Daemon: fix hardcode envoy listener addr

[rock-andy]

Without this patch, NetworkPolicy with Envoy would failed if
AF_INET6 address family not supported, and Envoy would report
error like:

xdsDetail="Error adding/updating listener(s) cilium-http-egress:14978:
IPv6 addresses are not supported on this machine: [::]:14978\n"
xdsNonce=196 xdsStreamID=1 xdsTypeURL=type.googleapis.com/envoy.config.listener.v3.Listener

Fixes: #17156

Signed-off-by: Zhang Qiang qiangzhang@qiyi.com

Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Thanks for contributing!

Fixes: #issue-number

Envoy configuration is fixed to work also when IPv6 is disabled.

[jrajahalme]

test-me-please

Job 'Cilium-PR-K8s-1.21-kernel-4.9' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTest Basic Test Traffic redirections to proxy Tests proxy visibility interactions with policy lifecycle operations

Failure Output

FAIL: traffic was not redirected to the proxy when it should have been

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.21-kernel-4.9 so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.16-net-next' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sPolicyTest Basic Test Traffic redirections to proxy Tests proxy visibility interactions with policy lifecycle operations

Failure Output

FAIL: traffic was not redirected to the proxy when it should have been

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.16-net-next so I can create a new GitHub issue to track it.

[jrajahalme]

Looks good, one question below, thanks!

[jrajahalme]

I suppose having Ipv4Compat: true is harmless when listening on an IPv4 is address?

[rock-andy]

Thanks for your time @jrajahalme . I have just checked the related code of envoy about ipv4Compat, and here's the only usage of socket_address.ipv4_compat, that means IPv4Compat only affect for ipv6 connection. Here's the code:

https://github.com/envoyproxy/envoy/blob/main/source/common/network/utility.cc#L137

[jrajahalme]

Added a release note to the description.

[aanm]

/test

[aanm]

it looks a little bit suspicious the same test failed in 2 different CI runs. Are we sure this isn't a real failure?

[aanm]

/test