Service ipv4 cidr is not supported with IPv6

pkg/apis/eksctl.io/v1alpha5/validation.go

@@ -179,6 +179,14 @@ func (c *ClusterConfig) ValidateVPCConfig() error {
 			} else if err == nil && version == -1 {
 				return fmt.Errorf("cluster version must be >= %s", Version1_21)
 			}
+
+			if c.VPC.NAT != nil {
+				return fmt.Errorf("setting NAT is not supported with IPv6")
+			}
+
+			if c.KubernetesNetworkConfig != nil && c.KubernetesNetworkConfig.ServiceIPv4CIDR != "" {
+				return fmt.Errorf("service ipv4 cidr is not supported with IPv6")
+			}
 		}
 	}
 

pkg/apis/eksctl.io/v1alpha5/validation_test.go

@@ -545,6 +545,7 @@ var _ = Describe("ClusterConfig validation", func() {
 			When("ipFamily is set to IPv6", func() {
 				It("accepts that setting", func() {
 					ipv6 := string(api.IPV6Family)
+					cfg.VPC.NAT = nil
 					cfg.VPC.IPFamily = &ipv6
 					cfg.Addons = append(cfg.Addons,
 						&api.Addon{Name: api.KubeProxyAddon},
@@ -582,9 +583,31 @@ var _ = Describe("ClusterConfig validation", func() {
 					Expect(err).To(MatchError(ContainSubstring("cluster version must be >= 1.21")))
 				})
 			})
+			When("ipFamily is set ot IPv6 but version is not or too low", func() {
+				It("returns an error", func() {
+					ipv6 := string(api.IPV6Family)
+					cfg.VPC.IPFamily = &ipv6
+					cfg.VPC.NAT = nil
+					cfg.Addons = append(cfg.Addons,
+						&api.Addon{Name: api.KubeProxyAddon},
+						&api.Addon{Name: api.CoreDNSAddon},
+						&api.Addon{Name: api.VPCCNIAddon},
+					)
+					cfg.IAM = &api.ClusterIAM{
+						WithOIDC: api.Enabled(),
+					}
+					cfg.Metadata.Version = ""
+					err = cfg.ValidateVPCConfig()
+					Expect(err).To(MatchError(ContainSubstring("failed to convert  cluster version to semver: unable to parse first version")))
+					cfg.Metadata.Version = api.Version1_12
+					err = cfg.ValidateVPCConfig()
+					Expect(err).To(MatchError(ContainSubstring("cluster version must be >= 1.21")))
+				})
+			})
 			When("ipFamily is set ot IPv6 but no managed addons are provided", func() {
 				It("it returns an error including which addons are missing", func() {
 					ipv6 := string(api.IPV6Family)
+					cfg.VPC.NAT = nil
 					cfg.VPC.IPFamily = &ipv6
 					cfg.IAM = &api.ClusterIAM{
 						WithOIDC: api.Enabled(),
@@ -631,6 +654,45 @@ var _ = Describe("ClusterConfig validation", func() {
 					Expect(err).To(MatchError(ContainSubstring("invalid value invalid for ipFamily; allowed are IPv4 and IPv6")))
 				})
 			})
+			When("ipFamily is set to IPv6 and vpc.NAT is defined", func() {
+				It("it returns an error", func() {
+					ipv6 := string(api.IPV6Family)
+					cfg.VPC.IPFamily = &ipv6
+					cfg.Metadata.Version = api.Version1_22
+					cfg.IAM = &api.ClusterIAM{
+						WithOIDC: api.Enabled(),
+					}
+					cfg.Addons = append(cfg.Addons,
+						&api.Addon{Name: api.KubeProxyAddon},
+						&api.Addon{Name: api.CoreDNSAddon},
+						&api.Addon{Name: api.VPCCNIAddon},
+					)
+					cfg.VPC.NAT = &api.ClusterNAT{}
+					err = cfg.ValidateVPCConfig()
+					Expect(err).To(MatchError(ContainSubstring("setting NAT is not supported with IPv6")))
+				})
+			})
+			When("ipFamily is set to IPv6 and serviceIPv4CIDR is not empty", func() {
+				It("it returns an error", func() {
+					ipv6 := string(api.IPV6Family)
+					cfg.VPC.IPFamily = &ipv6
+					cfg.Metadata.Version = api.Version1_22
+					cfg.IAM = &api.ClusterIAM{
+						WithOIDC: api.Enabled(),
+					}
+					cfg.Addons = append(cfg.Addons,
+						&api.Addon{Name: api.KubeProxyAddon},
+						&api.Addon{Name: api.CoreDNSAddon},
+						&api.Addon{Name: api.VPCCNIAddon},
+					)
+					cfg.KubernetesNetworkConfig = &api.KubernetesNetworkConfig{
+						ServiceIPv4CIDR: "192.168.0.0/24",
+					}
+					cfg.VPC.NAT = nil
+					err = cfg.ValidateVPCConfig()
+					Expect(err).To(MatchError(ContainSubstring("service ipv4 cidr is not supported with IPv6")))
+				})
+			})
 		})
 
 		Context("CIDRs", func() {

userdocs/src/usage/vpc-networking.md

@@ -56,6 +56,7 @@ This is an in config file setting only. When IPv6 is set, the following restrict
 - OIDC is enabled
 - managed addons are defined as shows above
 - version must be => 1.21
+- `vpc.NAT` and `serviceIPv4CIDR` fields are created by eksctl for ipv6 clusters and thus, are not supported configuration options
 
 The default value is `IPv4`.