Ipv6 daemon support #4853

JoseVillalta · 2026-01-29T20:12:47Z

Summary

Add IPv6 support for daemon-bridge network mode in managed Linux platform. This enables ECS managed daemons to operate on IPv6-only and dual-stack EC2 instances.

Implementation details

IPv6 Networking Configuration for Managed Daemon Namespaces:

Added IPv6 sysctl settings for IP forwarding on managed daemon namespaces
Added ip6tables NAT masquerade rules for IPv6 external connectivity
Added IPv6 subnet (fd00:ec2::172:0/112) and gateway (fd00:ec2::172:1) constants for daemon-bridge
Updated createDaemonBridgePluginConfig to configure IPv6 subnet and gateway when host is IPv6 compatible
Bridge now gets both IPv4 (169.254.172.1/22) and IPv6 addresses on IPv6-capable hosts

IP Compatibility Detection:

Platform APIs now detect host IP compatibility (IPv4-only, IPv6-only, dual-stack) from EC2 metadata
Routes are configured based on detected IP compatibility:
- IPv4-only: IPv4 default route only
- IPv6-only: IPv6 default route only (no IPv4 default route)
- Dual-stack: Both IPv4 and IPv6 default routes
ECS credentials endpoint route (169.254.170.2/32) is always configured via IPv4 link-local

E2E Tests:

Added daemon_bridge_e2e_test.go for direct CNI plugin invocation testing
Added managed_linux_daemon_e2e_test.go for platform API integration testing
Tests validate IPv4-only, IPv6-only, and dual-stack configurations
Tests use real EC2 metadata from IMDS and must run on actual EC2 instances

Testing

Unit tests updated in cniconf_linux_test.go to verify IPv6 subnet configuration
E2E tests run on remote EC2 instances:
All existing unit tests continue to pass

New tests cover the changes: yes

Description for the changelog

netlib: Add IPv6 support for daemon-bridge network mode on managed Linux platform

Additional Information

Does this PR include breaking model changes? If so, Have you added transformation functions?

No breaking model changes.

Does this PR include the addition of new environment variables in the README?

No new environment variables.

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Release 1.101.2

Extend daemon bridge network namespace configuration to support IPv6 default routes when the host is IPv6-compatible. This enables IPv4-only, IPv6-only, and dual-stack networking scenarios for daemon namespaces. Changes: - Add IPv6 fields to IPAMConfig struct (IPV6Subnet, IPV6Address, IPV6Gateway, IPV6Routes) - Add IPv6 constants (DefaultRouteDestinationIPv6, DaemonBridgeGatewayIPv6) - Update createDaemonBridgePluginConfig to accept IP compatibility and configure routes based on IPv4/IPv6/dual-stack mode - Update configureDaemonNetNS and StopDaemonNetNS to pass IP compatibility - Add comprehensive unit tests and property-based tests

Add IPv6 subnet configuration for daemon-bridge network mode: - Add ECSSubNetIPv6 (fd00:ec2::172:0/112) and DaemonBridgeGatewayIPv6 constants - Update createDaemonBridgePluginConfig to set IPV6Subnet and IPV6Gateway when host is IPv6 compatible - Update unit tests to verify IPv6 subnet configuration Add E2E tests for daemon-bridge networking: - daemon_bridge_e2e_test.go: Direct CNI plugin invocation tests - managed_linux_daemon_e2e_test.go: Platform API integration tests - Tests validate IPv4-only, IPv6-only, and dual-stack configurations - Add skipIfNotIPv6OnlyE2E helper for IPv6-only test scenarios The IPv6 subnet uses ULA address space (fd00:ec2::) which mirrors the IPv4 link-local subnet (169.254.172.0/22) for internal ECS communication.

aviral92

There are 8 commits in this PR, is this expected? just wanted to confirm that we are looking at the right set of changes.

JoseVillalta · 2026-01-29T22:11:17Z

There are 8 commits in this PR, is this expected? just wanted to confirm that we are looking at the right set of changes.

Yes.

xxx0624 · 2026-01-29T21:18:29Z

ecs-agent/netlib/model/ecscni/ipam_config_property_test.go

+// For any valid IPAMConfig with IPv6 fields populated (IPV6Subnet, IPV6Address, IPV6Gateway, IPV6Routes),
+// serializing to JSON and deserializing back SHALL produce an equivalent IPAMConfig object.
+//
+// **Validates: Requirements 1.5**


nit - can we have the requirement details?

xxx0624 · 2026-01-29T21:19:30Z

ecs-agent/netlib/model/ecscni/ipam_config_property_test.go

+//
+// **Validates: Requirements 1.5**
+func TestProperty_IPAMConfigIPv6JSONSerializationRoundTrip(t *testing.T) {
+	f := func(


nit: can we have a meaningful func name? or some comments?

xxx0624 · 2026-01-29T21:21:24Z

ecs-agent/netlib/model/ecscni/ipam_config_property_test.go

+		if err != nil {
+			// If marshaling fails, this is a valid failure case
+			// (e.g., invalid data that can't be serialized)
+			return true


Q - this comment is true but wondering if that is true for this function?

xxx0624 · 2026-01-29T21:23:05Z

ecs-agent/netlib/model/ecscni/ipam_config_property_test.go

+		}
+
+		// Verify equivalence of IPv6 fields
+		if original.IPV6Subnet != deserialized.IPV6Subnet {


non-blocking: is there any reason to use if for these checks below instead of assert or require

xxx0624 · 2026-01-29T21:48:18Z

ecs-agent/netlib/platform/cniconf_linux_property_test.go

+// the daemon bridge plugin configuration SHALL always include the IPv4 route to
+// the ECS agent endpoint (169.254.170.2/32) in the IPv4Routes field.
+//
+// **Validates: Requirements 3.2, 5.1, 5.2, 5.3**


Seems from AI?

xxx0624 · 2026-01-29T21:49:18Z

ecs-agent/netlib/platform/cniconf_linux_property_test.go

+// TestProperty_ECSAgentEndpointRouteInvariant_AllConfigurations tests the property
+// exhaustively for all three valid IP compatibility configurations.
+//
+// Feature: daemon-bridge-ipv6-support, Property 2: ECS Agent Endpoint Route Invariant


Same. Looks it's good to remove these or have more details.

xxx0624 · 2026-01-29T21:54:16Z

ecs-agent/netlib/platform/iptables_linux.go

+
+		// Also enable forwarding on specific interfaces if needed
+		if err := enableSysctlSetting("net.ipv6.conf.eth0.forwarding", "1"); err != nil {
+			logger.Warn("Failed to enable IPv6 forwarding on eth0", logger.Fields{


What could happen if we failed to enable this?

xxx0624 · 2026-01-29T22:21:50Z

ecs-agent/netlib/platform/managed_linux.go

+// It checks if the primary interface has IPv4 and/or IPv6 addresses configured.
+func (m *managedLinux) getIPCompatibilityFromNetNS(netNS *tasknetworkconfig.NetworkNamespace) ipcompatibility.IPCompatibility {
+	primaryIface := netNS.GetPrimaryInterface()
+	if primaryIface == nil {


Do we know if this can happen?

Can we have a log for this special case?

singholt and others added 7 commits January 12, 2026 14:58

run-integ-tests.ps1: add windows2025 to the ValidateSet

f5e22f3

Merge pull request aws#4841 from prateekchaudhry/v1.101.2-stage

735c676

Release 1.101.2

adds sysctl ipForwading key for ipv6 for Managed Daemons

1b189ba

use ip6tables in NAT for IPv6

bd5b0ad

updates CNI version

a98e9cd

JoseVillalta requested a review from a team as a code owner January 29, 2026 20:12

JoseVillalta added the bot/test label Jan 29, 2026

amazon-ecs-bot removed the bot/test label Jan 29, 2026

TheanLim added the bot/test label Jan 29, 2026

amazon-ecs-bot removed the bot/test label Jan 29, 2026

Update Go modules and vendor directories to match workflow requirements

e381883

JoseVillalta self-assigned this Jan 29, 2026

JoseVillalta requested review from aviral92 and xxx0624 January 29, 2026 21:09

JoseVillalta changed the title ~~Ipv6 daemon fix WIP do not merge yet~~ Ipv6 daemon support Jan 29, 2026

aviral92 reviewed Jan 29, 2026

View reviewed changes

JoseVillalta requested a review from aviral92 January 29, 2026 22:09

xxx0624 reviewed Jan 29, 2026

View reviewed changes

JoseVillalta added the bot/test label Jan 30, 2026

amazon-ecs-bot removed the bot/test label Jan 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ipv6 daemon support #4853

Ipv6 daemon support #4853

JoseVillalta commented Jan 29, 2026 •

edited

Loading

Uh oh!

aviral92 left a comment

Uh oh!

JoseVillalta commented Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

xxx0624 Jan 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Ipv6 daemon support #4853

Are you sure you want to change the base?

Ipv6 daemon support #4853

Conversation

JoseVillalta commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation details

Testing

Description for the changelog

Additional Information

Licensing

Uh oh!

aviral92 left a comment

Choose a reason for hiding this comment

Uh oh!

JoseVillalta commented Jan 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

JoseVillalta commented Jan 29, 2026 •

edited

Loading