[INFRA-47] *.jenkins-ci.org are not accessible via IPV6

[jenkins-infra-bot]

As per title.

None of the sites are accessible via IPV6, and while this is a trivial matter for the most part it does prevent automatic updates via Linux package managers using pkg.jenkins-ci.org.

---

Originally reported by namtabmai, imported from: *.jenkins-ci.org are not accessible via IPV6

• assignee: olblak
• status: Reopened
• priority: Trivial
• resolution: Unresolved
• imported: 2022/01/10

[jenkins-infra-bot]

evernat:

Is it reproduced recently?

[jenkins-infra-bot]

namtabmai:

Yes,

pkg.jenkins-ci.org doesn't have an AAAA record, perhaps the server itself has an IPv6 address but without the record it's near impossible to test.

Here's a basic site that should give a simple indication if it's IPv6 ready.

http://ip6.nl/#!pkg.jenkins-ci.org

[jenkins-infra-bot]

rtyler:

I'm not sure what the expectation here is? We don't have IPv6 links, which is why we don't have AAAA records. Our mirrors may or may not have IPv6, but I've never bothered checking.

[jenkins-infra-bot]

etnyx:

This could be problem now and in future more often,... I need to run Jenkins on IPv6 host only, even if changed Update site under pluginManager/advanced to IPv6 mirror, Jenkins always check to updates.jenkins-ci.org and failed in installing plugin for example

java.net.SocketTimeoutException: connect timed out
Caused: java.io.IOException: Failed to load http://updates.jenkins-ci.org/download/plugins/bouncycastle-api/2.16.2/bouncycastle-api.hpi to /var/lib/jenkins/plugins/bouncycastle-api.jpi.tmp

full exception

It's caused by missing IPv6 support on infrastructure since updates.jenkins-ci.org has CNAME to mirrors.jenkins.io it should be solved by adding IPv6 to jenkins.io domains.

If your provider can't provide IPv6, is there any workaround?

[jenkins-infra-bot]

etnyx:

I was able solve my problem, now my instance is also behind our ISP IPv4 NAT, so im able to use update.jenkins-ci.ogr over IPv4, but still IPv6 support should be nice

[jenkins-infra-bot]

rtyler:

This is not something that's going to happen until our infra providers are more IPv6 friendly

[jenkins-infra-bot]

rtyler:

We might revisit this in a couple years once IPv6 is better supported across public cloud providers (namely Azure)
.

[jenkins-infra-bot]

vazhnov:

As I see, you use AWS instance for

 $ dig any updates.jenkins.io +short
mirrors.jenkins.io.
52.202.51.185

At 2020, AWS supports VPC and EC2 with both IPv4 + IPv6 (but not by default yet).
AWS balancers has support for IPv4 + IPv6 by default (but in this case here is no AWS balancer).

I'm reopening this ticket.

Ping me if you need any help here — for example, I can create for you Terraform code to create dedicated VPC with IPv4 + IPv6.

[jenkins-infra-bot]

olblak:

We now have www.jenkins.io, pkg.jenkins.io, and plugins.jenkins.io running on IPV6.

 

olblak@winterfell  ~  dig -t AAAA www.jenkins.io  ✔  10002  12:07:39

; <<>> DiG 9.11.3-1ubuntu1.13-Ubuntu <<>> -t AAAA www.jenkins.io
;; global options: +cmd
;; Got answer:
;; >>HEADER<< opcode: QUERY, status: NOERROR, id: 36127
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.jenkins.io. IN AAAA

;; ANSWER SECTION:
www.jenkins.io. 3600 IN CNAME dualstack.d.sni.global.fastly.net.
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42::645
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42:200::645
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42:400::645
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42:600::645

;; Query time: 113 msec
;; SERVER: 1.1.1.2#53(1.1.1.2)
;; WHEN: Mon Oct 05 12:08:00 CEST 2020
;; MSG SIZE rcvd: 202

olblak@winterfell  ~  dig -t AAAA pkg.jenkins.io  ✔  10003  12:08:00

; <<>> DiG 9.11.3-1ubuntu1.13-Ubuntu <<>> -t AAAA pkg.jenkins.io
;; global options: +cmd
;; Got answer:
;; >>HEADER<< opcode: QUERY, status: NOERROR, id: 47014
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;pkg.jenkins.io. IN AAAA

;; ANSWER SECTION:
pkg.jenkins.io. 3600 IN CNAME dualstack.d.sni.global.fastly.net.
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42::645
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42:200::645
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42:400::645
dualstack.d.sni.global.fastly.net. 30 IN AAAA 2a04:4e42:600::645

;; Query time: 108 msec
;; SERVER: 1.1.1.2#53(1.1.1.2)
;; WHEN: Mon Oct 05 12:08:07 CEST 2020
;; MSG SIZE rcvd: 202

 

[jenkins-infra-bot]

JIRAUSER134177:

I just failed to update Jenkins on my RPI which is IPv6 only.

Err:1 https://pkg.jenkins.io/debian-stable binary/ jenkins 2.303.1
  Cannot initiate the connection to get.jenkins.io:443 (52.167.253.43). - connect (101: Network is unreachable)
E: Failed to fetch https://get.jenkins.io/debian-stable/jenkins_2.303.1_all.deb  Cannot initiate the connection to get.jenkins.io:443 (52.167.253.43). - connect (101: Network is unreachable)

IPv6 is available in Azure since 2020 and I have created VMs in Azure with IPv6, so I know that it is possible.

 https://azure.microsoft.com/en-us/updates/ipv6-for-azure-virtual-network-is-now-generally-available-2/

[dduportal]

Closing by following up in #3227 (comment)