[nginx] Explicitly Bind ipv4 and ipv6

[InAnimaTe]

Version: 0.9.0-beta.3

Right now, we utilize the ipv6only=off option with our listen [::]:80:

        listen [::]:80 default_server ipv6only=off reuseport backlog=511;
        listen [::]:443   default_server ipv6only=off reuseport backlog=511 ssl http2;

Unfortunately, this creates a weird result for incoming connections (echo-server printout):

-> My Pod Name is: echo-server-2244472294-t9wn4
-> My Pod Namespace is: development
-> My Pod IP is: 10.2.0.246

-> Requesting IP: 10.2.2.0:53912

-> Request Headers | 

  HTTP/1.1 GET /

  Host: echo.example.net
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Cache-Control: max-age=0
  Connection: close
  Upgrade-Insecure-Requests: 1
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
  X-Forwarded-For: ::ffff:192.168.1.149
  X-Forwarded-Host: echo.example.net
  X-Forwarded-Port: 80
  X-Forwarded-Proto: http
  X-Original-Uri: /
  X-Real-Ip: ::ffff:192.168.1.149
  X-Scheme: http

Note that the connection above comes from my laptop (1.149) which is ipv4 all the way to the node this container is running on (we don't have ipv6 enabled at all). Yet, Forwarded-For and Real-Ip both show :ffff:192.168.1.149, an ipv6 representation of the source.

I think the best way to mitigate this is by explicitly creating the ipv4 and ipv6 sockets:

        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;

Some relevant linkage:

https://trac.nginx.org/nginx/ticket/364
https://trac.nginx.org/nginx/ticket/455#comment:1
https://stefanchrist.eu/blog/2015_01_21/Using%20ipv6only%20in%20Nginx.xhtml
http://serverfault.com/questions/512054/globally-setting-ipv6only-off

[gianrubio]

@InAnimaTe try to use the disable-ipv6 option in your configmap.

[InAnimaTe]

@gianrubio Yes that's actually what I'm using at the moment, since we don't have any ipv6 infra anyway. Either way, I think the core implementation of this feature isn't yielding the result most people will actually want.

[gianrubio]

@aledbf I reproduce the same behaviour with ipv6 enabled and with only ipv4 connections.

WDYT about moving this listen options to a function into the template?

[aledbf]

@gianrubio @gianrubio I will change this detecting if ipv6 is enabled in the code and defining a listener per protocol version