{"id":38571902,"url":"https://github.com/hops-ops/aws-ipam","last_synced_at":"2026-04-02T11:52:46.557Z","repository":{"id":328857660,"uuid":"1098692968","full_name":"hops-ops/aws-ipam","owner":"hops-ops","description":"IPAM XRD","archived":false,"fork":false,"pushed_at":"2026-03-24T05:27:03.000Z","size":248,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-25T06:46:41.504Z","etag":null,"topics":["aws","aws-ipam","crossplane","crossplane-configuration","crossplane-configurations","crossplane-xrd","xrd"],"latest_commit_sha":null,"homepage":"","language":"KCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hops-ops.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-18T02:50:00.000Z","updated_at":"2026-03-24T05:19:46.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/hops-ops/aws-ipam","commit_stats":null,"previous_names":["hops-ops/configuration-aws-ipam","hops-ops/aws-ipam"],"tags_count":24,"template":false,"template_full_name":null,"purl":"pkg:github/hops-ops/aws-ipam","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ipam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ipam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ipam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ipam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hops-ops","download_url":"https://codeload.github.com/hops-ops/aws-ipam/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ipam/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31305861,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-02T09:48:21.550Z","status":"ssl_error","status_checked_at":"2026-04-02T09:48:19.196Z","response_time":89,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-ipam","crossplane","crossplane-configuration","crossplane-configurations","crossplane-xrd","xrd"],"created_at":"2026-01-17T08:00:55.748Z","updated_at":"2026-04-02T11:52:46.542Z","avatar_url":"https://github.com/hops-ops.png","language":"KCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-ipam\n\nCentralized IP address management for AWS. Stop tracking CIDRs in spreadsheets - request them from pools and let IPAM handle allocation, overlap prevention, and auditing.\n\n## Why IPAM?\n\nAWS recommends IPAM for any multi-VPC environment. Without proper IP address management, organizations risk address conflicts, wasted address space, and complex troubleshooting that leads to outages.\n\n**Without IPAM:**\n- Manual CIDR tracking in spreadsheets or wikis that drift from reality\n- Overlapping ranges when teams don't coordinate across accounts\n- No audit trail of who allocated what and when\n- IPv6 adoption feels impossible without a centralized plan\n- VPC creation blocked waiting on network team approvals\n\n**With IPAM:**\n- Automatic CIDR allocation from hierarchical pools - guaranteed non-overlapping\n- Full audit trail and compliance monitoring in AWS\n- Dual-stack (IPv4 + IPv6) ready from day one\n- Self-service VPC creation with guardrails (allocation rules enforce sizing)\n- Share pools across accounts via RAM (configured separately)\n- Compliance status tracking: Compliant, Noncompliant, or Unmanaged\n\n## The Journey\n\n### Stage 1: Getting Started (Single Account)\n\nYou have one AWS account and want organized IP allocation for your VPCs. Starting with IPAM early prevents painful migrations later.\n\n**Why start with IPAM now?**\n- When you add accounts later, VPCs won't overlap - the pool enforces it\n- Dual-stack (IPv6) ready from day one with no retrofitting\n- No migration pain - just keep using the same pools as you grow\n- Size VPCs appropriately with allocation rules (no more \"let's just use /16 to be safe\")\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: IPAM\nmetadata:\n  name: platform\n  namespace: default\nspec:\n  providerConfigRef:\n    name: default\n  region: us-east-1\n  pools:\n    ipv4:\n      # 10.0.0.0/8 gives you 16 million addresses\n      # Default /20 = 4096 IPs per VPC (enough for most workloads)\n      - name: ipv4\n        cidr: 10.0.0.0/8\n        allocations:\n          netmaskLength:\n            default: 20  # 4096 IPs - right-sized for typical VPCs\n            min: 16      # Largest allowed: 65,536 IPs\n            max: 24      # Smallest allowed: 256 IPs\n        description: IPv4 pool for VPCs\n```\n\n**Sizing guidance:** Most VPCs need far less than a /16. A /20 provides 4096 addresses - plenty for EKS clusters, RDS instances, and Lambda ENIs. Use allocation rules to prevent wasteful oversizing.\n\n### Stage 2: Add IPv6 for Modern Workloads\n\nIPv6 eliminates IP exhaustion concerns and enables modern networking patterns. AWS provides two types of IPv6:\n\n| Type | Range | Use Case |\n|------|-------|----------|\n| **ULA (Private)** | `fd00::/8` | Internal services, databases, service mesh |\n| **GUA (Public)** | Amazon-provided | Internet-facing workloads, public APIs |\n\n**Why IPv6?**\n- Pods get native IPv6 addresses (no NAT overhead in EKS)\n- Essentially unlimited IPs - a /56 per VPC gives you 4.7 sextillion addresses\n- Future-proof: IPv4 exhaustion is real, especially with container density\n- EKS IPv6 mode solves the IP exhaustion problem in large clusters\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: IPAM\nmetadata:\n  name: platform\n  namespace: default\nspec:\n  providerConfigRef:\n    name: default\n  region: us-east-1\n  pools:\n    ipv4:\n      - name: ipv4\n        cidr: 10.0.0.0/8\n        allocations:\n          netmaskLength:\n            default: 20\n\n    ipv6:\n      # Private IPv6 (ULA) - AWS auto-assigns from fd00::/8\n      # Use for internal services that don't need internet routing\n      ula:\n        - name: ipv6-private\n          netmaskLength: 48  # AWS assigns a /48 ULA block\n          allocations:\n            netmaskLength:\n              default: 56    # /56 per VPC = 256 subnets\n              min: 48\n              max: 64\n          description: Private IPv6 for internal services\n\n      # Public IPv6 (GUA) - Amazon-provided internet-routable\n      # Use for public-facing workloads\n      gua:\n        - name: ipv6-public\n          netmaskLength: 52  # AWS provisions /52 = 16 VPC allocations\n          allocations:\n            netmaskLength:\n              default: 56    # /56 per VPC (AWS standard)\n              min: 52\n              max: 60\n          description: Public IPv6 for internet-facing workloads\n```\n\n**Dual-stack strategy:** Create dual-stack VPCs with a mix of subnet types. You can have IPv4-only, dual-stack, and IPv6-only subnets in the same VPC, allowing gradual IPv6 adoption.\n\n### Stage 3: Multi-Region (Enterprise Scale)\n\nExpanding to multiple regions requires a hierarchical pool structure. Regional pools ensure:\n\n- **Lower latency:** VPCs allocate from region-local pools\n- **Data residency:** Compliance requirements (GDPR, data sovereignty) map to regional pools\n- **Disaster recovery:** Clear IP boundaries between regions simplify failover\n\nAWS recommends a four-tier hierarchy for enterprise: top-level pool → regional pools → business unit pools → environment pools.\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: IPAM\nmetadata:\n  name: platform\n  namespace: default\nspec:\n  providerConfigRef:\n    name: default\n  region: us-east-1\n  # IPAM auto-discovers regions from pool locales, but you can\n  # pre-provision regions before defining pools there\n  operatingRegions:\n    - us-east-1\n    - us-west-2\n    - eu-west-1\n  pools:\n    ipv4:\n      # Global pool - top of hierarchy (no locale = global)\n      - name: ipv4-global\n        cidr: 10.0.0.0/8\n        allocations:\n          netmaskLength:\n            default: 12  # Carve out /12 per region = 1M IPs each\n\n      # US East regional pool\n      - name: ipv4-us-east-1\n        sourcePoolRef: ipv4-global  # Child of global\n        locale: us-east-1           # Only us-east-1 VPCs can allocate\n        cidr: 10.0.0.0/12           # 10.0.0.0 - 10.15.255.255\n        allocations:\n          netmaskLength:\n            default: 20\n\n      # US West regional pool\n      - name: ipv4-us-west-2\n        sourcePoolRef: ipv4-global\n        locale: us-west-2\n        cidr: 10.16.0.0/12          # 10.16.0.0 - 10.31.255.255\n        allocations:\n          netmaskLength:\n            default: 20\n\n      # EU regional pool (for GDPR workloads)\n      - name: ipv4-eu-west-1\n        sourcePoolRef: ipv4-global\n        locale: eu-west-1\n        cidr: 10.32.0.0/12          # 10.32.0.0 - 10.47.255.255\n        allocations:\n          netmaskLength:\n            default: 20\n\n    ipv6:\n      ula:\n        # Global ULA pool\n        - name: ipv6-private\n          netmaskLength: 48\n          allocations:\n            netmaskLength:\n              default: 56\n\n        # Regional ULA for us-east-1\n        - name: ipv6-private-us-east-1\n          sourcePoolRef: ipv6-private\n          locale: us-east-1\n          netmaskLength: 56\n          allocations:\n            netmaskLength:\n              default: 64\n```\n\n**Locale enforcement:** When a pool has a `locale`, only VPCs in that region can allocate from it. This prevents accidental cross-region allocations and ensures compliance boundaries.\n\n### Stage 4: Import Existing IPAM\n\nAlready have an IPAM? Import it along with existing pools to bring them under GitOps management.\n\n**Why import?**\n- Preserve existing allocations - no disruption to running VPCs\n- Gradual adoption path - import what you have, extend with new pools\n- Single source of truth - manage IPAM alongside other infrastructure\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: IPAM\nmetadata:\n  name: existing-ipam\n  namespace: default\nspec:\n  # Import existing IPAM by ID\n  externalName: ipam-0123456789abcdef0\n  # Observe and update, but don't delete if this resource is removed\n  managementPolicies: [\"Observe\", \"Update\", \"LateInitialize\"]\n\n  providerConfigRef:\n    name: default\n  region: us-east-1\n  pools:\n    ipv4:\n      - name: ipv4\n        cidr: 10.0.0.0/8\n        # Import existing pool\n        externalName: ipam-pool-0123456789abcdef0\n        # Format: cidr_pool-id\n        cidrExternalName: 10.0.0.0/8_ipam-pool-0123456789abcdef0\n        managementPolicies: [\"Observe\", \"Update\", \"LateInitialize\"]\n        allocations:\n          netmaskLength:\n            default: 20\n```\n\n## Using IPAM Pools\n\nReference pool IDs from status when creating VPCs. The XRD exposes all pool IDs for downstream consumption.\n\n```yaml\napiVersion: ec2.aws.m.upbound.io/v1beta1\nkind: VPC\nspec:\n  forProvider:\n    region: us-east-1\n    # IPv4 from IPAM pool\n    ipv4IpamPoolId: ipam-pool-abc123  # From status.pools.ipv4[name=ipv4].id\n    ipv4NetmaskLength: 20\n    # IPv6 from IPAM (dual-stack)\n    ipv6IpamPoolId: ipam-pool-xyz789  # From status.pools.ipv6.gua[name=ipv6-public].id\n    ipv6NetmaskLength: 56\n```\n\n**Cross-account sharing:** To share pools with other AWS accounts, use AWS RAM (Resource Access Manager). RAM sharing is configured separately from this XRD - create a RAM resource share and add the IPAM pool ARN to it.\n\n## Status\n\nThe XRD exposes pool IDs and observed CIDRs for downstream resources:\n\n```yaml\nstatus:\n  id: ipam-0123456789abcdef0\n  arn: arn:aws:ec2:us-east-1:111111111111:ipam/ipam-0123456789abcdef0\n  privateDefaultScopeId: ipam-scope-abc123\n  publicDefaultScopeId: ipam-scope-xyz789\n  pools:\n    ipv4:\n      - name: ipv4\n        id: ipam-pool-abc123\n        arn: arn:aws:ec2:us-east-1:111111111111:ipam-pool/ipam-pool-abc123\n        cidr: 10.0.0.0/8\n    ipv6:\n      ula:\n        - name: ipv6-private\n          id: ipam-pool-def456\n          cidr: fd00:ec2::/48\n      gua:\n        - name: ipv6-public\n          id: ipam-pool-xyz789\n          cidr: 2600:1f26:47:c000::/52\n```\n\n## IPv6 Pool Sizing Reference\n\n| Level | Netmask | Addresses | Typical Use |\n|-------|---------|-----------|-------------|\n| IPAM Pool (GUA) | /52 | 16 /56 VPCs | Regional allocation |\n| VPC | /56 | 256 /64 subnets | Per-VPC allocation |\n| Subnet | /64 | 18 quintillion | Standard subnet size |\n| EKS Node Prefix | /80 | ~65k pod IPs | Prefix delegation per node |\n\n**Note:** VPC IPv6 allocations support /44, /48, /52, /56, and /60 (increments of /4).\n\n## Composed Resources\n\nThis XRD creates the following AWS resources:\n\n| Resource | Purpose | When Created |\n|----------|---------|--------------|\n| `VPCIpam` | Core IPAM instance with default scopes | Always |\n| `VPCIpamScope` | Custom scope for isolated address spaces | When `scopes` defined |\n| `VPCIpamPool` | Address pool (IPv4 or IPv6) | For each pool in `pools` |\n| `VPCIpamPoolCidr` | CIDR provisioned to a pool | For top-level pools with `cidr` or `netmaskLength` |\n| `Usage` | Deletion ordering (pool → CIDR dependencies) | When dependent resources are Ready |\n\n## Development\n\n```bash\nmake render              # Render all examples\nmake validate            # Validate all examples\nmake test                # Run KCL tests\nmake e2e                 # E2E tests against real AWS\nmake render:minimal      # Render single example\nmake validate:standard   # Validate single example\n```\n\n## References\n\n- [Amazon VPC IPAM Best Practices](https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-vpc-ip-address-manager-best-practices/)\n- [Multi-Region IPAM Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/multi-region-ipam-architecture.html)\n- [IPv6 on AWS Whitepaper](https://docs.aws.amazon.com/whitepapers/latest/ipv6-on-aws/ipv6-on-aws.html)\n- [Dual-stack IPv6 Architectures](https://aws.amazon.com/blogs/networking-and-content-delivery/dual-stack-ipv6-architectures-for-aws-and-hybrid-networks/)\n\n## License\n\nApache-2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhops-ops%2Faws-ipam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhops-ops%2Faws-ipam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhops-ops%2Faws-ipam/lists"}