NE-2421: Support dual-stack IngressController on AWS

Configure the publishing load balancer service for dual-stack AWS
clusters based on the Infrastructure CR's ipFamily field
(status.platformStatus.aws.ipFamily).

For NLB-type load balancers, set ipFamilyPolicy to RequireDualStack
and ipFamilies to match the cluster's IP family ordering. For CLB,
explicitly set SingleStack/IPv4 since CLB only forwards IPv4 traffic.
Without this, DualStackIPv6Primary clusters would default the CLB
service to SingleStack/IPv6, causing OVN to refuse IPv4 traffic on
the service's NodePort.

When the cluster IP family is dual-stack, the AWS DNS provider creates
both Alias A and Alias AAAA Route53 records for IngressController
wildcard domains. AAAA records are always created regardless of LB
type because stale AAAA records cannot be easily cleaned up when the
LB type changes from NLB to CLB — the old NLB is deleted before the
new CLB is created, so the DNS provider can no longer look up the
target hostname to delete the AAAA record. For CLBs the AAAA alias
simply won't resolve.

When the LB type is changed to CLB on a dual-stack cluster, a warning
note is appended to the effectuation message on the cluster operator
status indicating that CLBs do not support dual-stack.

Co-authored-by: Claude claude-opus-4-6 <noreply@anthropic.com>

Author: alebedev87

pkg/dns/aws/dns.go

@@ -11,6 +11,7 @@ import (
 	iov1 "github.com/openshift/api/operatoringress/v1"
 	"github.com/openshift/cluster-ingress-operator/pkg/dns"
 	logf "github.com/openshift/cluster-ingress-operator/pkg/log"
+	awsutil "github.com/openshift/cluster-ingress-operator/pkg/util/aws"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
@@ -109,6 +110,11 @@ type Config struct {
 	// Client is a Kubernetes client, which the provider uses to annotate
 	// DNSRecord CRs.
 	Client client.Client
+
+	// IPFamily is the cluster's IP family configuration from the
+	// Infrastructure CR. When dual-stack, the provider creates both
+	// Alias A and Alias AAAA Route53 records.
+	IPFamily configv1.IPFamilyType
 }
 
 // ServiceEndpoint stores the configuration of a custom url to
@@ -619,22 +625,34 @@ func (m *Provider) updateRecord(domain, zoneID, target, targetHostedZoneID, acti
 			},
 		}
 	} else {
-		input.ChangeBatch = &route53.ChangeBatch{
-			Changes: []*route53.Change{
-				{
-					Action: aws.String(action),
-					ResourceRecordSet: &route53.ResourceRecordSet{
-						Name: aws.String(domain),
-						Type: aws.String(route53.RRTypeA),
-						AliasTarget: &route53.AliasTarget{
-							HostedZoneId:         aws.String(targetHostedZoneID),
-							DNSName:              aws.String(target),
-							EvaluateTargetHealth: aws.Bool(false),
-						},
-					},
+		aliasTarget := &route53.AliasTarget{
+			HostedZoneId:         aws.String(targetHostedZoneID),
+			DNSName:              aws.String(target),
+			EvaluateTargetHealth: aws.Bool(false),
+		}
+		changes := []*route53.Change{
+			{
+				Action: aws.String(action),
+				ResourceRecordSet: &route53.ResourceRecordSet{
+					Name:        aws.String(domain),
+					Type:        aws.String(route53.RRTypeA),
+					AliasTarget: aliasTarget,
 				},
 			},
 		}
+		if awsutil.IsDualStack(m.config.IPFamily) {
+			changes = append(changes, &route53.Change{
+				Action: aws.String(action),
+				ResourceRecordSet: &route53.ResourceRecordSet{
+					Name:        aws.String(domain),
+					Type:        aws.String(route53.RRTypeAaaa),
+					AliasTarget: aliasTarget,
+				},
+			})
+		}
+		input.ChangeBatch = &route53.ChangeBatch{
+			Changes: changes,
+		}
 	}
 	resp, err := m.route53.ChangeResourceRecordSets(&input)
 	if err != nil {

pkg/operator/controller/dns/controller.go

@@ -594,8 +594,9 @@ func (r *reconciler) createDNSProvider(dnsConfig *configv1.DNS, platformStatus *
 	switch platformStatus.Type {
 	case configv1.AWSPlatformType:
 		cfg := awsdns.Config{
-			Region: platformStatus.AWS.Region,
-			Client: r.client,
+			Region:   platformStatus.AWS.Region,
+			IPFamily: platformStatus.AWS.IPFamily,
+			Client:   r.client,
 		}
 
 		sharedCredsFile, err := awsutil.SharedCredentialsFileFromSecret(creds)

pkg/operator/controller/ingress/load_balancer_service.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/openshift/cluster-ingress-operator/pkg/manifests"
 	"github.com/openshift/cluster-ingress-operator/pkg/operator/controller"
+	awsutil "github.com/openshift/cluster-ingress-operator/pkg/util/aws"
 	corev1 "k8s.io/api/core/v1"
 
 	configv1 "github.com/openshift/api/config/v1"
@@ -496,6 +497,32 @@ func desiredLoadBalancerService(ci *operatorv1.IngressController, deploymentRef
 				}
 			}
 
+			// Set ipFamilies and ipFamilyPolicy for dual-stack clusters.
+			if platform.AWS != nil && awsutil.IsDualStack(platform.AWS.IPFamily) {
+				if isAWSNLB(lbStatus) {
+					// NLB supports dual-stack natively.
+					ipFamilyPolicy := corev1.IPFamilyPolicyRequireDualStack
+					service.Spec.IPFamilyPolicy = &ipFamilyPolicy
+					if platform.AWS.IPFamily == configv1.DualStackIPv4Primary {
+						service.Spec.IPFamilies = []corev1.IPFamily{corev1.IPv4Protocol, corev1.IPv6Protocol}
+					} else {
+						service.Spec.IPFamilies = []corev1.IPFamily{corev1.IPv6Protocol, corev1.IPv4Protocol}
+					}
+				} else {
+					// CLB does not support dual-stack and only forwards
+					// IPv4 traffic. On DualStackIPv4Primary clusters,
+					// the service defaults to SingleStack/IPv4, which
+					// is correct. However on DualStackIPv6Primary, the
+					// default would be SingleStack/IPv6, causing OVN to
+					// refuse IPv4 traffic on the service's NodePort.
+					// Explicitly set SingleStack/IPv4 to ensure CLB
+					// traffic is always accepted.
+					ipFamilyPolicy := corev1.IPFamilyPolicySingleStack
+					service.Spec.IPFamilyPolicy = &ipFamilyPolicy
+					service.Spec.IPFamilies = []corev1.IPFamily{corev1.IPv4Protocol}
+				}
+			}
+
 			// Set the load balancer for AWS to be as aggressive as Azure (2 fail @ 5s interval, 2 healthy)
 			service.Annotations[awsLBHealthCheckTimeoutAnnotation] = awsLBHealthCheckTimeoutDefault
 			service.Annotations[awsLBHealthCheckUnhealthyThresholdAnnotation] = awsLBHealthCheckUnhealthyThresholdDefault
@@ -715,6 +742,27 @@ func loadBalancerServiceChanged(current, expected *corev1.Service) (bool, *corev
 		}
 	}
 
+	// Reconcile ipFamilies and ipFamilyPolicy when the desired service
+	// specifies them (i.e. the cluster is dual-stack).
+	if len(expected.Spec.IPFamilies) != 0 {
+		if !reflect.DeepEqual(current.Spec.IPFamilies, expected.Spec.IPFamilies) {
+			if !changed {
+				changed = true
+				updated = current.DeepCopy()
+			}
+			updated.Spec.IPFamilies = expected.Spec.IPFamilies
+		}
+	}
+	if expected.Spec.IPFamilyPolicy != nil {
+		if current.Spec.IPFamilyPolicy == nil || *current.Spec.IPFamilyPolicy != *expected.Spec.IPFamilyPolicy {
+			if !changed {
+				changed = true
+				updated = current.DeepCopy()
+			}
+			updated.Spec.IPFamilyPolicy = expected.Spec.IPFamilyPolicy
+		}
+	}
+
 	return changed, updated
 }
 
@@ -858,6 +906,10 @@ func loadBalancerServiceIsProgressing(ic *operatorv1.IngressController, service
 		if wantLBType != haveLBType {
 			patchSpec := fmt.Sprintf(`{"spec":{"endpointPublishingStrategy":{"type":"LoadBalancerService","loadBalancer":{"providerParameters":{"type":"AWS","aws":{"type":"%s"}}}}}}`, haveLBType)
 			err := createEffectuationMessage("loadBalancer.providerParameters.aws.type", string(haveLBType), string(wantLBType), patchSpec, ic, service)
+			// Add a note to the effectuation message about CLB not supporting dual-stack.
+			if wantLBType == operatorv1.AWSClassicLoadBalancer && platform.AWS != nil && awsutil.IsDualStack(platform.AWS.IPFamily) {
+				err = fmt.Errorf("%w Classic Load Balancers do not support dual-stack. The IngressController %q will use IPv4-only despite that the cluster is configured as %q. Use an NLB type to support dual-stack networking.", err, ic.Name, platform.AWS.IPFamily)
+			}
 			errs = append(errs, err)
 		}
 
@@ -1386,3 +1438,13 @@ func getAllowedSourceRanges(eps *operatorv1.EndpointPublishingStrategy) []operat
 
 	return nil
 }
+
+// isAWSNLB returns true if the IngressController's load balancer status
+// indicates an AWS Network Load Balancer.
+func isAWSNLB(lbStatus *operatorv1.LoadBalancerStrategy) bool {
+	return lbStatus != nil &&
+		lbStatus.ProviderParameters != nil &&
+		lbStatus.ProviderParameters.Type == operatorv1.AWSLoadBalancerProvider &&
+		lbStatus.ProviderParameters.AWS != nil &&
+		lbStatus.ProviderParameters.AWS.Type == operatorv1.AWSNetworkLoadBalancer
+}