Add ipv6 support. #1024

axel7born · 2024-08-05T15:16:04Z

How to categorize this PR?

/area networking
/kind enhancement
/platform aws

What this PR does / why we need it:
The PR adds required infrastructure changes to deploy IPv6 shoots.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Add ipv6 support to deploy IPv6 shoots.

pkg/controller/controlplane/valuesprovider.go

pkg/controller/infrastructure/infraflow/reconcile.go

kon-angelo · 2024-09-02T11:40:17Z

pkg/controller/infrastructure/infraflow/reconcile.go

-	desired.CidrBlock = *c.config.Networks.VPC.CIDR
+
+	if !isIPv4(c.ipFamilies) && c.config.Networks.VPC.CIDR == nil {
+		desired.CidrBlock = "10.0.0.0/16"


I think I forgot the outcome of that discussion around this hardcoded IP and it would be nice if here or better in a comment write something about it.

Probably, it is better not to automatically assign an IPv4 address here and leave that to the user?

Though, I need to adapt the validation.

kon-angelo · 2024-09-02T11:46:10Z

pkg/controller/infrastructure/infraflow/reconcile.go

+				AssignIpv6AddressOnCreation: ptr.To(isIPv6(c.ipFamilies)),
+				CidrBlock: func(cidr string) string {
+					if cidr == "" {
+						return "10.0.32.0/20"


also here regarding the "magic IP"

Same as above, it is probably better to let the user configure the CIDR for the public range.

kon-angelo · 2024-09-02T11:48:01Z

/needs rebase

hebelsan · 2024-09-02T10:52:53Z

pkg/aws/client/client.go

@@ -1202,6 +1206,79 @@ func (c *Client) DeleteInternetGateway(ctx context.Context, id string) error {
 	return ignoreNotFound(err)
 }

+func (c *Client) CreateEgressOnlyInternetGateway(ctx context.Context, gateway *EgressOnlyInternetGateway) (*EgressOnlyInternetGateway, error) {


Public func CreateEgressOnlyInternetGateway should have a describing comment

I added a comment.

hebelsan · 2024-09-02T11:53:37Z

pkg/controller/infrastructure/actuator_reconcile.go

@@ -395,6 +407,18 @@ func generateTerraformInfraConfig(ctx context.Context, infrastructure *extension
 		dhcpDomainName = fmt.Sprintf("%s.compute.internal", infrastructure.Spec.Region)
 	}

+	isIPv4 := true
+	isIPv6 := false
+	if sets.New[v1beta1.IPFamily](ipFamilies...).Has(v1beta1.IPFamilyIPv6) {


Is there a special reason why we use sets, couldn't we just use slices.Contains() here?

No special reason, I changed it to slices.Contains().

pkg/apis/aws/validation/infrastructure.go

pkg/apis/aws/validation/shoot.go

kon-angelo · 2024-09-24T09:11:37Z

pkg/controller/infrastructure/infraflow/context.go

@@ -155,6 +160,7 @@ func NewFlowContext(opts Opts) (*FlowContext, error) {
 		infra:         opts.Infrastructure,
 		client:        opts.AwsClient,
 		runtimeClient: opts.RuntimeClient,
+		ipFamilies:    opts.IPFamilies,


Nit: I think you can just do the init here in this func instead of passing it as an opt.

I get it from c.Shoot.Spec.Networking.IPFamilies, which I don't have here. Or am I missing something?

pkg/controller/infrastructure/infraflow/reconcile.go

kon-angelo · 2024-09-24T09:37:25Z

pkg/controller/infrastructure/infraflow/reconcile.go

+	if slices.Contains(c.ipFamilies, v1beta1.IPFamilyIPv6) {
+		eogw, err := c.client.FindEgressOnlyInternetGatewayByVPC(ctx, vpcID)
+		if err != nil || eogw == nil {
+			return fmt.Errorf("Egress-Only Internet Gateway not found for VPC %s", vpcID)
+		}
+		c.state.Set(IdentifierEgressOnlyInternetGateway, eogw.EgressOnlyInternetGatewayId)


Not sure but you have a separate step for ensure the EOIG, why do it also here.

Also you can add a preflight check in

gardener-extension-provider-aws/pkg/controller/infrastructure/configvalidator.go

Line 118 in 96c494f

internetGatewayID, err := awsClient.GetVPCInternetGateway(ctx, vpcID)

The EOIG should be present in case of an existing VPC. In that case the ensure step would not be run. However, I struggle to add it to the preflight check as I don't have Shoot.Spec.Networking.IPFamilies there.

You can fetch it with:

cluster, err := extensionscontroller.GetCluster(ctx, r.client, infrastructure.Namespace) if err != nil { return reconcile.Result{}, err }

pkg/controller/infrastructure/infraflow/reconcile.go

kon-angelo · 2024-09-24T10:23:05Z

pkg/controller/infrastructure/infraflow/reconcile.go

@@ -1420,17 +1553,17 @@ func (c *FlowContext) getSubnetKey(item *awsclient.Subnet) (zoneName, subnetKey
 			for _, key := range []string{IdentifierZoneSubnetWorkers, IdentifierZoneSubnetPublic, IdentifierZoneSubnetPrivate} {
 				switch key {
 				case IdentifierZoneSubnetWorkers:
-					if value == helper.GetSuffixSubnetWorkers() {
+					if value == fmt.Sprintf("%s-%s", c.namespace, helper.GetSuffixSubnetWorkers()) {


can this value be changed freely ? What happens to existing clusters that have already a state and the key will change ?

I'm wondering how this should have worked before. The tag is set here and could have never matched before. Or am I missing something.

pkg/controller/infrastructure/templates/main.tpl.tf

axel7born · 2024-09-25T08:13:35Z

I think I addressed all comments. Could you take a look again, please?

kon-angelo · 2024-09-27T12:49:07Z

/test

testmachinery · 2024-09-27T12:49:12Z

Testrun: e2e-g5zqw
Workflow: e2e-g5zqw-wf
Phase: Failed

+---------------------+-----------------------------+-----------+----------+
|        NAME         |            STEP             |   PHASE   | DURATION |
+---------------------+-----------------------------+-----------+----------+
| bastion-test        | bastion-test                | Succeeded | 9m4s     |
| dnsrecord-test      | dnsrecord-test              | Succeeded | 5m47s    |
| infrastructure-test | infrastructure-test-tf      | Succeeded | 35m6s    |
| infrastructure-test | infrastructure-test-flow    | Failed    | 26m28s   |
| infrastructure-test | infrastructure-test-migrate | Omitted   | 0s       |
| infrastructure-test | infrastructure-test-recover | Omitted   | 0s       |
+---------------------+-----------------------------+-----------+----------+

kon-angelo · 2024-09-30T08:25:41Z

/test

testmachinery · 2024-09-30T08:25:45Z

Testrun: e2e-sfpkj
Workflow: e2e-sfpkj-wf
Phase: Failed

+---------------------+-----------------------------+-----------+----------+
|        NAME         |            STEP             |   PHASE   | DURATION |
+---------------------+-----------------------------+-----------+----------+
| bastion-test        | bastion-test                | Succeeded | 8m6s     |
| dnsrecord-test      | dnsrecord-test              | Succeeded | 5m54s    |
| infrastructure-test | infrastructure-test-tf      | Succeeded | 34m54s   |
| infrastructure-test | infrastructure-test-flow    | Succeeded | 26m20s   |
| infrastructure-test | infrastructure-test-migrate | Failed    | 39m42s   |
| infrastructure-test | infrastructure-test-recover | Omitted   | 0s       |
+---------------------+-----------------------------+-----------+----------+

Adapt tests.

axel7born requested review from a team as code owners August 5, 2024 15:16

gardener-robot added the needs/review Needs review label Aug 5, 2024

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 5, 2024

gardener-robot-ci-1 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Aug 5, 2024

axel7born mentioned this pull request Aug 5, 2024

Set ipv6AddressCount and ipv6PrefixCount when dualstack is enabled. #785

Closed

kon-angelo reviewed Sep 2, 2024

View reviewed changes

gardener-robot added the needs/rebase Needs git rebase label Sep 2, 2024

hebelsan reviewed Sep 2, 2024

View reviewed changes

axel7born force-pushed the add-ipv6 branch from 0baa71d to 0cf707f Compare September 10, 2024 15:00

gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 10, 2024

axel7born force-pushed the add-ipv6 branch from 0cf707f to 6817edf Compare September 11, 2024 07:43

gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 11, 2024

gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 13, 2024

axel7born force-pushed the add-ipv6 branch from a33a944 to 81dce2e Compare September 14, 2024 16:22

gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 14, 2024

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 19, 2024

gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 19, 2024

axel7born force-pushed the add-ipv6 branch from 9af2acd to b599b86 Compare September 19, 2024 12:52

kon-angelo requested changes Sep 24, 2024

View reviewed changes

gardener-robot added the needs/changes Needs (more) changes label Sep 24, 2024

kon-angelo requested changes Sep 24, 2024

View reviewed changes

pkg/controller/infrastructure/templates/main.tpl.tf Outdated Show resolved Hide resolved

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 24, 2024

gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 24, 2024

axel7born force-pushed the add-ipv6 branch from cd95944 to 5db11b5 Compare September 25, 2024 08:04

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 25, 2024

gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 25, 2024

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 27, 2024

gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 27, 2024

axel7born added 12 commits October 1, 2024 12:36

IPv6 infrastructure changes for terraform.

435e053

Request IPv6 addresses in case of IPv6 shoots.

99d0137

Set NodeIPFamily to IPv6 for IPv6 shoots.

9348880

Add IPv6 to flow based deploy.

6633aab

Adapt tests.

Address review comments.

75c521a

Adapt validation.

3098be3

Fix after rebase.

2a24739

Fix integration tests.

e788237

Fix terraform after rebase.

458b592

fix format

bc8a51d

Address review comments.

37fb225

Add comment to getSubnetKey.

aaf6215

axel7born force-pushed the add-ipv6 branch from a5e7111 to aaf6215 Compare October 1, 2024 10:42

gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Oct 1, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ipv6 support. #1024

Add ipv6 support. #1024

axel7born commented Aug 5, 2024

kon-angelo Sep 2, 2024

axel7born Sep 11, 2024

axel7born Sep 11, 2024

kon-angelo Sep 2, 2024

axel7born Sep 11, 2024

kon-angelo commented Sep 2, 2024

hebelsan Sep 2, 2024

axel7born Sep 11, 2024

hebelsan Sep 2, 2024

axel7born Sep 11, 2024

kon-angelo Sep 24, 2024

axel7born Sep 25, 2024

kon-angelo Sep 24, 2024

axel7born Sep 25, 2024

kon-angelo Sep 27, 2024

kon-angelo Sep 24, 2024

axel7born Sep 24, 2024

axel7born commented Sep 25, 2024

kon-angelo commented Sep 27, 2024

testmachinery bot commented Sep 27, 2024 •

edited

Loading

kon-angelo commented Sep 30, 2024

testmachinery bot commented Sep 30, 2024 •

edited

Loading

Add ipv6 support. #1024

Are you sure you want to change the base?

Add ipv6 support. #1024

Conversation

axel7born commented Aug 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kon-angelo commented Sep 2, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

axel7born commented Sep 25, 2024

kon-angelo commented Sep 27, 2024

testmachinery bot commented Sep 27, 2024 • edited Loading

kon-angelo commented Sep 30, 2024

testmachinery bot commented Sep 30, 2024 • edited Loading

testmachinery bot commented Sep 27, 2024 •

edited

Loading

testmachinery bot commented Sep 30, 2024 •

edited

Loading