Summary

  • Spiro Stathakis set isp6’s order platform on IPv6-first EKS, yet its initial /28 IPv4 subnets could not hold the node and dual-stack endpoint interfaces.
  • The team expanded to /27 public and /26 private subnets. EKS gives the pods IPv6, but the surrounding platform still spends IPv4 addresses and can fall back to IPv4 traffic.

The smallest IPv4 subnet available in AWS sounds like a tidy place to park a protocol you intend to outgrow. Spiro Stathakis tried that. His first-person RIPE Labs account says isp6 put its order-management platform on EKS with ipFamily: ipv6, brought its own IPv6 allocation, and gave the remaining IPv4 side a /28. The address plan lasted until the actual interfaces arrived.

The arithmetic was sharp before a pod did any work. AWS reserves five addresses in every IPv4 subnet: the first four and the last. A /28 contains 16 addresses, leaving 11 usable. Stathakis says node primary interfaces and the network interfaces for dual-stack service endpoints consumed that small pool. He reports growing the public subnets to /27 and the private ones to /26. Those are his deployment sizes, not a universal EKS prescription. He does not publish a dated ENI inventory, so the exact count per subnet is still missing.

The label “IPv6 cluster” describes one boundary, not the entire machine. AWS’s EKS documentation assigns IPv6 to pods and services in this mode. For an IPv4-only destination, the pod also has a host-local IPv4 address; the VPC CNI translates its source to the node’s primary IPv4 address. That compatibility path lets an application keep working while its packets use the old network. The cluster’s IP family is chosen at creation and cannot be changed later. The decision to go IPv6 first is durable; the IPv4 footprint beneath it is negotiated with every dependency.

Stathakis’s account names the other bill. His team kept one NAT gateway for destinations that still required IPv4. It restricted certain dual-stack AWS service endpoints to IPv6 on port 443, so a client choosing an A record would fail rather than quietly use IPv4. NAT flow logs revealed which requests were still on the fallback path. He did not present those logs or a current topology export, so a dated subnet inventory and flow-log sample would change how precisely we can size the residual IPv4 load.

The case is useful because the compromise is visible. A company selling IPv6 adoption can give its pods IPv6 addresses from its own allocation and still have a cloud platform reserve IPv4 capacity for nodes, endpoints and legacy egress. The /28 was a statement of intent. The ENIs were the invoice.