NFS interruption when IPv6 GUA renews with privacy extensions & gai.conf

[gregwalters]

I've got several pods using NFS-backed storage that hang for a bit, potentially fail a health check, and restart nearly every time a node renews its IPv6 GUA.

Describe on a pod shows:

  Warning  Unhealthy  20m (x28 over 75m)  kubelet  Readiness probe failed: command timed out: "/bin/bash -ec /health/ping_readiness_local.sh 1" timed out after 2s
  Warning  Unhealthy  20m (x14 over 75m)  kubelet  Liveness probe failed: command timed out: "/bin/bash -ec /health/ping_liveness_local.sh 5" timed out after 6s
  Normal   Killing    20m (x3 over 75m)   kubelet  Container redis failed liveness probe, will be restarted

From host logs (time lines up as about 20 minutes ago):

2025-12-03 12:12:11.000000000
[talos] assigned address {"component": "controller-runtime", "controller": "network.AddressSpecController", "address": "<removed>::aa5/128", "link": "enp37s0"} 
2025-12-03 12:12:11.000000000
[talos] removed address <removed>::5f4/128 from "enp37s0" {"component": "controller-runtime", "controller": "network.AddressSpecController"} 

Reading /proc/mounts on a node shows addresses that aren't in use any more:

$ t -n kube0 read /proc/mounts |grep nfs
<nfs host>:/mnt/raid/docker_volumes/pvc-0c877670-ceb3-498c-8e25-f5ef6201f411 /var/lib/kubelet/pods/ee0daf02-f00a-40ff-9ec4-524ecce508e7/volumes/kubernetes.io~nfs/pvc-0c877670-ceb3-498c-8e25-f5ef6201f411 nfs4 rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp6,timeo=600,retrans=2,sec=sys,clientaddr=<removed>::4ba,local_lock=none,addr=<removed>::70e 0 0
<nfs host>:/mnt/raid/docker_volumes/pvc-1019a871-7ce2-49ac-9389-93d4d282e024 /var/lib/kubelet/pods/e299f278-2511-4528-817b-eccd60c7e787/volumes/kubernetes.io~nfs/pvc-1019a871-7ce2-49ac-9389-93d4d282e024 nfs4 rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp6,timeo=600,retrans=2,sec=sys,clientaddr=<removed>::4ba,local_lock=none,addr=<removed>::70e 0 0
<nfs host>:/mnt/raid/docker_volumes/lemmy/lemmy /var/lib/kubelet/pods/7d66d1b8-9385-4609-9405-466391a5aebc/volumes/kubernetes.io~nfs/lemmy nfs4 rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp6,timeo=600,retrans=2,sec=sys,clientaddr=<removed>::4ba,local_lock=none,addr=<removed>::70e 0 0

Addresses associated with the same node:

$ t -n kube0 get addresses |grep enp |grep :
kube0   network     AddressStatus   enp37s0/<removed full GUA>:7ef4/64   1         <removed full GUA>:7ef4/64   enp37s0
kube0   network     AddressStatus   enp37s0/<removed short GUA>::f32/128                 2         <removed short GUA>::f32/128                 enp37s0
kube0   network     AddressStatus   enp37s0/<removed ULA>:7ef4/64    2         <removed ULA>:7ef4/64    enp37s0
kube0   network     AddressStatus   enp37s0/<removed LLA>:7ef4/64                 2         <removed LLA>:7ef4/64                 enp37s0

On my network GUAs change pretty frequently. Every 15 minutes or so it seems. But, ULA are more-or-less static. I'd love to be able to set /etc/gai.conf or otherwise configure talos to prefer ULA over GLA when connecting to NFS mounts but can't figure out how. If I set files: in my MachineConfig I get an error about writing outside of /var. Any ideas? My NFS server has a GUA and ULA that both get discovered by the talos nodes via neighbor discovery.

[gregwalters]

While I haven't figured out how to address this client-side, I did come across a fix that works server-side. I restricted the allowed addresses for the NFS mount to just the ULA and now when clients attempt to connect with their GUA they're denied and apparently retry with another assigned address.

Since implementing I'm seeing the correct addresses used for the connections and no pod restarts due to storage hangs.