Skip to main content
In this guide, we’ll dive into how IPv6 works in Amazon EKS when using the AWS VPC CNI plugin. By enabling IPv6 at VPC creation time, you get a dual-stack VPC (IPv4 + IPv6). As AWS services continue to evolve, IPv6-only VPCs are not yet supported, so you must use dual-stack.
The image illustrates the concept of visualizing IPv6 addresses within a dual-stack VPC, showing components like a node, RDS database, and S3 bucket, with IPv6 enabled.

​
Dual-Stack VPC and Prefix Delegation

When IPv6 is enabled on your VPC (and on your EKS cluster):
  • Each worker node’s primary ENI gets one IPv4 and one IPv6 address.
  • Kubernetes uses Prefix Delegation to hand out a /80 IPv6 block to each node.
    That /80 block contains ~2.8 × 10^14 addresses—orders of magnitude more than all IPv4 addresses on the Internet.
The image illustrates the concept of visualizing IPv6 addresses within an EKS Cluster, showing a dual-stack VPC with both IPv4 and IPv6 capabilities, and highlighting the availability of 100 trillion IP addresses.

​
Pod Networking and NAT64 Translation

By design, EKS Pods are single-stack IPv6: they only receive an IPv6 address. To reach IPv4-only endpoints:
  1. Pod sends an IPv6 request.
  2. Node DNS resolves the target to an IPv4 address.
  3. The node SNATs the traffic using its IPv4 ENI.
  4. Responses come back over IPv4 and are mapped to the Pod’s IPv6.
All IPv6-to-IPv4 translation uses link-local addresses (169.254.0.0/16 via veth*). If the destination has native IPv6, traffic flows directly over the IPv6 ENI.
The image illustrates the concept of visualizing IPv6 addresses within a dual-stack VPC, showing a node with a pod connected to an ENI, supporting both IPv4 and IPv6.
Pods accessing IPv4 services share the same node-level IPv4 address and NAT connections. This can become a throughput bottleneck at scale—plan accordingly.

​
Egress-Only IPv6 Traffic

Since IPv6 addresses are globally unique, you generally don’t need SNAT or NAT Gateways for Pod-to-Pod or outbound traffic. To control outbound IPv6:
AWS does not offer an ingress-only IPv6 gateway. Control incoming IPv6 traffic with Security Groups or Network ACLs.
The image is a diagram illustrating the visualization of an IPv6 address, showing connections between IPv4, IPv6, and IPv6/80 through an ENI (Elastic Network Interface).

​
1. Creating a Dual-Stack EKS Cluster

Use eksdemo, eksctl, or the AWS CLI to spin up a dual-stack EKS cluster:
Verify your nodes:
You should see each node’s IPv6 under INTERNAL-IP. Deploy a test Pod and inspect its IP:
The Pod’s IP will be in IPv6 format.

​
2. Examining Node Interfaces

SSH into a node and list its interfaces:
Example eth0 output:
Link-local Pod interfaces (veth*) will show both 169.254.x.x/32 and fe80::/64.

​
IPv4 Routes

​
IPv6 Routes

​
3. Inspecting IPv6 Prefix Delegation

To view the /80 prefixes assigned to each node, run:
Example output:
Each node receives a /80 (~280 trillion addresses) for Pod allocation—IP exhaustion is no longer a concern.

​
Conclusion

Enabling IPv6 in Amazon EKS provides a virtually unlimited address space per node. Although Pods today are single-stack IPv6, understanding NAT64 translation and potential NAT bottlenecks is key to designing large-scale, dual-stack clusters.

Watch Video