✨ Support IPv6/dual-stack routable pods with NSX-VPC

go.mod

@@ -15,8 +15,8 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260423081355-beab2417344a
-	github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260423081355-beab2417344a
+	github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260526090146-dc1b9330cf6b
+	github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260526090146-dc1b9330cf6b
 	github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20260502065817-4ee333ccd54c
 	github.com/vmware/govmomi v0.54.0
 	github.com/vmware/vsphere-automation-sdk-go/lib v0.7.0
@@ -125,7 +125,7 @@ require (
 	k8s.io/streaming v0.36.0 // indirect
 	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
-	sigs.k8s.io/controller-runtime v0.19.0 // indirect
+	sigs.k8s.io/controller-runtime v0.23.3 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect

go.sum

@@ -2,6 +2,8 @@ cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
@@ -73,8 +75,8 @@ github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7O
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
@@ -115,10 +117,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
-github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -159,10 +161,10 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
-github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260423081355-beab2417344a h1:yqGxhqSJ78veQjdOHINJLE9IWDcreMTzwDsOAdwrUWM=
-github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260423081355-beab2417344a/go.mod h1:Q4JzNkNMvjo7pXtlB5/R3oME4Nhah7fAObWgghVmtxk=
-github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260423081355-beab2417344a h1:3+uFGz+qweWuBXNBfpb7dEahIy1kNWe2tmaVXZbw1c4=
-github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260423081355-beab2417344a/go.mod h1:MNz/PlAeJyKGt+X+nQE2bpiMghzpaP5XKaUlH0Stgh4=
+github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260526090146-dc1b9330cf6b h1:rd5aM+0OQbC8mwwf6RvGdtpR/OPyTd1c6a3pgahn5T4=
+github.com/vmware-tanzu/nsx-operator/pkg/apis v0.0.0-20260526090146-dc1b9330cf6b/go.mod h1:SugdFTNhj3fQNOVEQGppIrgFOPLB1gsYUQi/UbLXDY8=
+github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260526090146-dc1b9330cf6b h1:fePl1eOHS7b2kWfo8JAZbnY2V6zjTQWqNFbz+43NGn4=
+github.com/vmware-tanzu/nsx-operator/pkg/client v0.0.0-20260526090146-dc1b9330cf6b/go.mod h1:xwd6AvIa50MlhSFRDRBNtwjDhKTS6Od7XQMpnN9Y/LY=
 github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20260502065817-4ee333ccd54c h1:xJzEwgcm+w72/Da+0wiv/EXUmAj0JJ0DnF7TeSjGJIw=
 github.com/vmware-tanzu/vm-operator/api v1.9.1-0.20260502065817-4ee333ccd54c/go.mod h1:nWTPpxfe4gHuuYuFcrs86+NMxfkqPk3a3IlvI8TCWak=
 github.com/vmware/govmomi v0.54.0 h1:akEKkM9XKMOhTskmdzTLG8JzH+sh61jbFrVPbAzv5IQ=
@@ -346,8 +348,8 @@ k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0x
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.19.0 h1:nWVM7aq+Il2ABxwiCizrVDSlmDcshi9llbaFbC0ji/Q=
-sigs.k8s.io/controller-runtime v0.19.0/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
+sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
+sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=

pkg/cloudprovider/vsphereparavirtual/cloud.go

@@ -161,15 +161,11 @@ func (cp *VSphereParavirtual) Initialize(clientBuilder cloudprovider.ControllerC
 		klog.Fatalf("Invalid flag combination: %v", err)
 	}
 
-	ipv6Enabled := resolvedClusterIPFamily == ClusterIPFamilyIPv6 ||
-		resolvedClusterIPFamily == ClusterIPFamilyIPv4IPv6 ||
-		resolvedClusterIPFamily == ClusterIPFamilyIPv6IPv4
-
 	// IPv6 (including dual stack) Routable Pods requires VPC mode; T1 networking does not
 	// support per-family IPAddressAllocation or StaticRoute CRs.
 	// This guard is scoped to RouteEnabled: IPv6 Node IP Report and Load Balancer do not
 	// depend on VPC mode and must continue to work when route controllers are disabled.
-	if RouteEnabled && ipv6Enabled && !vpcModeEnabled {
+	if RouteEnabled && resolvedClusterIPFamily.IPv6Enabled() && !vpcModeEnabled {
 		klog.Fatalf("--cluster-ip-family=%s with route controller enabled requires --enable-vpc-mode=true: IPv6 and dual stack routable pods are not supported on the legacy T1 networking mode", resolvedClusterIPFamily)
 	}
 	klog.Infof("Using VM Operator API version: %s", vmopAPIVersion)
@@ -191,7 +187,7 @@ func (cp *VSphereParavirtual) Initialize(clientBuilder cloudprovider.ControllerC
 	cp.loadBalancer = lb
 
 	klog.Infof("Using cluster IP family: %s", resolvedClusterIPFamily)
-	instances, err := NewInstances(clusterNS, vmopClient, resolvedClusterIPFamily)
+	instances, err := NewInstances(clusterNS, vmopClient, string(resolvedClusterIPFamily))
 	if err != nil {
 		klog.Errorf("Failed to init Instance: %v", err)
 	}
@@ -200,7 +196,14 @@ func (cp *VSphereParavirtual) Initialize(clientBuilder cloudprovider.ControllerC
 	if RouteEnabled {
 		klog.V(0).Info("Starting routable pod controllers")
 
-		if err := routablepod.StartControllers(kcfg, client, cp.informMgr, ClusterName, clusterNS, ownerRef, vpcModeEnabled, podIPPoolType); err != nil {
+		if err := routablepod.StartControllers(kcfg, client, cp.informMgr, routablepod.Options{
+			ClusterName:    ClusterName,
+			ClusterNS:      clusterNS,
+			OwnerRef:       ownerRef,
+			VPCModeEnabled: vpcModeEnabled,
+			PodIPPoolType:  podIPPoolType,
+			IPFamily:       resolvedClusterIPFamily,
+		}); err != nil {
 			klog.Errorf("Failed to start Routable pod controllers: %v", err)
 		}
 	}

pkg/cloudprovider/vsphereparavirtual/cluster_ip_family.go

@@ -18,26 +18,27 @@ package vsphereparavirtual
 
 import (
 	"fmt"
-	"strings"
 
+	"k8s.io/cloud-provider-vsphere/pkg/cloudprovider/vsphereparavirtual/ipfamily"
 	"k8s.io/cloud-provider-vsphere/pkg/cloudprovider/vsphereparavirtual/vmoperator/factory"
 )
 
-// ClusterIPFamilyIPv4 is the default: IPv4-first NodeInternalIP ordering; does
-// not require a VM Operator API with dual-stack VirtualMachineService fields.
-const ClusterIPFamilyIPv4 = "ipv4"
-
-// ClusterIPFamilyIPv6 is IPv6-first ordering and requires
-// --vm-operator-api-version >= v1alpha6 (dual-stack VirtualMachineService fields).
-const ClusterIPFamilyIPv6 = "ipv6"
-
-// ClusterIPFamilyIPv4IPv6 is dual-stack with IPv4 before IPv6 in the reported
-// NodeInternalIP list; requires --vm-operator-api-version >= v1alpha6.
-const ClusterIPFamilyIPv4IPv6 = "ipv4ipv6"
+// The four ClusterIPFamily constants are aliases for the canonical values in
+// the ipfamily package. Keeping them here preserves backward compatibility for
+// any callers in this package (instances.go, cloud.go, tests) that already
+// reference them by the ClusterIPFamily* name.
+const (
+	ClusterIPFamilyIPv4     = string(ipfamily.IPv4)
+	ClusterIPFamilyIPv6     = string(ipfamily.IPv6)
+	ClusterIPFamilyIPv4IPv6 = string(ipfamily.IPv4IPv6)
+	ClusterIPFamilyIPv6IPv4 = string(ipfamily.IPv6IPv4)
+)
 
-// ClusterIPFamilyIPv6IPv4 is dual-stack with IPv6 before IPv4 (same primary
-// order as ClusterIPFamilyIPv6); requires --vm-operator-api-version >= v1alpha6.
-const ClusterIPFamilyIPv6IPv4 = "ipv6ipv4"
+// ParseClusterIPFamily validates the --cluster-ip-family flag and returns a
+// canonical IPFamily value. It is a thin wrapper around ipfamily.Parse.
+func ParseClusterIPFamily(raw string) (ipfamily.IPFamily, error) {
+	return ipfamily.Parse(raw)
+}
 
 // supportsDualStackVMService records, per --vm-operator-api-version, whether
 // that API persists the dual-stack fields on VirtualMachineService
@@ -52,25 +53,6 @@ var supportsDualStackVMService = map[string]bool{
 	factory.V1alpha6: true,
 }
 
-// ParseClusterIPFamily validates the --cluster-ip-family flag and returns a
-// canonical lowercase value: ipv4, ipv6, ipv4ipv6, or ipv6ipv4.
-func ParseClusterIPFamily(raw string) (string, error) {
-	s := strings.ToLower(strings.TrimSpace(raw))
-	switch s {
-	case "ipv4":
-		return ClusterIPFamilyIPv4, nil
-	case "ipv6":
-		return ClusterIPFamilyIPv6, nil
-	case "ipv4ipv6":
-		return ClusterIPFamilyIPv4IPv6, nil
-	case "ipv6ipv4":
-		return ClusterIPFamilyIPv6IPv4, nil
-	default:
-		return "", fmt.Errorf("invalid --cluster-ip-family %q: must be one of %s, %s, %s, %s",
-			raw, ClusterIPFamilyIPv4, ClusterIPFamilyIPv6, ClusterIPFamilyIPv4IPv6, ClusterIPFamilyIPv6IPv4)
-	}
-}
-
 // vmopSupportsDualStackVMServiceAPI reports whether vmopAPIVersion is known
 // and persists VirtualMachineService dual-stack fields. An unknown version
 // returns false; add new versions to supportsDualStackVMService before
@@ -79,32 +61,19 @@ func vmopSupportsDualStackVMServiceAPI(version string) bool {
 	return supportsDualStackVMService[version]
 }
 
-// clusterIPFamilyRequiresDualStackVMOP reports whether the canonical family
-// needs VM Operator APIs that persist dual-stack LoadBalancer fields.
-func clusterIPFamilyRequiresDualStackVMOP(clusterIPFamily string) bool {
-	switch clusterIPFamily {
-	case ClusterIPFamilyIPv6, ClusterIPFamilyIPv4IPv6, ClusterIPFamilyIPv6IPv4:
-		return true
-	default:
-		return false
-	}
-}
-
 // validateIPFamilyConfig ensures ipv6 / ipv4ipv6 / ipv6ipv4 are only used with
 // a VM Operator API version that persists VirtualMachineService dual-stack
 // fields (see supportsDualStackVMService). ipv4 does not require dual-stack
 // VirtualMachineService fields.
-//
-// clusterIPFamily must be a canonical value returned from ParseClusterIPFamily.
-func validateIPFamilyConfig(clusterIPFamily, vmopAPIVersion string) error {
-	if !clusterIPFamilyRequiresDualStackVMOP(clusterIPFamily) {
+func validateIPFamilyConfig(f ipfamily.IPFamily, vmopAPIVersion string) error {
+	if !f.IPv6Enabled() {
 		return nil
 	}
 	if !vmopSupportsDualStackVMServiceAPI(vmopAPIVersion) {
 		return fmt.Errorf(
 			"--cluster-ip-family=%s requires --vm-operator-api-version >= %s (dual-stack VirtualMachineService fields), got %q; "+
 				"earlier API versions omit ipFamilies/ipFamilyPolicy and can silently provision IPv4-only load balancers",
-			clusterIPFamily, factory.V1alpha6, vmopAPIVersion,
+			f, factory.V1alpha6, vmopAPIVersion,
 		)
 	}
 	return nil

pkg/cloudprovider/vsphereparavirtual/cluster_ip_family_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"k8s.io/cloud-provider-vsphere/pkg/cloudprovider/vsphereparavirtual/ipfamily"
 	"k8s.io/cloud-provider-vsphere/pkg/cloudprovider/vsphereparavirtual/vmoperator/factory"
 )
 
@@ -49,16 +50,16 @@ func TestParseClusterIPFamily(t *testing.T) {
 	testCases := []struct {
 		name    string
 		raw     string
-		want    string
+		want    ipfamily.IPFamily
 		wantErr bool
 	}{
-		{name: "ipv4 canonical", raw: "ipv4", want: ClusterIPFamilyIPv4},
-		{name: "IPv4 case", raw: "IPv4", want: ClusterIPFamilyIPv4},
-		{name: "ipv6 with spaces", raw: "  ipv6 ", want: ClusterIPFamilyIPv6},
-		{name: "ipv4ipv6", raw: "ipv4ipv6", want: ClusterIPFamilyIPv4IPv6},
-		{name: "IPv4IPv6 mixed case", raw: "IPv4IPv6", want: ClusterIPFamilyIPv4IPv6},
-		{name: "ipv6ipv4", raw: "ipv6ipv4", want: ClusterIPFamilyIPv6IPv4},
-		{name: "IPv6IPv4 mixed case", raw: "IPv6IPv4", want: ClusterIPFamilyIPv6IPv4},
+		{name: "ipv4 canonical", raw: "ipv4", want: ipfamily.IPv4},
+		{name: "IPv4 case", raw: "IPv4", want: ipfamily.IPv4},
+		{name: "ipv6 with spaces", raw: "  ipv6 ", want: ipfamily.IPv6},
+		{name: "ipv4ipv6", raw: "ipv4ipv6", want: ipfamily.IPv4IPv6},
+		{name: "IPv4IPv6 mixed case", raw: "IPv4IPv6", want: ipfamily.IPv4IPv6},
+		{name: "ipv6ipv4", raw: "ipv6ipv4", want: ipfamily.IPv6IPv4},
+		{name: "IPv6IPv4 mixed case", raw: "IPv6IPv4", want: ipfamily.IPv6IPv4},
 		{name: "garbage", raw: "dual-stack", wantErr: true},
 		{name: "empty after trim", raw: "   ", wantErr: true},
 		{name: "typo v6", raw: "ip6", wantErr: true},
@@ -125,79 +126,79 @@ func TestSimulateInitializeIPFamilyChecks_Order(t *testing.T) {
 func TestValidateIPFamilyConfig(t *testing.T) {
 	testCases := []struct {
 		name            string
-		clusterIPFamily string
+		clusterIPFamily ipfamily.IPFamily
 		vmopAPIVersion  string
 		wantErr         bool
 	}{
 		{
 			name:            "ipv4 + v1alpha2 is always valid (default path)",
-			clusterIPFamily: ClusterIPFamilyIPv4,
+			clusterIPFamily: ipfamily.IPv4,
 			vmopAPIVersion:  factory.V1alpha2,
 			wantErr:         false,
 		},
 		{
 			name:            "ipv4 + v1alpha5 is valid",
-			clusterIPFamily: ClusterIPFamilyIPv4,
+			clusterIPFamily: ipfamily.IPv4,
 			vmopAPIVersion:  factory.V1alpha5,
 			wantErr:         false,
 		},
 		{
 			name:            "ipv4 + v1alpha6 is valid",
-			clusterIPFamily: ClusterIPFamilyIPv4,
+			clusterIPFamily: ipfamily.IPv4,
 			vmopAPIVersion:  factory.V1alpha6,
 			wantErr:         false,
 		},
 		{
 			name:            "ipv6 + v1alpha6 is valid",
-			clusterIPFamily: ClusterIPFamilyIPv6,
+			clusterIPFamily: ipfamily.IPv6,
 			vmopAPIVersion:  factory.V1alpha6,
 			wantErr:         false,
 		},
 		{
 			name:            "ipv4ipv6 + v1alpha6 is valid",
-			clusterIPFamily: ClusterIPFamilyIPv4IPv6,
+			clusterIPFamily: ipfamily.IPv4IPv6,
 			vmopAPIVersion:  factory.V1alpha6,
 			wantErr:         false,
 		},
 		{
 			name:            "ipv6 + v1alpha2 is rejected",
-			clusterIPFamily: ClusterIPFamilyIPv6,
+			clusterIPFamily: ipfamily.IPv6,
 			vmopAPIVersion:  factory.V1alpha2,
 			wantErr:         true,
 		},
 		{
 			name:            "ipv6 + v1alpha5 is rejected",
-			clusterIPFamily: ClusterIPFamilyIPv6,
+			clusterIPFamily: ipfamily.IPv6,
 			vmopAPIVersion:  factory.V1alpha5,
 			wantErr:         true,
 		},
 		{
 			name:            "ipv4ipv6 + v1alpha2 is rejected",
-			clusterIPFamily: ClusterIPFamilyIPv4IPv6,
+			clusterIPFamily: ipfamily.IPv4IPv6,
 			vmopAPIVersion:  factory.V1alpha2,
 			wantErr:         true,
 		},
 		{
 			name:            "ipv4ipv6 + v1alpha5 is rejected",
-			clusterIPFamily: ClusterIPFamilyIPv4IPv6,
+			clusterIPFamily: ipfamily.IPv4IPv6,
 			vmopAPIVersion:  factory.V1alpha5,
 			wantErr:         true,
 		},
 		{
 			name:            "ipv6ipv4 + v1alpha6 is valid",
-			clusterIPFamily: ClusterIPFamilyIPv6IPv4,
+			clusterIPFamily: ipfamily.IPv6IPv4,
 			vmopAPIVersion:  factory.V1alpha6,
 			wantErr:         false,
 		},
 		{
 			name:            "ipv6ipv4 + v1alpha2 is rejected",
-			clusterIPFamily: ClusterIPFamilyIPv6IPv4,
+			clusterIPFamily: ipfamily.IPv6IPv4,
 			vmopAPIVersion:  factory.V1alpha2,
 			wantErr:         true,
 		},
 		{
 			name:            "unknown vmop version is treated as below v1alpha6 for dual-stack family",
-			clusterIPFamily: ClusterIPFamilyIPv6IPv4,
+			clusterIPFamily: ipfamily.IPv6IPv4,
 			vmopAPIVersion:  "v1alpha99",
 			wantErr:         true,
 		},