also whitelist ipv6

[mdonoughe]

What this PR does / why we need it:

Whitelisting 0.0.0.0/0 means people who use whitelisting won't have problems when using acme over ipv4, but guarantees that people will have problems when using acme over ipv6 (see nginx rule below). I've added ::0/0 to the whitelist, which seems to solve the problem I've been having today.

geo $the_real_ip $deny_QevWrNHVjGFiQYHjfMrOsfzrjRZiYJTr {
        default 1;

        0.0.0.0/0 0;
        ::/0 0;
}

Without ::0/0 in this filter, IPv6 acme requests are blocked with error 403.

if ($deny_QevWrNHVjGFiQYHjfMrOsfzrjRZiYJTr) {
        return 403;
}

You can tell this is happening when the nginx logs show the pattern of returning 200 for a challenge requests coming from one of your cluster nodes, followed by a 403 response to a request with the Let's Encrypt user agent from an IPv6 address. On the log entries with a 200 response you will see the container address where the request is forwarded to, but on the 403 log entries you will not.

Which issue this PR fixes: none that I know of

Special notes for your reviewer:

Release note:

All IPv6 addresses are added to the nginx-ingress whitelist for HTTP challenges,
restoring HTTP challenge support for domains with AAAA records when using nginx-ingress.

[jetstack-bot]

Hi @mdonoughe. Thanks for your PR.

I'm waiting for a jetstack or cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[johannwagner]

We ran into the same bug and still thought, how to report it :D

[munnerz]

Thanks! 😄

/lgtm
/approve
/ok-to-test

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mdonoughe, munnerz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [munnerz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment