Sub-task of #246, per bowei's concrete steps: "Fixing the Envoy bind to include IPv6 addresses." Needs #845 for somewhere to test it.
Problem
| Socket |
Where |
Today |
router ingress :8080 / :8443 |
router/xds.go — buildListener, buildHttpsListener |
0.0.0.0 |
router Envoy admin :9901 |
manifests/ate-install/atenet-router.yaml |
0.0.0.0 |
egress Envoy admin :15000 |
manifests/ate-install/atenet-egress.yaml |
0.0.0.0 |
egress :443 CONNECT listener |
same |
0.0.0.0 |
atenet-router, atenet-egress Services |
both manifests |
no ipFamilyPolicy → SingleStack |
IPv6-only cluster — the pod never starts. The kubelet probes a pod on its only address, so the startup probe against the egress admin port is refused. atenet-egress crashlooped for 14h on a v6-only kind cluster while Envoy itself started fine and logged admin address: 0.0.0.0:15000:
Startup probe failed: Get "http://[fd00:10:244::18]:15000/ready": connect: connection refused
Dual-stack cluster — the pod is healthy and half the data path is dark. The router answers on its Service's IPv4 ClusterIP and on nothing at all for IPv6. The missing ipFamilyPolicy compounds it: even with a :: listener the Service only hands out one ClusterIP.
Two socket shapes, two fixes
Worth writing down, because side by side the two look inconsistent:
- Ingress listeners keep the
0.0.0.0 primary and gain an additional :: address on the same port, ipv4_compat: false. Setting it would clear IPV6_V6ONLY and collide with the primary already bound to that port, and Envoy rejects the whole listener when an additional address fails to bind — that takes down all ingress, not just the v6 half.
- The two admin sockets and the egress
:443 listener are single sockets, so they bind :: with ipv4_compat: true. The flag is load-bearing: dataplane.go health-checks the router admin over http://127.0.0.1:9901/ready, and the egress ext-proc drainer dials 127.0.0.1:15000, where envoydrain.go reads a refusal as "Envoy already exited" and skips the drain silently.
- Both Services get
ipFamilyPolicy: PreferDualStack — Prefer, not Require, which fails Service creation outright on a single-stack cluster.
No behaviour change on IPv4-only: the ingress primary is untouched, PreferDualStack is a no-op there, and a host without IPv6 simply has no second socket to bind.
Not in scope
These leave both gateways IPv4-only for outbound resolution — material for bowei's step 3:
I have a fix working on an IPv6-only kind cluster and will open a PR.
Sub-task of #246, per bowei's concrete steps: "Fixing the Envoy bind to include IPv6 addresses." Needs #845 for somewhere to test it.
Problem
:8080/:8443router/xds.go—buildListener,buildHttpsListener0.0.0.0:9901manifests/ate-install/atenet-router.yaml0.0.0.0:15000manifests/ate-install/atenet-egress.yaml0.0.0.0:443CONNECT listener0.0.0.0atenet-router,atenet-egressServicesipFamilyPolicy→ SingleStackIPv6-only cluster — the pod never starts. The kubelet probes a pod on its only address, so the startup probe against the egress admin port is refused.
atenet-egresscrashlooped for 14h on a v6-only kind cluster while Envoy itself started fine and loggedadmin address: 0.0.0.0:15000:Dual-stack cluster — the pod is healthy and half the data path is dark. The router answers on its Service's IPv4 ClusterIP and on nothing at all for IPv6. The missing
ipFamilyPolicycompounds it: even with a::listener the Service only hands out one ClusterIP.Two socket shapes, two fixes
Worth writing down, because side by side the two look inconsistent:
0.0.0.0primary and gain an additional::address on the same port,ipv4_compat: false. Setting it would clearIPV6_V6ONLYand collide with the primary already bound to that port, and Envoy rejects the whole listener when an additional address fails to bind — that takes down all ingress, not just the v6 half.:443listener are single sockets, so they bind::withipv4_compat: true. The flag is load-bearing:dataplane.gohealth-checks the router admin overhttp://127.0.0.1:9901/ready, and the egress ext-proc drainer dials127.0.0.1:15000, whereenvoydrain.goreads a refusal as "Envoy already exited" and skips the drain silently.ipFamilyPolicy: PreferDualStack— Prefer, not Require, which fails Service creation outright on a single-stack cluster.No behaviour change on IPv4-only: the ingress primary is untouched,
PreferDualStackis a no-op there, and a host without IPv6 simply has no second socket to bind.Not in scope
These leave both gateways IPv4-only for outbound resolution — material for bowei's step 3:
dns_lookup_family: V4_ONLYon the egress dynamic forward proxy (both the HTTP filter and the cluster DNS cache) — already named in [Bug] Data plane is hard IPv4 #246.xds.goisSTRICT_DNSwithDnsLookupFamilyunset, i.e. Envoy's V4-only default.cmd/atenet/internal/dns/corefile.goemitstemplate IN Aonly, no AAAA path — distinct from atenet/dns: actor zone returns SERVFAIL for every query it does not answer #888.I have a fix working on an IPv6-only kind cluster and will open a PR.