aws / aws/amazon-vpc-resource-controller-k8s
Branch ENIs not receiving IPv6 addresses in dual-stack subnets
- Dominant language
- Go
- Stars
- 106
- Forks
- 71
- Avg merge
- 10h 28m
- Merged PRs (30d)
- 6
Description
**Describe the Bug**:
Branch ENIs created by the VPC Resource Controller are not receiving IPv6 addresses when deployed in dual-stack subnets. The `CreateNetworkInterface` API call does not request IPv6 addresses, resulting in branch ENIs that only have IPv4 connectivity even when the subnet has an IPv6 CIDR block assigned.
**Observed Behavior**:
When creating branch ENIs for pods in a subnet that has both IPv4 and IPv6 CIDR blocks configured:
- Branch ENIs receive one primary IPv4 address (auto-assigned by AWS)
- Branch ENIs do NOT receive any IPv6 addresses
- Pods using these branch ENIs cannot communicate over IPv6
The controller checks the subnet's IPv6 CIDR block but does not pass IPv6 address requests to the EC2 `CreateNetworkInterface` API.
**Expected Behavior**:
In dual-stack subnets (subnets with both IPv4 and IPv6 CIDR blocks), branch ENIs should receive both IP families:
- 1 IPv4 address (auto-assigned by AWS)
- 1 IPv6 address
The controller should provision IP addresses that match the subnet's capabilities, allowing the pod/kubelet/CNI layer to decide which IP family to use for connectivity.
**How to reproduce it (as minimally and precisely as possible)**:
1. Create an EKS cluster with IPv6 networking enabled
2. Ensure worker nodes are in a subnet with both IPv4 and IPv6 CIDR blocks assigned
3. Deploy a pod that requests a branch ENI (using security groups for pods or trunk ENI feature)
4. Inspect the branch ENI created for the pod:
```bash
aws ec2 describe-network-interfaces --network-interface-ids
```
5. Observe that `Ipv6Addresses` array is empty despite the subnet having an IPv6 CIDR block
**Additional Context**:
AWS behavior for ENI creation:
- IPv4 primary address is automatically assigned in dual-stack subnets (no explicit request needed)
- IPv6 addresses must be explicitly requested via `Ipv6AddressCount` or `Ipv6PrefixCount` parameter
- Without this request, ENIs in dual-stack subnets receive IPv4 only
**Environment**:
- Kubernetes version: EKS 1.32
- VPC Resource Controller version: 1.7.2 and earlier
- OS: Linux
- Subnet configuration: Dual-stack (both IPv4 and IPv6 CIDR blocks)
**Related**:
- This issue only affects branch ENIs (trunk ENI feature for security groups for pods)
- Standard pod networking through the VPC CNI plugin may have separate IPv6 handling
- Custom networking mode (ENIConfig) does not support IPv6 and is out of scope for this issue
Contributor guide
Assessment
This issue has not been assessed yet.