Make vpc-cni and kube-proxy optional when creating IPv6 clusters

pkg/apis/eksctl.io/v1alpha5/validation.go

@@ -700,28 +700,23 @@ func (c *ClusterConfig) validateKubernetesNetworkConfig() error {
 	case strings.ToLower(IPV4Family), "":
 	case strings.ToLower(IPV6Family):
 		if !c.IsAutoModeEnabled() {
-			if missing := c.addonContainsManagedAddons([]string{VPCCNIAddon, CoreDNSAddon, KubeProxyAddon}); len(missing) != 0 {
+			if missing := c.addonContainsManagedAddons([]string{CoreDNSAddon}); len(missing) != 0 {
 				return fmt.Errorf("the default core addons must be defined for IPv6; missing addon(s): %s; either define them or use EKS Auto Mode", strings.Join(missing, ", "))
 			}
 
-			// Check if at least one credential provider (Pod identity or IRSA) is configured
-			if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) != 0 && (c.IAM == nil || c.IAM != nil && IsDisabled(c.IAM.WithOIDC)) {
-				return errors.New("either pod identity or oidc needs to be enabled if IPv6 is set; set either one or use EKS Auto Mode")
-			}
-
-			// If the pod identity addon is present, verify it is correctly configured for use by the VPC CNI addon
-			// Assuming user intends to use pod identities if the pod identity agent addon is added.
-			if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) == 0 && !c.AddonsConfig.AutoApplyPodIdentityAssociations {
-				vpcCNIAddonEntry := c.getAddon(VPCCNIAddon)
-
-				if vpcCNIAddonEntry == nil {
-					// should be unreachable
-					return errors.New("the vpc-cni addon must be defined for IPv6; either define it or use EKS Auto Mode")
+			if vpcCNIAddonEntry := c.getAddon(VPCCNIAddon); vpcCNIAddonEntry != nil {
+				// Check if at least one credential provider (Pod identity or IRSA) is configured
+				if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) != 0 && (c.IAM == nil || c.IAM != nil && IsDisabled(c.IAM.WithOIDC)) {
+					return errors.New("either pod identity or oidc needs to be enabled if IPv6 is set; set either one or use EKS Auto Mode")
 				}
 
-				if !vpcCNIAddonEntry.UseDefaultPodIdentityAssociations &&
-					(vpcCNIAddonEntry.PodIdentityAssociations == nil || len(*vpcCNIAddonEntry.PodIdentityAssociations) == 0) {
-					return fmt.Errorf("Set one of: addonsConfig.autoApplyPodIdentityAssociations, useDefaultPodIdentityAssociations on the vpc-cni addon, apply a custom pod identity on the vpc-cni addon")
+				// If the pod identity addon is present, verify it is correctly configured for use by the VPC CNI addon
+				// Assuming user intends to use pod identities if the pod identity agent addon is added.
+				if len(c.addonContainsManagedAddons([]string{PodIdentityAgentAddon})) == 0 && !c.AddonsConfig.AutoApplyPodIdentityAssociations {
+					if !vpcCNIAddonEntry.UseDefaultPodIdentityAssociations &&
+						(vpcCNIAddonEntry.PodIdentityAssociations == nil || len(*vpcCNIAddonEntry.PodIdentityAssociations) == 0) {
+						return fmt.Errorf("Set one of: addonsConfig.autoApplyPodIdentityAssociations, useDefaultPodIdentityAssociations on the vpc-cni addon, apply a custom pod identity on the vpc-cni addon")
+					}
 				}
 			}
 		}

pkg/apis/eksctl.io/v1alpha5/validation_test.go

@@ -1233,7 +1233,7 @@ var _ = Describe("ClusterConfig validation", func() {
 						}
 						cfg.Addons = append(cfg.Addons, &api.Addon{Name: api.KubeProxyAddon})
 						err = api.ValidateClusterConfig(cfg)
-						Expect(err).To(MatchError(ContainSubstring("the default core addons must be defined for IPv6; missing addon(s): vpc-cni, coredns")))
+						Expect(err).To(MatchError(ContainSubstring("the default core addons must be defined for IPv6; missing addon(s): coredns")))
 					})
 				})
 
@@ -1300,6 +1300,14 @@ var _ = Describe("ClusterConfig validation", func() {
 							})
 						})
 					})
+
+					When("vpc-cni addon is not provided", func() {
+						It("accepts that setting", func() {
+							cfg.Addons = []*api.Addon{{Name: api.CoreDNSAddon}}
+							err = api.ValidateClusterConfig(cfg)
+							Expect(err).To(BeNil())
+						})
+					})
 				})
 
 				When("ipFamily is set to IPv6, no managed addons are provided, but auto-mode is used", func() {

userdocs/src/usage/vpc-ip-family.md

@@ -22,20 +22,20 @@ kubernetesNetworkConfig:
   ipFamily: IPv6 # or IPv4
 
 addons:
-  - name: vpc-cni
+  - name: vpc-cni # optional
   - name: coredns
-  - name: kube-proxy
+  - name: kube-proxy # optional
 
+# required if vpc-cni addon is used
 iam:
   withOIDC: true
 ```
 
 This is an in config file setting only. When IPv6 is set, the following restriction must be followed:
 
-- OIDC is enabled
-- managed addons are defined as shows above
+- OIDC is enabled if `vpc-cni` addon is used
 - cluster version must be => 1.21
-- vpc-cni addon version must be => 1.10.0
+- if used, vpc-cni addon version must be => 1.10.0
 - unmanaged nodegroups are not yet supported with IPv6 clusters
 - managed nodegroup creation is not supported with un-owned IPv6 clusters
 - `vpc.NAT` and `serviceIPv4CIDR` fields are created by eksctl for ipv6 clusters and thus, are not supported configuration options