Skip to content

K
k3s
Commit d4c3422a authored by Brad Davidson's avatar Brad Davidson Committed by Brad Davidson
Browse files
Options

Fix ipv6 sysctl required by non-ipv6 LoadBalancer service

This is a partial revert of 095ecdb0, with the workaround moved into klipper-lb. Signed-off-by: 's avatarBrad Davidson <brad.davidson@rancher.com>
parent 21611c56
Hide whitespace changes
Inline Side-by-side
Showing with 14 additions and 12 deletions
pkg/cloudprovider/servicelb.go
View file @ d4c3422a
...@@ -52,7 +52,7 @@ const ( ...@@ -52,7 +52,7 @@ const (
) )
var ( var (
DefaultLBImage = "rancher/klipper-lb:v0.4.7" DefaultLBImage = "rancher/klipper-lb:v0.4.9"
) )
func (k *k3s) Register(ctx context.Context, func (k *k3s) Register(ctx context.Context,
...@@ -437,12 +437,19 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) { ...@@ -437,12 +437,19 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
return nil, err return nil, err
} }
sourceRanges := strings.Join(sourceRangesSet.StringSlice(), ",") sourceRanges := strings.Join(sourceRangesSet.StringSlice(), ",")
securityContext := &core.PodSecurityContext{}
for _, ipFamily := range svc.Spec.IPFamilies { for _, ipFamily := range svc.Spec.IPFamilies {
if ipFamily == core.IPv6Protocol && sourceRanges == "0.0.0.0/0" { switch ipFamily {
// The upstream default load-balancer source range only includes IPv4, even if the service is IPv6-only or dual-stack. case core.IPv4Protocol:
// If using the default range, and IPv6 is enabled, also allow IPv6. securityContext.Sysctls = append(securityContext.Sysctls, core.Sysctl{Name: "net.ipv4.ip_forward", Value: "1"})
sourceRanges += ",::/0" case core.IPv6Protocol:
securityContext.Sysctls = append(securityContext.Sysctls, core.Sysctl{Name: "net.ipv6.conf.all.forwarding", Value: "1"})
if sourceRanges == "0.0.0.0/0" {
// The upstream default load-balancer source range only includes IPv4, even if the service is IPv6-only or dual-stack.
// If using the default range, and IPv6 is enabled, also allow IPv6.
sourceRanges += ",::/0"
}
} }
} }
...@@ -478,12 +485,7 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) { ...@@ -478,12 +485,7 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
PriorityClassName: priorityClassName, PriorityClassName: priorityClassName,
ServiceAccountName: "svclb", ServiceAccountName: "svclb",
AutomountServiceAccountToken: utilsptr.To(false), AutomountServiceAccountToken: utilsptr.To(false),
SecurityContext: &core.PodSecurityContext{ SecurityContext: securityContext,
Sysctls: []core.Sysctl{
{Name: "net.ipv4.ip_forward", Value: "1"},
{Name: "net.ipv6.conf.all.forwarding", Value: "1"},
},
},
Tolerations: []core.Toleration{ Tolerations: []core.Toleration{
{ {
Key: util.MasterRoleLabelKey, Key: util.MasterRoleLabelKey,
......
scripts/airgap/image-list.txt
View file @ d4c3422a
docker.io/rancher/klipper-helm:v0.8.4-build20240523 docker.io/rancher/klipper-helm:v0.8.4-build20240523
docker.io/rancher/klipper-lb:v0.4.7 docker.io/rancher/klipper-lb:v0.4.9
docker.io/rancher/local-path-provisioner:v0.0.28 docker.io/rancher/local-path-provisioner:v0.0.28
docker.io/rancher/mirrored-coredns-coredns:1.10.1 docker.io/rancher/mirrored-coredns-coredns:1.10.1
docker.io/rancher/mirrored-library-busybox:1.36.1 docker.io/rancher/mirrored-library-busybox:1.36.1
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment