aws / aws/containers-roadmap

[EKS/Kubernetes] [Feature request]: Prefix delegation based IPAM support for IPv6 in cloud-provider-aws

Open
#2,067 0 comments 9 reactions 0 assignees View on GitHub
EKS EKS Networking Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

We would like to integrate an IP address management (IPAM) controller with the AWS cloud-controller-manager to assign POD addresses based on prefix delegations. Our primary use-case are IPv6 only clusters, but the concept would also work with some limitations for IPv4.

The desired process for assigning IPv6 addresses to pods is as follows:

* The cloud provider assigns globally unique and routable IPv6 addresses to VPCs/Networks, e.g., using IPAM pools in case of AWS
* When creating nodes, we delegates an IPv6 prefixes to each node, e.g., a /80 in case in case of AWS.
* The IPAM controller within the cloud-controller-manager should picks up this prefix delegation through the cloud provider API and writes the delegated prefix in the nodes PodCIDR attribute. This can be implemented analogous to the GCP implementation as a custom CloudAllocator.
* The standard host-local CNI on the node picks up the PodCIDR and assigns addresses to pods.

**Which service(s) is this request for?**
Kubernetes [cloud-provide-aws](https://github.com/kubernetes/cloud-provider-aws)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
While adding IPv6 support to the [gardener project](https://github.com/gardener/), we strive to get globally unique IPv6 addresses across all our clusters.
We would prefer to integrate the IPv6 IPAM functionality with the cloud provider's as much as possible as using provider managed IPv6 space also eliminates the need for NAT or routing hacks.

The functionality to use delegated prefixes as PodCIDR is already implemented in [amazon-vpc-cni-k8s](https://github.com/aws/amazon-vpc-cni-k8s/tree/master), which requires api keys to read/add prefix delegations to be present on the nodes. This implementation was reasonable for IPv4, where nodes needed dynamically add multiple prefix delegations in order to preserve precious address space. For IPv6, we only need a single prefix delegation and can add this one at the time we create the node, thus, eliminating the risk to expose API keys through a compromised node and the need to deploy the vpc-cni to the nodes.

**Are you currently working around this issue?**
How are you currently solving this problem?

**Additional context**
Original issue was created on [cloud-provider-aws](https://github.com/kubernetes/cloud-provider-aws/issues/608).
We were asked to open an issue here to better track the issue.
One implementation of such a controller which does the prefix delegation can be found [here](https://github.com/kubernetes/kops/blob/master/cmd/kops-controller/controllers/awsipam.go).

Contributor guide

Open the contributing guide

Research direction

Start by reading the referenced kops controller at cmd/kops-controller/controllers/awsipam.go and the related cloud-provider-aws issue #608, then compare the existing amazon-vpc-cni-k8s prefix-delegation implementation. Done means defining and implementing the cloud-provider-aws IPAM flow that discovers an IPv6 prefix delegation and writes it to the node PodCIDR, with validation for the stated IPv6 use case.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.