aws/eni: fix cilium operator crash on IPv6 ENI #22075
Conversation
Cilium operator would crash when being brought up in an AWS region where there was a IPv6-only ENI and no subnet filters, because it would fail to parse the ENI (logs will show "ENI has no IP address" and "Initial synchronization with instances API failed"). We work around this issue for the moment by filtering the network interfaces we fetch from AWS with 'private-ip-addresses=*', which includes all ENIs with any value in the PrivateIpAddress field. This is the field `parseENI` complains about otherwise. In general, though, it seems that the ENI IPAM mode needs to learn to handle IPv6 ENIs. That will not be a small undertaking, so we fix the obvious bug for now. Co-authored-by: Sebastian Wicki <sebastian@isovalent.com> Signed-off-by: David Bimmler <david.bimmler@isovalent.com>
bimmlerd
added
kind/bug
|
Should I also create a ticket for this to make it more discoverable? Also, do we want to backport this? |
|
I don't think we necessarily need an issue here, the PR already describes it well enough. Let's backport this to the latest stable, as it is a regular bug fix. |
gandro
added
needs-backport/1.12
affects/v1.11
|
/ci-eks |
I've added a sentence. I guess we track this in #18405, and #19251 is related. Do we link to issues in the docs, e.g. something like "work on implementing this is tracked in xyz?" |
|
@bimmlerd I've seen it done before, so yes. |
Yes, there is even built-in syntax for it: |
|
Ah yes, thanks Joe. I remember we had done it but I forgot about this incantation. |
Signed-off-by: David Bimmler <david.bimmler@isovalent.com>
bimmlerd
force-pushed
the
pr/bimmlerd/fix-ipv6-eni-crashing-operator
branch
from
7b52acb
to
5c622fe
Compare
|
I've filed #22217 for the ConformanceKind1.19 failure. This seems likely to be broken/flaky on master somehow. |
jrajahalme
added
backport-done/1.12
joestringer
moved this from Needs backport from master
to Backport done to v1.12
in 1.12.5
Cilium operator would crash when being brought up in an AWS region where there was a IPv6-only ENI and no subnet filters, because it would fail to parse the ENI (logs will show
ENI has no IP addressandInitial synchronization with instances API failed).We work around this issue for the moment by filtering the network interfaces we fetch from AWS with
'private-ip-addresses=*', which includes all ENIs with any value in the PrivateIpAddress field. This is the fieldparseENIcomplains about otherwise.In general, though, it seems that the ENI IPAM mode needs to learn to handle IPv6 ENIs. There are unsolved challenges (such as representing the IP pool as a list of addresses, which will not work for IPv6), however, which cannot be addressed quickly, so we work around it for now.
cc @gandro @chanieljdan @bmcustodio