[EKS] [request]: Support IPv6 only subnets
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
In an ipv6 cluster with a public/private subnet setup (nodes in private subnets, NAT gateways and public LBs in public subnets), I would like my private node subnets to be IPv6-only, with the only IPv4 assignments happening in public subnets if dual-stack support is necessary.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
EKS' current IPv6 implementation requires subnets with nodes in them to have an IPv4 CIDR allocated, in order to assign nodes IPv4 addresses alongside their IPv6 addresses. From what I understand, this was to support outbound requests to IPv4 services when regions did not have DNS64/NAT64 support: DNS returns an A record, the pod is assigned a node-local IPv4 address, then that address is NAT'ed to the node's IPv4 before going out to the IGW.
As of March of this year, however, DNS64 and NAT64 capabilities have been expanded to all AWS commercial and govcloud regions (https://aws.amazon.com/about-aws/whats-new/2022/02/aws-expands-nat64-dns64-regions/). By enabling DNS64 in the node subnet and adding a route table entry forwarding 64:ff9b::/96 to a NAT gateway in a public subnet with an IPv4 address, it should be possible to support outbound IPv4 without requiring the private node subnets to have IPv4 CIDRs assigned.
I think this is important as it:
1. Eliminates the need for custom CNI logic for outbound IPv4 support in IPv6 clusters
2. Eliminates scaling restrictions caused by address exhaustion of small IPv4 subnets in clusters with large numbers of nodes
**Are you currently working around this issue?**
I currently have everything setup as described above, with DNS64 and NAT64, and everything is working fine. I would just like to be able to flip the ipv6_native switch in the terraform definition of my VPC and completely eliminate any assignment of IPv4 CIDRs to my private subnets. If there's a way to disable the custom CNI logic to make sure it's not picking up something I'm missing, I'm happy to test.
If you made it this far, thank you very much :)
Contributor guide
Research direction
Start by reviewing the EKS IPv6 subnet requirements and the AWS DNS64/NAT64 configuration described in the issue. Determine the service and networking changes needed to allow IPv6-only private node subnets while preserving outbound IPv4 access; done means the configuration works without IPv4 CIDRs on private subnets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, infrastructure, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100