241 lines
7.7 KiB
Markdown
241 lines
7.7 KiB
Markdown
---
|
|
reviewers:
|
|
- lachie83
|
|
- khenidak
|
|
- bridgetkromhout
|
|
min-kubernetes-server-version: v1.23
|
|
title: Validate IPv4/IPv6 dual-stack
|
|
content_type: task
|
|
---
|
|
|
|
<!-- overview -->
|
|
This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clusters.
|
|
|
|
|
|
## {{% heading "prerequisites" %}}
|
|
|
|
|
|
* Provider support for dual-stack networking (Cloud provider or otherwise must be able to provide Kubernetes nodes with routable IPv4/IPv6 network interfaces)
|
|
* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack networking.
|
|
* [Dual-stack enabled](/docs/concepts/services-networking/dual-stack/) cluster
|
|
|
|
{{< version-check >}}
|
|
|
|
{{< note >}}
|
|
While you can validate with an earlier version, the feature is only GA and officially supported since v1.23.
|
|
{{< /note >}}
|
|
|
|
|
|
<!-- steps -->
|
|
|
|
## Validate addressing
|
|
|
|
### Validate node addressing
|
|
|
|
Each dual-stack Node should have a single IPv4 block and a single IPv6 block allocated. Validate that IPv4/IPv6 Pod address ranges are configured by running the following command. Replace the sample node name with a valid dual-stack Node from your cluster. In this example, the Node's name is `k8s-linuxpool1-34450317-0`:
|
|
|
|
```shell
|
|
kubectl get nodes k8s-linuxpool1-34450317-0 -o go-template --template='{{range .spec.podCIDRs}}{{printf "%s\n" .}}{{end}}'
|
|
```
|
|
```
|
|
10.244.1.0/24
|
|
2001:db8::/64
|
|
```
|
|
There should be one IPv4 block and one IPv6 block allocated.
|
|
|
|
Validate that the node has an IPv4 and IPv6 interface detected. Replace node name with a valid node from the cluster. In this example the node name is `k8s-linuxpool1-34450317-0`:
|
|
|
|
```shell
|
|
kubectl get nodes k8s-linuxpool1-34450317-0 -o go-template --template='{{range .status.addresses}}{{printf "%s: %s\n" .type .address}}{{end}}'
|
|
```
|
|
```
|
|
Hostname: k8s-linuxpool1-34450317-0
|
|
InternalIP: 10.0.0.5
|
|
InternalIP: 2001:db8:10::5
|
|
```
|
|
|
|
### Validate Pod addressing
|
|
|
|
Validate that a Pod has an IPv4 and IPv6 address assigned. Replace the Pod name with a valid Pod in your cluster. In this example the Pod name is `pod01`:
|
|
|
|
```shell
|
|
kubectl get pods pod01 -o go-template --template='{{range .status.podIPs}}{{printf "%s\n" .ip}}{{end}}'
|
|
```
|
|
```
|
|
10.244.1.4
|
|
2001:db8::4
|
|
```
|
|
|
|
You can also validate Pod IPs using the Downward API via the `status.podIPs` fieldPath. The following snippet demonstrates how you can expose the Pod IPs via an environment variable called `MY_POD_IPS` within a container.
|
|
|
|
```
|
|
env:
|
|
- name: MY_POD_IPS
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIPs
|
|
```
|
|
|
|
The following command prints the value of the `MY_POD_IPS` environment variable from within a container. The value is a comma separated list that corresponds to the Pod's IPv4 and IPv6 addresses.
|
|
|
|
```shell
|
|
kubectl exec -it pod01 -- set | grep MY_POD_IPS
|
|
```
|
|
```
|
|
MY_POD_IPS=10.244.1.4,2001:db8::4
|
|
```
|
|
|
|
The Pod's IP addresses will also be written to `/etc/hosts` within a container. The following command executes a cat on `/etc/hosts` on a dual stack Pod. From the output you can verify both the IPv4 and IPv6 IP address for the Pod.
|
|
|
|
```shell
|
|
kubectl exec -it pod01 -- cat /etc/hosts
|
|
```
|
|
```
|
|
# Kubernetes-managed hosts file.
|
|
127.0.0.1 localhost
|
|
::1 localhost ip6-localhost ip6-loopback
|
|
fe00::0 ip6-localnet
|
|
fe00::0 ip6-mcastprefix
|
|
fe00::1 ip6-allnodes
|
|
fe00::2 ip6-allrouters
|
|
10.244.1.4 pod01
|
|
2001:db8::4 pod01
|
|
```
|
|
|
|
## Validate Services
|
|
|
|
Create the following Service that does not explicitly define `.spec.ipFamilyPolicy`. Kubernetes will assign a cluster IP for the Service from the first configured `service-cluster-ip-range` and set the `.spec.ipFamilyPolicy` to `SingleStack`.
|
|
|
|
{{% code_sample file="service/networking/dual-stack-default-svc.yaml" %}}
|
|
|
|
Use `kubectl` to view the YAML for the Service.
|
|
|
|
```shell
|
|
kubectl get svc my-service -o yaml
|
|
```
|
|
|
|
The Service has `.spec.ipFamilyPolicy` set to `SingleStack` and `.spec.clusterIP` set to an IPv4 address from the first configured range set via `--service-cluster-ip-range` flag on kube-controller-manager.
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: my-service
|
|
namespace: default
|
|
spec:
|
|
clusterIP: 10.0.217.164
|
|
clusterIPs:
|
|
- 10.0.217.164
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
targetPort: 9376
|
|
selector:
|
|
app.kubernetes.io/name: MyApp
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
status:
|
|
loadBalancer: {}
|
|
```
|
|
|
|
Create the following Service that explicitly defines `IPv6` as the first array element in `.spec.ipFamilies`. Kubernetes will assign a cluster IP for the Service from the IPv6 range configured `service-cluster-ip-range` and set the `.spec.ipFamilyPolicy` to `SingleStack`.
|
|
|
|
{{% code_sample file="service/networking/dual-stack-ipfamilies-ipv6.yaml" %}}
|
|
|
|
Use `kubectl` to view the YAML for the Service.
|
|
|
|
```shell
|
|
kubectl get svc my-service -o yaml
|
|
```
|
|
|
|
The Service has `.spec.ipFamilyPolicy` set to `SingleStack` and `.spec.clusterIP` set to an IPv6 address from the IPv6 range set via `--service-cluster-ip-range` flag on kube-controller-manager.
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: MyApp
|
|
name: my-service
|
|
spec:
|
|
clusterIP: 2001:db8:fd00::5118
|
|
clusterIPs:
|
|
- 2001:db8:fd00::5118
|
|
ipFamilies:
|
|
- IPv6
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
targetPort: 80
|
|
selector:
|
|
app.kubernetes.io/name: MyApp
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
status:
|
|
loadBalancer: {}
|
|
```
|
|
|
|
Create the following Service that explicitly defines `PreferDualStack` in `.spec.ipFamilyPolicy`. Kubernetes will assign both IPv4 and IPv6 addresses (as this cluster has dual-stack enabled) and select the `.spec.ClusterIP` from the list of `.spec.ClusterIPs` based on the address family of the first element in the `.spec.ipFamilies` array.
|
|
|
|
{{% code_sample file="service/networking/dual-stack-preferred-svc.yaml" %}}
|
|
|
|
{{< note >}}
|
|
The `kubectl get svc` command will only show the primary IP in the `CLUSTER-IP` field.
|
|
|
|
```shell
|
|
kubectl get svc -l app.kubernetes.io/name=MyApp
|
|
|
|
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
|
my-service ClusterIP 10.0.216.242 <none> 80/TCP 5s
|
|
```
|
|
{{< /note >}}
|
|
|
|
Validate that the Service gets cluster IPs from the IPv4 and IPv6 address blocks using `kubectl describe`. You may then validate access to the service via the IPs and ports.
|
|
|
|
```shell
|
|
kubectl describe svc -l app.kubernetes.io/name=MyApp
|
|
```
|
|
|
|
```
|
|
Name: my-service
|
|
Namespace: default
|
|
Labels: app.kubernetes.io/name=MyApp
|
|
Annotations: <none>
|
|
Selector: app.kubernetes.io/name=MyApp
|
|
Type: ClusterIP
|
|
IP Family Policy: PreferDualStack
|
|
IP Families: IPv4,IPv6
|
|
IP: 10.0.216.242
|
|
IPs: 10.0.216.242,2001:db8:fd00::af55
|
|
Port: <unset> 80/TCP
|
|
TargetPort: 9376/TCP
|
|
Endpoints: <none>
|
|
Session Affinity: None
|
|
Events: <none>
|
|
```
|
|
|
|
### Create a dual-stack load balanced Service
|
|
|
|
If the cloud provider supports the provisioning of IPv6 enabled external load balancers, create the following Service with `PreferDualStack` in `.spec.ipFamilyPolicy`, `IPv6` as the first element of the `.spec.ipFamilies` array and the `type` field set to `LoadBalancer`.
|
|
|
|
{{% code_sample file="service/networking/dual-stack-prefer-ipv6-lb-svc.yaml" %}}
|
|
|
|
Check the Service:
|
|
|
|
```shell
|
|
kubectl get svc -l app.kubernetes.io/name=MyApp
|
|
```
|
|
|
|
Validate that the Service receives a `CLUSTER-IP` address from the IPv6 address block along with an `EXTERNAL-IP`. You may then validate access to the service via the IP and port.
|
|
|
|
```shell
|
|
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
|
my-service LoadBalancer 2001:db8:fd00::7ebc 2603:1030:805::5 80:30790/TCP 35s
|
|
```
|
|
|
|
|