Branch ENIs not receiving IPv6 addresses in dual-stack subnets

[jfernandez]

Describe the Bug:

Branch ENIs created by the VPC Resource Controller are not receiving IPv6 addresses when deployed in dual-stack subnets. The CreateNetworkInterface API call does not request IPv6 addresses, resulting in branch ENIs that only have IPv4 connectivity even when the subnet has an IPv6 CIDR block assigned.

Observed Behavior:

When creating branch ENIs for pods in a subnet that has both IPv4 and IPv6 CIDR blocks configured:

• Branch ENIs receive one primary IPv4 address (auto-assigned by AWS)
• Branch ENIs do NOT receive any IPv6 addresses
• Pods using these branch ENIs cannot communicate over IPv6

The controller checks the subnet's IPv6 CIDR block but does not pass IPv6 address requests to the EC2 CreateNetworkInterface API.

Expected Behavior:

In dual-stack subnets (subnets with both IPv4 and IPv6 CIDR blocks), branch ENIs should receive both IP families:

• 1 IPv4 address (auto-assigned by AWS)
• 1 IPv6 address

The controller should provision IP addresses that match the subnet's capabilities, allowing the pod/kubelet/CNI layer to decide which IP family to use for connectivity.

How to reproduce it (as minimally and precisely as possible):

1. Create an EKS cluster with IPv6 networking enabled
2. Ensure worker nodes are in a subnet with both IPv4 and IPv6 CIDR blocks assigned
3. Deploy a pod that requests a branch ENI (using security groups for pods or trunk ENI feature)
4. Inspect the branch ENI created for the pod:

   aws ec2 describe-network-interfaces --network-interface-ids <eni-id>

5. Observe that Ipv6Addresses array is empty despite the subnet having an IPv6 CIDR block

Additional Context:

AWS behavior for ENI creation:

• IPv4 primary address is automatically assigned in dual-stack subnets (no explicit request needed)
• IPv6 addresses must be explicitly requested via Ipv6AddressCount or Ipv6PrefixCount parameter
• Without this request, ENIs in dual-stack subnets receive IPv4 only

Environment:

• Kubernetes version: EKS 1.32
• VPC Resource Controller version: 1.7.2 and earlier
• OS: Linux
• Subnet configuration: Dual-stack (both IPv4 and IPv6 CIDR blocks)

Related:

• This issue only affects branch ENIs (trunk ENI feature for security groups for pods)
• Standard pod networking through the VPC CNI plugin may have separate IPv6 handling
• Custom networking mode (ENIConfig) does not support IPv6 and is out of scope for this issue

[yash97]

Thanks for reporting. Will repro and raise fix for this.

[jfernandez]

@yash97 I tested this fix, and it appears to be working as expected in our cluster. #636