC2 `CreateNetworkInterface` API.

**Expected Behavior**:

In dual-stack subnets (subnets with both IPv4 and IPv6 CIDR blocks), branch ENIs should receive both IP families:
- 1 IPv4 address (auto-assigned by AWS)
- 1 IPv6 address

The controller should provision IP addresses that match the subnet's capabilities, allowing the pod/kubelet/CNI layer to decide which IP family to use for connectivity.

**How to reproduce it (as minimally and precisely as possible)**:

1. Create an EKS cluster with IPv6 networking enabled
2. Ensure worker nodes are in a subnet with both IPv4 and IPv6 CIDR blocks assigned
3. Deploy a pod that requests a branch ENI (using security groups for pods or trunk ENI feature)
4. Inspect the branch ENI created for the pod:
```bash
aws ec2 describe-network-interfaces --network-interface-ids
```
5. Observe that `Ipv6Addresses` array is empty despite the subnet having an IPv6 CIDR block

**Additional Context**:

AWS behavior for ENI creation:
- IPv4 primary address is automatically assigned in dual-stack subnets (no explicit request needed)
- IPv6 addresses must be explicitly requested via `Ipv6AddressCount` or `Ipv6PrefixCount` parameter
- Without this request, ENIs in dual-stack subnets receive IPv4 only

**Environment**:
- Kubernetes version: EKS 1.32
- VPC Resource Controller version: 1.7.2 and earlier
- OS: Linux
- Subnet configuration: Dual-stack (both IPv4 and IPv6 CIDR blocks)

**Related**:
- This issue only affects branch ENIs (trunk ENI feature for security groups for pods)
- Standard pod networking through the VPC CNI plugin may have separate IPv6 handling
- Custom networking mode (ENIConfig) does not support IPv6 and is out of scope for this issue

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.