The following targets cannot be used with this IPv6 target group because of missing primary IPv6 addresses

[kaykhan]

I have provisioned a test k8s cluster using `https://github.com/terraform-aws-modules/terraform-aws-eks i am trying to expose an example service externally using https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.7/

However im getting the following error:

The following targets cannot be used with this IPv6 target group because of missing primary IPv6 addresses

{"level":"error","ts":"2024-05-13T10:04:00Z","msg":"Reconciler error","controller":"targetGroupBinding","controllerGroup":"elbv2.k8s.aws","controllerKind":"TargetGroupBinding","TargetGroupBinding":{"name":"k8s-echoserv-echoserv-a104e9d027","namespace":"echoserver"},"namespace":"echoserver","name":"k8s-echoserv-echoserv-a104e9d027","reconcileID":"eeb07b44-8529-4196-9d3a-27a23b487d3a","error":"InvalidTarget: The following targets cannot be used with this IPv6 target group because of missing primary IPv6 addresses: i-09ec9f135d3d2c537', 'i-078902b4d1174b6aa', 'i-0a108ad067bac1820', 'i-035e6893ce492052d\n\tstatus code: 400, request id: 7bedf7f7-d2a2-4219-8155-0637b85083ea"}

Would appreciate if someone could help me understand this.

It looks like there is a setting to enable Assign primary IPv6 IP under EC2 -> Netowrking -> Manage IP Addresses. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html?icmpid=docs_ec2_console#managing-network-interface-ip-addresses

Should this be enabled on the ec2 instances?

apiVersion: v1
kind: Namespace
metadata:
  name: echoserver
---
apiVersion: v1
kind: Service
metadata:
  name: echoserver4
  namespace: echoserver
spec:
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP
  type: NodePort
  selector:
    app: echoserver4
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: echoserver4
  namespace: echoserver
spec:
  selector:
    matchLabels:
      app: echoserver4
  replicas: 1
  template:
    metadata:
      labels:
        app: echoserver4
    spec:
      containers:
      - image: k8s.gcr.io/e2e-test-images/echoserver:2.5
        imagePullPolicy: Always
        name: echoserver4
        ports:
        - containerPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echoserver4
  namespace: echoserver
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/tags: Environment=dev,Team=test
    alb.ingress.kubernetes.io/ip-address-type: dualstack
spec:
  ingressClassName: alb
  rules:
    - host: echoserver4.acme-test.com
      http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: echoserver4
                port:
                  number: 80

[wweiwei-li]

Yes, to use IPv6 target group. your instances should have primary IPv6 address. This should be enabled on the ec2 instances side. The setting to enable Assign primary IPv6 IP is under EC2 -> Netowrking -> Manage IP Addresses -> enable Assign primary ipv6

[michal-sa]

@kaykhan did you solve this with terraform and the EKS module somehow? I'm currently encountering the same issues but can't find any way to enable it through IaC.

[kaykhan]

@kaykhan did you solve this with terraform and the EKS module somehow? I'm currently encountering the same issues but can't find any way to enable it through IaC.

H @michal-sa I yes i managed to resolve this when using ipv6 the target-type cannot be instance and must instead be ip

https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/guide/ingress/annotations/#target-type

https://aws.amazon.com/blogs/containers/amazon-eks-launches-ipv6-support/

ALB and NLB in the current phase of their IPv6 support allow dual-stack for internet-facing (frontend) endpoints. Both IPv4 and IPv6 clients can connect to NLB or ALB in dual-mode. EKS IPv6 clusters provision ALB and NLB in dual stack IP mode when you add an annotation service.beta.kubernetes.io/aws-load-balancer-ip-address-type: dualstack to your service or ingress manifests. NLB and ALB use target types to define the destination targets. As of today, you can configure the ingress type with the annotation alb.ingress.kubernetes.io/target-type: ip only. Targets of type instance are not supported.

working example (assumes your cluster is setup correctly):

apiVersion: v1
kind: Namespace
metadata:
  name: echoserver
---
apiVersion: v1
kind: Service
metadata:
  name: echoserver
  namespace: echoserver
spec:
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP
  type: NodePort
  selector:
    app: echoserver
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: echoserver
  namespace: echoserver
spec:
  selector:
    matchLabels:
      app: echoserver
  replicas: 3
  template:
    metadata:
      labels:
        app: echoserver
    spec:
      containers:
      - image: k8s.gcr.io/e2e-test-images/echoserver:2.5
        imagePullPolicy: Always
        name: echoserver
        ports:
        - containerPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echoserver
  namespace: echoserver
  labels:
    app: echoserver
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/tags: Environment=dev,Team=test
    alb.ingress.kubernetes.io/ip-address-type: dualstack
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: <YOUR CERT>
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80,"HTTPS": 443}]'
    alb.ingress.kubernetes.io/healthcheck-path: /health
    alb.ingress.kubernetes.io/ssl-redirect: '443'
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-2-Ext-2018-06
spec:
  ingressClassName: alb
  rules:
    - host: echoserver.<YOUR_DOMAIN>.com
      http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: echoserver
                port:
                  number: 80

[michal-sa]

Thank you for the really fast response @kaykhan :smile: It worked just fine to change it to the ip type. Missed that part in the blog.

[kaykhan]

Thank you for the really fast response @kaykhan 😄 It worked just fine to change it to the ip type. Missed that part in the blog.

you're welcome, yes its quite easy to miss.