From c8d526cf09fd943de131382b5d21ce4e7a3d2c21 Mon Sep 17 00:00:00 2001 From: Alex Melhem Date: Mon, 27 Jul 2026 15:44:09 +0200 Subject: [PATCH] Make vpc-cni and kube-proxy optional when creating IPv6 clusters The initial implementation of IPv6 cluster creation assumed a requirement for AWS VPC CNI and Kube Proxy. As other CNI/proxy solutions add support for IPv6, this change removes the requirement for the 2 above addons when creating IPv6 clusters. It also removes the requirement to use OIDC if vpc-cni is not in use. Signed-off-by: Alex Melhem --- pkg/apis/eksctl.io/v1alpha5/validation.go | 29 ++++++++----------- .../eksctl.io/v1alpha5/validation_test.go | 10 ++++++- userdocs/src/usage/vpc-ip-family.md | 10 +++---- 3 files changed, 26 insertions(+), 23 deletions(-) diff --git a/pkg/apis/eksctl.io/v1alpha5/validation.go b/pkg/apis/eksctl.io/v1alpha5/validation.go index 070e7a2519..8336312eb6 100644 --- a/pkg/apis/eksctl.io/v1alpha5/validation.go +++ b/pkg/apis/eksctl.io/v1alpha5/validation.go @@ -700,28 +700,23 @@ func (c *ClusterConfig) validateKubernetesNetworkConfig() error { case strings.ToLower(IPV4Family), "": case strings.ToLower(IPV6Family): if !c.IsAutoModeEnabled() { - if missing := c.addonContainsManagedAddons([]string{VPCCNIAddon, CoreDNSAddon, KubeProxyAddon}); len(missing) != 0 { + if missing := c.addonContainsManagedAddons([]string{CoreDNSAddon}); len(missing) != 0 { return fmt.Errorf("the default core addons must be defined for IPv6; missing addon(s): %s; either define them or use EKS Auto Mode", strings.Join(missing, ", ")) } - // Check if at least one credential provider (Pod identity or IRSA) is configured - if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) != 0 && (c.IAM == nil || c.IAM != nil && IsDisabled(c.IAM.WithOIDC)) { - return errors.New("either pod identity or oidc needs to be enabled if IPv6 is set; set either one or use EKS Auto Mode") - } - - // If the pod identity addon is present, verify it is correctly configured for use by the VPC CNI addon - // Assuming user intends to use pod identities if the pod identity agent addon is added. - if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) == 0 && !c.AddonsConfig.AutoApplyPodIdentityAssociations { - vpcCNIAddonEntry := c.getAddon(VPCCNIAddon) - - if vpcCNIAddonEntry == nil { - // should be unreachable - return errors.New("the vpc-cni addon must be defined for IPv6; either define it or use EKS Auto Mode") + if vpcCNIAddonEntry := c.getAddon(VPCCNIAddon); vpcCNIAddonEntry != nil { + // Check if at least one credential provider (Pod identity or IRSA) is configured + if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) != 0 && (c.IAM == nil || c.IAM != nil && IsDisabled(c.IAM.WithOIDC)) { + return errors.New("either pod identity or oidc needs to be enabled if IPv6 is set; set either one or use EKS Auto Mode") } - if !vpcCNIAddonEntry.UseDefaultPodIdentityAssociations && - (vpcCNIAddonEntry.PodIdentityAssociations == nil || len(*vpcCNIAddonEntry.PodIdentityAssociations) == 0) { - return fmt.Errorf("Set one of: addonsConfig.autoApplyPodIdentityAssociations, useDefaultPodIdentityAssociations on the vpc-cni addon, apply a custom pod identity on the vpc-cni addon") + // If the pod identity addon is present, verify it is correctly configured for use by the VPC CNI addon + // Assuming user intends to use pod identities if the pod identity agent addon is added. + if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) == 0 && !c.AddonsConfig.AutoApplyPodIdentityAssociations { + if !vpcCNIAddonEntry.UseDefaultPodIdentityAssociations && + (vpcCNIAddonEntry.PodIdentityAssociations == nil || len(*vpcCNIAddonEntry.PodIdentityAssociations) == 0) { + return fmt.Errorf("Set one of: addonsConfig.autoApplyPodIdentityAssociations, useDefaultPodIdentityAssociations on the vpc-cni addon, apply a custom pod identity on the vpc-cni addon") + } } } } diff --git a/pkg/apis/eksctl.io/v1alpha5/validation_test.go b/pkg/apis/eksctl.io/v1alpha5/validation_test.go index ce8a9501c7..20707a8de2 100644 --- a/pkg/apis/eksctl.io/v1alpha5/validation_test.go +++ b/pkg/apis/eksctl.io/v1alpha5/validation_test.go @@ -1233,7 +1233,7 @@ var _ = Describe("ClusterConfig validation", func() { } cfg.Addons = append(cfg.Addons, &api.Addon{Name: api.KubeProxyAddon}) err = api.ValidateClusterConfig(cfg) - Expect(err).To(MatchError(ContainSubstring("the default core addons must be defined for IPv6; missing addon(s): vpc-cni, coredns"))) + Expect(err).To(MatchError(ContainSubstring("the default core addons must be defined for IPv6; missing addon(s): coredns"))) }) }) @@ -1300,6 +1300,14 @@ var _ = Describe("ClusterConfig validation", func() { }) }) }) + + When("vpc-cni addon is not provided", func() { + It("accepts that setting", func() { + cfg.Addons = []*api.Addon{{Name: api.CoreDNSAddon}} + err = api.ValidateClusterConfig(cfg) + Expect(err).To(BeNil()) + }) + }) }) When("ipFamily is set to IPv6, no managed addons are provided, but auto-mode is used", func() { diff --git a/userdocs/src/usage/vpc-ip-family.md b/userdocs/src/usage/vpc-ip-family.md index 579f58fafa..781c38ebce 100644 --- a/userdocs/src/usage/vpc-ip-family.md +++ b/userdocs/src/usage/vpc-ip-family.md @@ -22,20 +22,20 @@ kubernetesNetworkConfig: ipFamily: IPv6 # or IPv4 addons: - - name: vpc-cni + - name: vpc-cni # optional - name: coredns - - name: kube-proxy + - name: kube-proxy # optional +# required if vpc-cni addon is used iam: withOIDC: true ``` This is an in config file setting only. When IPv6 is set, the following restriction must be followed: -- OIDC is enabled -- managed addons are defined as shows above +- OIDC is enabled if `vpc-cni` addon is used - cluster version must be => 1.21 -- vpc-cni addon version must be => 1.10.0 +- if used, vpc-cni addon version must be => 1.10.0 - unmanaged nodegroups are not yet supported with IPv6 clusters - managed nodegroup creation is not supported with un-owned IPv6 clusters - `vpc.NAT` and `serviceIPv4CIDR` fields are created by eksctl for ipv6 clusters and thus, are not supported configuration options