fix: Restore IPv6-only Cilium networking in containerlab labs - #411
Open
privateip wants to merge 1 commit into
Open
fix: Restore IPv6-only Cilium networking in containerlab labs#411privateip wants to merge 1 commit into
privateip wants to merge 1 commit into
Conversation
deploy-cni.sh set --set enableIPv4=false --set enableIPv6=true when installing Cilium, but no Cilium chart version defines those flat keys (checked v1.18.2, the CLI's unpinned default, and v1.20.0, the CLI's "stable" -- both only expose the nested ipv4.enabled/ipv6.enabled). The --set was a silent no-op, so Cilium fell back to its real default (IPv4 enabled, IPv6 disabled) and allocated pod addresses from 10.0.0.0/8 -- unreachable from these IPv6-only clusters (--service-cluster-ip-range=fd00:200::/108), which is why CoreDNS and any pod scheduled off the edge-labeled node could never reach the apiserver service and sat at 0/1 Ready. Switch to the real chart keys (ipv4.enabled, ipv6.enabled, ipam.operator.clusterPoolIPv6PodCIDRList, clusterPoolIPv6MaskSize). Also make the Cilium install step actually idempotent: `cilium install` refuses to touch an existing Helm release but doesn't fail the outer script (the error is printed by the inner `bash -c`, which had no `set -e` of its own, so it fell through to a passing `cilium status --wait` against the untouched old release and exited 0) -- add `set -e` to the inner script and fall back to `cilium upgrade` when a release already exists, so a rerun against an already-cilium'd node actually applies this fix instead of silently keeping the old config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CoreDNS (and any pod scheduled off the edge-labeled node) sat at 0/1 Ready in the containerlab labs because Cilium silently fell back to IPv4-only pod networking, which can't reach these clusters' IPv6-only Kubernetes service network. The
--setflags meant to force Cilium into IPv6-only mode referenced keys that don't exist in any Cilium chart, so they were ignored. This switches to the real chart keys and makes the install step idempotent so a rerun actually applies the fix instead of silently keeping the broken config.Note
This fixes the install path for a fresh cluster. Live-upgrading an already-broken cluster to IPv6-only may still need manual repair of stale per-node IPAM state left over from the IPv4 allocation.
Test plan
task deploybrings up Cilium IPv6-only and CoreDNS reaches Ready on all three sitesdeploy-cni.shagainst an already-provisioned cluster upgrades Cilium instead of silently no-op'ing