Skip to content

feat: Add dualstack support for AWS Infrastructure #640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

Volatus
Copy link
Contributor

@Volatus Volatus commented Apr 16, 2025

  1. Makes the necessary changes to the VPC, subnets, security groups and gateways to add IPv6 Dualstack support.
  2. Dualstack is opt-in, controlled by the var.dualstack variable, which defaults to false.
  3. There is no change to how IPv4 environments are created, they're identical to how they were before.

dualstack is also added as a Terraform output so that Bosh will have a way of determining whether it has to consume IPv6 specific outputs or not.

Copy link

linux-foundation-easycla bot commented Apr 16, 2025

CLA Signed

The committers listed above are authorized under a signed CLA.

@peanball
Copy link
Contributor

For completeness, I've discussed with @Volatus that the IPv6 config should be optional, not default. The PR is being reworked to base IPv6 or not on a terraform variable. This variable will then be set by the Go code appropriately and defaults to "IPv4 only".

@oliver-heinrich
Copy link

oliver-heinrich commented Apr 18, 2025

Hi @Volatus , thanks for your contribution :-). I have the following questions:

  • Looks like you also enhanced the load balancer for the ingress part. Are the enhancements also covering therefore the IPv6 ingress part? This would be great as we plan from cf-deployment a roundtrip test in the CATs test suite where an app exposes an IPv6 HTTP endpoint that can be called from the same app via an egress call. With this approach we would become in the CATs tests independent from calling external Third Party IPv6 Test URL's
  • Currently we have in cf deployment only bbl env for IPv4. Can we upgrade in a compatible way our IPv4 bbl env's to the new dualstack env using the introduced config switch for the dualstack (proposed by @peanball )?

@peanball
Copy link
Contributor

@oliver-heinrich, please note that "upgrade" is not in scope. Recreate would be your option.

See also #632, which contains what was agreed with the BOSH team (via @rkoster).

@Volatus Volatus force-pushed the feat/aws-ipv6-enhancement branch from 4fca9ea to 47a626b Compare April 22, 2025 10:23
@Volatus
Copy link
Contributor Author

Volatus commented Apr 22, 2025

Hi @oliver-heinrich

Looks like you also enhanced the load balancer for the ingress part. Are the enhancements also covering therefore the IPv6 ingress part?

LB wise it's occurred to me that we should replace the aws_elb resources with aws_lb ones. The ELB variants are the old classic load balancers on AWS, which don't support dualstack/IPv6. The newer ones do and would allow us to pick from application, network or gateway LBs.

Here's an overview of the differences between the LB variants on AWS, I think we may need to use network type if we need TCP listeners.

Currently we have in cf deployment only bbl env for IPv4. Can we upgrade in a compatible way our IPv4 bbl env's to the new dualstack env using the introduced config switch for the dualstack

Theoretically this could be possible. (although I run into clashing security group rules when trying to upgrade from IPv4 to dualstack but it downgrades just fine from dualstack to IPv4)

@oliver-heinrich
Copy link

overview of the differences between the LB variants on AWS

@Volatus : Thank you for the info.
@jochenehret : FYI regarding the ELB/LB changes.

@peanball
Copy link
Contributor

I would prefer moving the LB changes into a separate PR.

@Volatus Volatus marked this pull request as ready for review April 23, 2025 07:18
@Volatus Volatus force-pushed the feat/aws-ipv6-enhancement branch 5 times, most recently from 40de513 to 59e04b3 Compare April 24, 2025 13:40
@beyhan beyhan requested review from a team, ragaskar, mingxiao and ramonskie and removed request for a team April 24, 2025 15:15
@beyhan
Copy link
Member

beyhan commented Apr 24, 2025

@Volatus could you please update the description with the latest change state.

@beyhan beyhan moved this from Inbox to Pending Review | Discussion in Foundational Infrastructure Working Group Apr 24, 2025
Volatus added 2 commits May 5, 2025 11:31
Makes the necessary changes to the VPC, subnets, security groups and gateways to add IPv6 Dualstack support.

Signed-off-by: Ismayil Mirzali <[email protected]>
@Volatus Volatus force-pushed the feat/aws-ipv6-enhancement branch from 59e04b3 to 2d52540 Compare May 5, 2025 08:32
@peanball
Copy link
Contributor

peanball commented May 8, 2025

@beyhan @ramonskie, the description has been updated. Please don't forget about this PR :D

As noted, this is part 1 of X for adding IPv6 dual stack support. The next step will be to process the new TF vars when var.dualstack is set to true and pass them on to BOSH and the other deployments as part of the BBL code.

Copy link
Contributor

@peanball peanball left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validated changes on our AWS account, with changes as expected.

Copy link
Contributor

@ramonskie ramonskie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@ramonskie ramonskie merged commit 35dce3a into cloudfoundry:main May 8, 2025
4 checks passed
@github-project-automation github-project-automation bot moved this from Pending Review | Discussion to Done in Foundational Infrastructure Working Group May 8, 2025
@Volatus Volatus deleted the feat/aws-ipv6-enhancement branch May 14, 2025 07:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Development

Successfully merging this pull request may close these issues.

6 participants