Enable forwarding IPv6 connections through the proxy #12495
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
adleong
approved these changes
Apr 24, 2024
alpeb
force-pushed
the
alpeb/LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
branch
3 times, most recently
from
e3c33b1
to
98eacf4
Compare
As part of the ongoing effort to support IPv6/dual-stack networks, this change enables the proxy to properly forward IPv6 connections: - Adds the new `LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS` environment variable when injecting the proxy. This is supported as of proxy v2.228.0 which was just pulled into the linkerd2 repo in #2d5085b56e465ef56ed4a178dfd766a3e16a631d. This adds the IPv6 loopback address (`[::1]`) to the IPv4 one (`127.0.0.1`) so the proxy can forward outbound connections received via IPv6. The injector will still inject `LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR` to support the rare case where the `proxy.image.version` value is overridden with an older version. The new proxy still considers that variable, but it's superseded by the new one. The old variable is considered deprecated and should be removed in the future. - The values for `LINKERD2_PROXY_CONTROL_LISTEN_ADDR`, `LINKERD2_PROXY_ADMIN_LISTEN_ADDR` and `LINKERD2_PROXY_INBOUND_LISTEN_ADDR` have been updated to point to the IPv6 wildcard address (`[::]`) instead of the IPv4 one (`0.0.0.0`) for the same reason. Unlike with the loopback address, the IPv6 wildcard address suffices to capture both IPv4 and IPv6 traffic. - The endpoint translator's `getInboundPort()` has been updated to properly parse the IPv6 loopback address retrieved from the proxy container manifest. A unit test was added to validate the behavior.
… with IPv6 addresses
alpeb
force-pushed
the
alpeb/LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
branch
from
98eacf4
to
76f598d
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As part of the ongoing effort to support IPv6/dual-stack networks, this change enables the proxy to properly forward IPv6 connections:
LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRSenvironment variable when injecting the proxy. This is supported as of proxy v2.228.0 which was just pulled into the linkerd2 repo in 2d5085b. This adds the IPv6 loopback address ([::1]) to the IPv4 one (127.0.0.1) so the proxy can forward outbound connections received via IPv6. The injector will still injectLINKERD2_PROXY_OUTBOUND_LISTEN_ADDRto support the rare case where theproxy.image.versionvalue is overridden with an older version. The new proxy still considers that variable, but it's superseded by the new one. The old variable is considered deprecated and should be removed in the future.LINKERD2_PROXY_CONTROL_LISTEN_ADDR,LINKERD2_PROXY_ADMIN_LISTEN_ADDRandLINKERD2_PROXY_INBOUND_LISTEN_ADDRhave been updated to point to the IPv6 wildcard address ([::]) instead of the IPv4 one (0.0.0.0) for the same reason. Unlike with the loopback address, the IPv6 wildcard address suffices to capture both IPv4 and IPv6 traffic.getInboundPort()has been updated to properly parse the IPv6 loopback address retrieved from the proxy container manifest. A unit test was added to validate the behavior.Edit:
Updated
norelay_test.goand the prometheus metrics matching utilities to properly deal with IPv6 addresses,