Allow migration from dual-stack [IPv4, IPv6] to single stack [IPv4] networking

pkg/controller/controlplane/valuesprovider.go

@@ -45,6 +45,7 @@ import (
 	apisaws "github.com/gardener/gardener-extension-provider-aws/pkg/apis/aws"
 	"github.com/gardener/gardener-extension-provider-aws/pkg/apis/aws/helper"
 	"github.com/gardener/gardener-extension-provider-aws/pkg/aws"
+	"github.com/gardener/gardener-extension-provider-aws/pkg/utils"
 )
 
 const (
@@ -720,7 +721,7 @@ func getIPAMChartValues(
 		"nodeCIDRMaskSizeIPv6": nodeCidrMaskSizeIPv6,
 		"useWorkloadIdentity":  useWorkloadIdentity,
 	}
-	enabled := mode != "ipv4"
+	enabled := mode != "ipv4" || utils.HasIPv6NodeCIDR(cluster)
 	if !enabled {
 		values["replicas"] = 0
 	}
@@ -856,7 +857,9 @@ func getControlPlaneShootChartValues(
 		*cpConfig.CloudControllerManager.UseCustomRouteController
 
 	ipamControllerEnabled := false
-	if networkingConfig := cluster.Shoot.Spec.Networking; networkingConfig != nil && slices.Contains(networkingConfig.IPFamilies, v1beta1.IPFamilyIPv6) {
+	if networkingConfig := cluster.Shoot.Spec.Networking; networkingConfig != nil &&
+		(slices.Contains(networkingConfig.IPFamilies, v1beta1.IPFamilyIPv6) ||
+			utils.HasIPv6NodeCIDR(cluster)) {
 		ipamControllerEnabled = true
 	}
 

pkg/controller/controlplane/valuesprovider_test.go

@@ -198,6 +198,11 @@ var _ = Describe("ValuesProvider", func() {
 						Version: "1.29.0",
 					},
 				},
+				Status: gardencorev1beta1.ShootStatus{
+					Networking: &gardencorev1beta1.NetworkingStatus{
+						Nodes: []string{"1.2.3.4/24"},
+					},
+				},
 			},
 		}
 

pkg/utils/iputil.go

@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+package utils
+
+import (
+	"net"
+
+	extensionscontroller "github.com/gardener/gardener/extensions/pkg/controller"
+)
+
+// IsIPv6CIDR checks if a CIDR string represents an IPv6 network
+func IsIPv6CIDR(cidr string) bool {
+	_, ipNet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return false
+	}
+	return ipNet.IP.To4() == nil
+}
+
+// HasIPv6NodeCIDR returns true if any node CIDR in the cluster is IPv6.
+func HasIPv6NodeCIDR(cluster *extensionscontroller.Cluster) bool {
+	if cluster == nil || cluster.Shoot == nil || cluster.Shoot.Status.Networking == nil {
+		return false
+	}
+	for _, cidr := range cluster.Shoot.Status.Networking.Nodes {
+		if IsIPv6CIDR(cidr) {
+			return true
+		}
+	}
+	return false
+}

pkg/utils/iputil_test.go

@@ -0,0 +1,69 @@
+// SPDX-FileCopyrightText: SAP SE or an SAP affiliate company and Gardener contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	extensionscontroller "github.com/gardener/gardener/extensions/pkg/controller"
+	gardencorev1beta1 "github.com/gardener/gardener/pkg/apis/core/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("iputil", func() {
+	Describe("IsIPv6CIDR", func() {
+		It("should return true for valid IPv6 CIDR", func() {
+			Expect(IsIPv6CIDR("2001:db8::/64")).To(BeTrue())
+		})
+
+		It("should return false for valid IPv4 CIDR", func() {
+			Expect(IsIPv6CIDR("192.168.0.0/24")).To(BeFalse())
+		})
+
+		It("should return false for invalid CIDR", func() {
+			Expect(IsIPv6CIDR("invalid-cidr")).To(BeFalse())
+		})
+	})
+
+	Describe("HasIPv6NodeCIDR", func() {
+		It("should return true if any node CIDR is IPv6", func() {
+			cluster := &extensionscontroller.Cluster{
+				Shoot: &gardencorev1beta1.Shoot{
+					Status: gardencorev1beta1.ShootStatus{
+						Networking: &gardencorev1beta1.NetworkingStatus{
+							Nodes: []string{"192.168.0.0/24", "2001:db8::/64"},
+						},
+					},
+				},
+			}
+			Expect(HasIPv6NodeCIDR(cluster)).To(BeTrue())
+		})
+
+		It("should return false if all node CIDRs are IPv4", func() {
+			cluster := &extensionscontroller.Cluster{
+				Shoot: &gardencorev1beta1.Shoot{
+					Status: gardencorev1beta1.ShootStatus{
+						Networking: &gardencorev1beta1.NetworkingStatus{
+							Nodes: []string{"192.168.0.0/24"},
+						},
+					},
+				},
+			}
+			Expect(HasIPv6NodeCIDR(cluster)).To(BeFalse())
+		})
+
+		It("should return false if cluster or networking is nil", func() {
+			Expect(HasIPv6NodeCIDR(nil)).To(BeFalse())
+			Expect(HasIPv6NodeCIDR(&extensionscontroller.Cluster{})).To(BeFalse())
+			Expect(HasIPv6NodeCIDR(&extensionscontroller.Cluster{Shoot: &gardencorev1beta1.Shoot{}})).To(BeFalse())
+			Expect(HasIPv6NodeCIDR(&extensionscontroller.Cluster{
+				Shoot: &gardencorev1beta1.Shoot{
+					Status: gardencorev1beta1.ShootStatus{
+						Networking: nil,
+					},
+				},
+			})).To(BeFalse())
+		})
+	})
+})

pkg/webhook/controlplane/ensurer.go

@@ -39,6 +39,7 @@ import (
 	"github.com/gardener/gardener-extension-provider-aws/imagevector"
 	"github.com/gardener/gardener-extension-provider-aws/pkg/apis/aws/helper"
 	"github.com/gardener/gardener-extension-provider-aws/pkg/aws"
+	"github.com/gardener/gardener-extension-provider-aws/pkg/utils"
 )
 
 const (
@@ -174,7 +175,10 @@ func (e *ensurer) EnsureKubeControllerManagerDeployment(ctx context.Context, gct
 	}
 
 	allocateNodeCIDRs := true
-	if networkingConfig := cluster.Shoot.Spec.Networking; networkingConfig != nil && slices.Contains(networkingConfig.IPFamilies, v1beta1.IPFamilyIPv6) {
+	// Check if IPv6 is configured in IPFamilies or if any node CIDR is IPv6
+	if networkingConfig := cluster.Shoot.Spec.Networking; networkingConfig != nil &&
+		(slices.Contains(networkingConfig.IPFamilies, v1beta1.IPFamilyIPv6) ||
+			utils.HasIPv6NodeCIDR(cluster)) {
 		allocateNodeCIDRs = false
 	}
 	if c := extensionswebhook.ContainerWithName(ps.Containers, "kube-controller-manager"); c != nil {