Make vpc-cni and kube-proxy optional when creating IPv6 clusters

[41ks]

Description

The initial implementation of IPv6 cluster creation assumed a requirement for AWS VPC CNI and Kube Proxy. As other CNI/proxy solutions add support for IPv6, this change removes the requirement for the 2 above addons when creating IPv6 clusters. It also removes the requirement to use OIDC if vpc-cni is not in use.

I came across this as part of my work on supporting IPv6 in the Cilium ENI IPAM mode, which is tracked in cilium/cilium#18405. This support was released in Cilium 1.20. A lot of users using EKS + Cilium rely on eksctl to configure their clusters. Even the Cilium project relies on it to set up CI conformance testing. As such, having AWS VPC CNI, which conflicts with Cilium's own CNI and IPAM, as a hard requirement when creating IPv6 clusters is a significant blocker for adoption.

I have manually verified that creating an IPv6 cluster without the kube-proxy and vpc-cni addons is possible, meaning those requirements are only present in the validation in eksctl. Even CoreDNS doesn't seem to be a strict requirement. However, this does not conflict with Cilium, so I left it as is.

I also successfully built and ran eksctl with this cluster configuration :

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: eks-ipv6-eni
  region: eu-north-1
  version: "1.35"

vpc:
  clusterEndpoints:
    publicAccess: true
    privateAccess: true

addonsConfig:
  disableDefaultAddons: true
addons:
- name: coredns
- name: kube-proxy

kubernetesNetworkConfig:
  ipFamily: IPv6

After this, I created a managed nodegroup with an IAM role containing the default node permissions plus an AssignIpv6Addresses permission. Then I ran this to install Cilium:

cilium install --version "v1.20.0" \
  --set kubeProxyReplacement=true \
  --set ipv6.enabled=true \
  --set ipv4.enabled=false \
  --set MTU=9001 \
  --set endpointHealthChecking.enabled=false \
  --set healthChecking=false \
  --set enableIPv6Masquerade=false

With this was done, connectivity was working as expected with pods getting IPv6 addresses assigned by Cilium.

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the userdocs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes
• (Core team) Added labels for change area (e.g. area/nodegroup) and kind (e.g. kind/improvement)

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟

[github-actions]

Hello 41ks 👋 Thank you for opening a Pull Request in eksctl project. The team will review the Pull Request and aim to respond within 1-10 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website