New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: kubelet: get IP based on service network IP mode for dual-stack support. #70659

Open
wants to merge 2 commits into
base: master
from

Conversation

@pmichali
Collaborator

pmichali commented Nov 5, 2018

What type of PR is this?
/kind feature

What this PR does / why we need it:
Allows kubelet to obtain the correct IP from pods, when operating in dual-stack mode.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #70653

Special notes for your reviewer:
Intent of this is to allow IPv4 only and IPv6 only to work as they do today, but adapt kubelet for when running in dual-stack cluster.

Does this PR introduce a user-facing change?:
NONE

/area ipv6
/sig network

leblancd and others added some commits Nov 5, 2018

Fix kubeadm etcd manifests to use brackets around IPv6 addrs
When 'kubeadm init ...' is used with an IPv6 kubeadm configuration,
kubeadm currently generates an etcd.yaml manifest that uses IP:port
combinatins where the IP is an IPv6 address, but it is not enclosed
in square brackets, e.g.:
    - --advertise-client-urls=https://fd00:20::2:2379
For IPv6 advertise addresses, this should be of the form:
    - --advertise-client-urls=https://[fd00:20::2]:2379

The lack of brackets around IPv6 addresses in cases like this is
causing failures to bring up IPv6-only clusters with Kubeadm as
described in kubernetes/kubeadm Issues #1212.

This format error is fixed by using net.JoinHostPort() to generate
URLs as shown above.

Fixes kubernetes/kubeadm Issue #1212
WIP: kubelet: get IP based on service network IP mode for dual-stack …
…support.

This is WIP as it relies on bug fix 70633 that fixes reggression in etcd. Once
that commit merges, this can be rebased.

In GetPodIP, the kubelet code attempts to get the IPv4 address for the
pod, and if that fails, tries to get the IPv6 address.  That works fine
for IPv4 only and IPv6 only mode, but not for dual-stack, where each
pod will have both addresses.

In addition, since dual-stack will support only a single (selectable)
family for services, we need to also ensure that kubelet is using the
same family, when getting the IP. One way to do that is to request
the IP, based on the family used for services.

With the introduction of IPv6 only mode, a DNS_SVC_IP environment
variable was defined, so that DNS used an IP that was in the family
for services. The variable can be provided to the kubelet, via a
drop-in file, as is done for kubeadm-dind-cluster.

This change makes use of that information, reading the variable, and,
if set, will use the same family as the DNS IP in the request to obtain
the pod IP. Otherwise, it will fall back on trying to get the IPv4
address, and then trying to get the IPv6 address, if no IPv4 address
is available (to support backward compatibility).

Fixes Issue: #70653

/area ipv6
/sig network
@k8s-ci-robot

This comment has been minimized.

Contributor

k8s-ci-robot commented Nov 5, 2018

@pmichali: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot

This comment has been minimized.

Contributor

k8s-ci-robot commented Nov 5, 2018

Hi @pmichali. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot

This comment has been minimized.

Contributor

k8s-ci-robot commented Nov 5, 2018

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pmichali
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: dchen1107

If they are not already assigned, you can assign the PR to them by writing /assign @dchen1107 in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@pmichali

This comment has been minimized.

Collaborator

pmichali commented Nov 5, 2018

Commit message for this change...

This is WIP as it relies on bug fix 70633 that fixes reggression in etcd. Once
that commit merges, this can be rebased.

In GetPodIP, the kubelet code attempts to get the IPv4 address for the
pod, and if that fails, tries to get the IPv6 address.  That works fine
for IPv4 only and IPv6 only mode, but not for dual-stack, where each
pod will have both addresses.

In addition, since dual-stack will support only a single (selectable)
family for services, we need to also ensure that kubelet is using the
same family, when getting the IP. One way to do that is to request
the IP, based on the family used for services.

With the introduction of IPv6 only mode, a DNS_SVC_IP environment
variable was defined, so that DNS used an IP that was in the family
for services. The variable can be provided to the kubelet, via a
drop-in file, as is done for kubeadm-dind-cluster.

This change makes use of that information, reading the variable, and,
if set, will use the same family as the DNS IP in the request to obtain
the pod IP. Otherwise, it will fall back on trying to get the IPv4
address, and then trying to get the IPv6 address, if no IPv4 address
is available (to support backward compatibility).
@pmichali

This comment has been minimized.

Collaborator

pmichali commented Nov 5, 2018

NOTE: this is WIP because regression was found in etcd for IPv6 clusters and this commit includes the cherry picked fix under PR 70633. Once that is merged, a rebase can be done for this commit.

@neolit123

@pmichali thank you for working on this change.
added some minor comments.

this would need a release note instead of NONE.
@kubernetes/sig-cluster-lifecycle-pr-reviews
/priority important-longterm

if err != nil {
return nil, err
addrType := preferredFamily()
if addrType != "" {

This comment has been minimized.

@neolit123

neolit123 Nov 5, 2018

Member

small whitespace issue.

This comment has been minimized.

@pmichali

pmichali Nov 7, 2018

Collaborator

Will address when I rebase.

@@ -90,7 +92,7 @@ func CreateStackedEtcdStaticPodManifestFile(client clientset.Interface, manifest
}
// notifies the other members of the etcd cluster about the joining member
etcdPeerAddress := fmt.Sprintf("https://%s:%d", cfg.APIEndpoint.AdvertiseAddress, kubeadmconstants.EtcdListenPeerPort)
etcdPeerAddress := fmt.Sprintf("https://%s", net.JoinHostPort(cfg.APIEndpoint.AdvertiseAddress, strconv.Itoa(kubeadmconstants.EtcdListenPeerPort)))

This comment has been minimized.

This comment has been minimized.

@pmichali

pmichali Nov 7, 2018

Collaborator

This and the following change are part of the PR 70633 commit (a fix to a regression) that this PR needs. Mention has been made on that PR to add UT changes. When it is merged, I'll rebase to pickup the latest.

@@ -282,7 +284,7 @@ func performEtcdStaticPodUpgrade(client clientset.Interface, waiter apiclient.Wa
if err != nil {
return true, errors.Wrap(err, "failed to retrieve the current etcd version")
}
currentEtcdVersionStr, ok := currentEtcdVersions[fmt.Sprintf("https://%s:%d", cfg.APIEndpoint.AdvertiseAddress, constants.EtcdListenClientPort)]
currentEtcdVersionStr, ok := currentEtcdVersions[fmt.Sprintf("https://%s", net.JoinHostPort(cfg.APIEndpoint.AdvertiseAddress, strconv.Itoa(constants.EtcdListenClientPort)))]

This comment has been minimized.

This comment has been minimized.

@pmichali

pmichali Nov 7, 2018

Collaborator

see above.

@k8s-ci-robot

This comment has been minimized.

Contributor

k8s-ci-robot commented Nov 10, 2018

@pmichali: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment