support nat64 and dns64 (#1082)

gardener · Oct 14, 2024 · a136b35 · a136b35
1 parent 8975d72
commit a136b35
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 0 deletions.
diff --git a/pkg/aws/client/client.go b/pkg/aws/client/client.go
@@ -1460,6 +1460,7 @@ func (c *Client) describeRouteTables(ctx context.Context, input *ec2.DescribeRou
 				NatGatewayId:                route.NatGatewayId,
 				EgressOnlyInternetGatewayId: route.EgressOnlyInternetGatewayId,
 				DestinationPrefixListId:     route.DestinationPrefixListId,
+				DestinationIpv6CidrBlock:    route.DestinationIpv6CidrBlock,
 			})
 		}
 		for _, assoc := range item.Associations {

diff --git a/pkg/controller/infrastructure/infraflow/reconcile.go b/pkg/controller/infrastructure/infraflow/reconcile.go
@@ -32,6 +32,7 @@ const (
 	defaultLongTimeout = 3 * time.Minute
 	allIPv4            = "0.0.0.0/0"
 	allIPv6            = "::/0"
+	nat64Prefix        = "64:ff9b::/96"
 )
 
 // Reconcile creates and runs the flow to reconcile the AWS infrastructure.
@@ -674,6 +675,7 @@ func (c *FlowContext) ensureZones(ctx context.Context) error {
 				CidrBlock:                               zone.Workers,
 				Ipv6Native:                              ptr.To(!isIPv4(c.ipFamilies)),
 				EnableResourceNameDnsAAAARecordOnLaunch: ptr.To(!isIPv4(c.ipFamilies)),
+				EnableDns64:                             ptr.To(!isIPv4(c.ipFamilies)),
 			},
 			&awsclient.Subnet{
 				Tags:                                    tagsPrivate,
@@ -1108,6 +1110,10 @@ func (c *FlowContext) ensurePrivateRoutingTable(zoneName string) flow.TaskFn {
 				DestinationIpv6CidrBlock:    ptr.To(allIPv6),
 				EgressOnlyInternetGatewayId: c.state.Get(IdentifierEgressOnlyInternetGateway),
 			})
+			routes = append(routes, &awsclient.Route{
+				DestinationIpv6CidrBlock: ptr.To(nat64Prefix),
+				NatGatewayId:             child.Get(IdentifierZoneNATGateway),
+			})
 		}
 
 		desired := &awsclient.RouteTable{

diff --git a/pkg/controller/infrastructure/templates/main.tpl.tf b/pkg/controller/infrastructure/templates/main.tpl.tf
@@ -181,6 +181,7 @@ resource "aws_subnet" "nodes_z{{ $index }}" {
   availability_zone = "{{ $zone.name }}"
 
   {{ if $.isIPv6 }}
+  enable_dns64 = true
   ipv6_native = true
   assign_ipv6_address_on_creation = true
   ipv6_cidr_block = "${cidrsubnet({{ $.vpc.ipv6CidrBlock }}, 8, (({{ $index }} * 3)))}"
@@ -344,6 +345,16 @@ resource "aws_route" "private_utility_z{{ $index }}_nat" {
 }
 
 {{- if $.isIPv6 }}
+resource "aws_route" "private_utility_z{{ $index }}_nat_64" {
+  route_table_id         = aws_route_table.routetable_private_utility_z{{ $index }}.id
+  destination_ipv6_cidr_block  = "64:ff9b::/96"
+  nat_gateway_id         = aws_nat_gateway.natgw_z{{ $index }}.id
+
+  timeouts {
+    create = "5m"
+  }
+}
+
 resource "aws_route" "private_utility_z{{ $index }}_egw" {
   route_table_id         = aws_route_table.routetable_private_utility_z{{ $index }}.id
   destination_ipv6_cidr_block = "::/0"

diff --git a/test/integration/infrastructure/infrastructure_test.go b/test/integration/infrastructure/infrastructure_test.go
@@ -826,6 +826,7 @@ func verifyCreation(
 		sshPublicKeyDigest = "46:ca:46:0e:8e:1d:bc:0c:45:31:ee:0f:43:5f:9b:f1"
 		allCIDR            = "0.0.0.0/0"
 		allCIDRIPV6        = "::/0"
+		nat64Prefix        = "64:ff9b::/96"
 	)
 
 	var (
@@ -1357,6 +1358,13 @@ func verifyCreation(
 						}
 					}
 
+					expectedRoutes = append(expectedRoutes, &ec2.Route{
+						DestinationIpv6CidrBlock: awssdk.String(nat64Prefix),
+						NatGatewayId:             describeNatGatewaysOutput.NatGateways[0].NatGatewayId,
+						Origin:                   awssdk.String("CreateRoute"),
+						State:                    awssdk.String("active"),
+					})
+
 					expectedRoutes = append(expectedRoutes, &ec2.Route{
 						DestinationIpv6CidrBlock:    awssdk.String(allCIDRIPV6),
 						EgressOnlyInternetGatewayId: eoigs[0].EgressOnlyInternetGatewayId,