Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
- For the linkerd-control-plane chart added the values.yaml entry `disableIPv6`, defaulting to false. If we wan't to explicitly set `disableIPv6=true`, the proxy-init v2.3.0 (containing linkerd/linkerd2-proxy-init#350) needs to be used, otherwise proxy-init will error out because of the unknown flag.
- For the linkerd2-cni chart added the entries `iptablesMode` (defaults to "legacy") and `disableIPv6` (defaults to false). These flags can still be passed to the current proxy-init version (without  linkerd/linkerd2-proxy-init#350) and will simply be ignored.

Note this allows routing IPv6 traffic to the proxy by default, but it's just the first step towards IPv6/dual-stack support. More control plane and proxy changes will come next.
  • Loading branch information
alpeb committed Mar 19, 2024
1 parent 5915ef5 commit 45f2782
Show file tree
Hide file tree
Showing 34 changed files with 68 additions and 9 deletions.
1 change: 1 addition & 0 deletions charts/linkerd-control-plane/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,7 @@ Kubernetes: `>=1.22.0-0`
| debugContainer.image.version | string | linkerdVersion | Tag for the debug container image |
| deploymentStrategy | object | `{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"}}` | default kubernetes deployment strategy |
| disableHeartBeat | bool | `false` | Set to true to not start the heartbeat cronjob |
| disableIPv6 | bool | `false` | disables routing IPv6 traffic in addition to IPv4 traffic through the proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni v1.4.0) |
| enableEndpointSlices | bool | `true` | enables the use of EndpointSlice informers for the destination service; enableEndpointSlices should be set to true only if EndpointSlice K8s feature gate is on |
| enableH2Upgrade | bool | `true` | Allow proxies to perform transparent HTTP/2 upgrading |
| enablePSP | bool | `false` | Add a PSP resource and bind it to the control plane ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
Expand Down
4 changes: 4 additions & 0 deletions charts/linkerd-control-plane/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@ enablePodAntiAffinity: false
enablePprof: false
# -- enables the creation of pod disruption budgets for control plane components
enablePodDisruptionBudget: false
# -- disables routing IPv6 traffic in addition to IPv4 traffic through the
# proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni
# v1.4.0)
disableIPv6: false

controller:
# -- sets pod disruption budget parameter for all deployments
Expand Down
2 changes: 2 additions & 0 deletions charts/linkerd2-cni/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ Kubernetes: `>=1.22.0-0`
| commonLabels | object | `{}` | Labels to apply to all resources |
| destCNIBinDir | string | `"/opt/cni/bin"` | Directory on the host where the CNI configuration will be placed |
| destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside |
| disableIPv6 | bool | `false` | Disables adding IPv6 rules on top of IPv4 rules |
| enablePSP | bool | `false` | Add a PSP resource and bind it to the linkerd-cni ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
| extraInitContainers | list | `[]` | Add additional initContainers to the daemonset |
| ignoreInboundPorts | string | `""` | Default set of inbound ports to skip via iptables |
Expand All @@ -34,6 +35,7 @@ Kubernetes: `>=1.22.0-0`
| image.version | string | `"v1.3.0"` | Tag for the CNI container Docker image |
| imagePullSecrets | list | `[]` | |
| inboundProxyPort | int | `4143` | Inbound port for the proxy container |
| iptablesMode | string | `"legacy"` | Variant of iptables that will be used to configure routing |
| logLevel | string | `"info"` | Log level for the CNI plugin |
| outboundProxyPort | int | `4140` | Outbound port for the proxy container |
| podLabels | object | `{}` | Additional labels to add to all pods |
Expand Down
5 changes: 4 additions & 1 deletion charts/linkerd2-cni/templates/cni-plugin.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,7 @@ data:
dest_cni_bin_dir: "{{.Values.destCNIBinDir}}"
# The CNI network configuration to install on each node. The special
# values in this config will be automatically populated.
# iptables-mode and ipv6 flags are only considered as of linkerd-cni v1.4.0
cni_network_config: |-
{
"name": "linkerd-cni",
Expand All @@ -176,7 +177,9 @@ data:
],
{{- end }}
"simulate": false,
"use-wait-flag": {{.Values.useWaitFlag}}
"use-wait-flag": {{.Values.useWaitFlag}},
"iptables-mode": {{.Values.iptablesMode | quote}},
"ipv6": {{ternary "false" "true" .Values.disableIPv6 }}
}
}
---
Expand Down
4 changes: 4 additions & 0 deletions charts/linkerd2-cni/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ destCNINetDir: "/etc/cni/net.d"
destCNIBinDir: "/opt/cni/bin"
# -- Configures the CNI plugin to use the -w flag for the iptables command
useWaitFlag: false
# -- Variant of iptables that will be used to configure routing
iptablesMode: "legacy"
# -- Disables adding IPv6 rules on top of IPv4 rules
disableIPv6: false
# -- Kubernetes priorityClassName for the CNI plugin's Pods
priorityClassName: ""

Expand Down
3 changes: 3 additions & 0 deletions charts/partials/templates/_proxy-init.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ args:
- "iptables-nft-save"
{{- else if not (eq .Values.proxyInit.iptablesMode "legacy") }}
{{ fail (printf "Unsupported value \"%s\" for proxyInit.iptablesMode\nValid values: [\"nft\", \"legacy\"]" .Values.proxyInit.iptablesMode) }}
{{end -}}
{{- if .Values.disableIPv6 }}
- --ipv6=false
{{- end }}
- --incoming-proxy-port
- {{.Values.proxy.ports.inbound | quote}}
Expand Down
5 changes: 4 additions & 1 deletion cli/cmd/testdata/install-cni-plugin_default.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install-cni-plugin_fully_configured.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install-cni-plugin_skip_ports.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install_cni_helm_default_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install_cni_helm_override_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_custom_domain.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_custom_registry.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_default.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_default_token.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_ha_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_ha_with_overrides_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_heartbeat_disabled_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_helm_control_plane_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_helm_output_ha_labels.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_no_init_container.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_proxy_ignores.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_values_file.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion justfile
Original file line number Diff line number Diff line change
Expand Up @@ -464,7 +464,7 @@ _linkerd-viz-uninit:

##
## linkerd multicluster
##
##

_mc-target-k3d-flags := "--k3s-arg --disable='local-storage,metrics-server@server:*' --k3s-arg '--cluster-cidr=10.23.0.0/24@server:*'"

Expand Down
2 changes: 2 additions & 0 deletions pkg/charts/cni/values.go
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,8 @@ type Values struct {
CommonLabels map[string]string `json:"commonLabels"`
ImagePullSecrets []map[string]string `json:"imagePullSecrets"`
ExtraInitContainers []interface{} `json:"extraInitContainers"`
IptablesMode string `json:"iptablesMode"`
DisableIPv6 bool `json:"disableIPv6"`
EnablePSP bool `json:"enablePSP"`
Privileged bool `json:"privileged"`
Resources Resources `json:"resources"`
Expand Down
1 change: 1 addition & 0 deletions pkg/charts/linkerd2/values.go
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ type (
HighAvailability bool `json:"highAvailability"`
CNIEnabled bool `json:"cniEnabled"`
EnableEndpointSlices bool `json:"enableEndpointSlices"`
DisableIPv6 bool `json:"disableIPv6"`
ControlPlaneTracing bool `json:"controlPlaneTracing"`
ControlPlaneTracingNamespace string `json:"controlPlaneTracingNamespace"`
IdentityTrustAnchorsPEM string `json:"identityTrustAnchorsPEM"`
Expand Down
1 change: 1 addition & 0 deletions pkg/charts/linkerd2/values_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ func TestNewValues(t *testing.T) {
PodAnnotations: map[string]string{},
PodLabels: map[string]string{},
EnableEndpointSlices: true,
DisableIPv6: false,
EnablePodDisruptionBudget: false,
Controller: &Controller{
PodDisruptionBudget: &PodDisruptionBudget{
Expand Down

0 comments on commit 45f2782

Please sign in to comment.