Use IPv6-enabled proxy-init (#12249)

Followup to linkerd/linkerd2-proxy-init#350

- For the linkerd-control-plane chart added the values.yaml entry `disableIPv6`, defaulting to false. 
- For the linkerd2-cni chart added the entries `iptablesMode` (defaults to "legacy") and `disableIPv6` (defaults to false).

Note this allows routing IPv6 traffic to the proxy by default, but it's just the first step towards IPv6/dual-stack support. More control plane and proxy changes will come next.

Co-authored-by: Oliver Gould <ver@buoyant.io>

charts/linkerd-control-plane/README.md

@@ -159,6 +159,7 @@ Kubernetes: `>=1.22.0-0`
 | debugContainer.image.version | string | linkerdVersion | Tag for the debug container image |
 | deploymentStrategy | object | `{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"}}` | default kubernetes deployment strategy |
 | disableHeartBeat | bool | `false` | Set to true to not start the heartbeat cronjob |
+| disableIPv6 | bool | `false` | disables routing IPv6 traffic in addition to IPv4 traffic through the proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni v1.4.0) |
 | enableEndpointSlices | bool | `true` | enables the use of EndpointSlice informers for the destination service; enableEndpointSlices should be set to true only if EndpointSlice K8s feature gate is on |
 | enableH2Upgrade | bool | `true` | Allow proxies to perform transparent HTTP/2 upgrading |
 | enablePSP | bool | `false` | Add a PSP resource and bind it to the control plane ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |

charts/linkerd-control-plane/values.yaml

@@ -39,6 +39,10 @@ enablePodAntiAffinity: false
 enablePprof: false
 # -- enables the creation of pod disruption budgets for control plane components
 enablePodDisruptionBudget: false
+# -- disables routing IPv6 traffic in addition to IPv4 traffic through the
+# proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni
+# v1.4.0)
+disableIPv6: false
 
 controller:
   # -- sets pod disruption budget parameter for all deployments

charts/linkerd2-cni/README.md

@@ -25,6 +25,7 @@ Kubernetes: `>=1.22.0-0`
 | commonLabels | object | `{}` | Labels to apply to all resources |
 | destCNIBinDir | string | `"/opt/cni/bin"` | Directory on the host where the CNI configuration will be placed |
 | destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside |
+| disableIPv6 | bool | `false` | Disables adding IPv6 rules on top of IPv4 rules |
 | enablePSP | bool | `false` | Add a PSP resource and bind it to the linkerd-cni ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
 | extraInitContainers | list | `[]` | Add additional initContainers to the daemonset |
 | ignoreInboundPorts | string | `""` | Default set of inbound ports to skip via iptables |
@@ -34,6 +35,7 @@ Kubernetes: `>=1.22.0-0`
 | image.version | string | `"v1.4.0"` | Tag for the CNI container Docker image |
 | imagePullSecrets | list | `[]` |  |
 | inboundProxyPort | int | `4143` | Inbound port for the proxy container |
+| iptablesMode | string | `"legacy"` | Variant of iptables that will be used to configure routing |
 | logLevel | string | `"info"` | Log level for the CNI plugin |
 | outboundProxyPort | int | `4140` | Outbound port for the proxy container |
 | podLabels | object | `{}` | Additional labels to add to all pods |

charts/linkerd2-cni/templates/cni-plugin.yaml

@@ -150,6 +150,7 @@ data:
   dest_cni_bin_dir: "{{.Values.destCNIBinDir}}"
   # The CNI network configuration to install on each node. The special
   # values in this config will be automatically populated.
+  # iptables-mode and ipv6 flags are only considered as of linkerd-cni v1.4.0
   cni_network_config: |-
     {
       "name": "linkerd-cni",
@@ -176,7 +177,9 @@ data:
         ],
         {{- end }}
         "simulate": false,
-        "use-wait-flag": {{.Values.useWaitFlag}}
+        "use-wait-flag": {{.Values.useWaitFlag}},
+        "iptables-mode": {{.Values.iptablesMode | quote}},
+        "ipv6": {{.Values.disableIPv6 | ternary "false" "true"}}
       }
     }
 ---

charts/linkerd2-cni/values.yaml

@@ -26,6 +26,10 @@ destCNINetDir:    "/etc/cni/net.d"
 destCNIBinDir:    "/opt/cni/bin"
 # -- Configures the CNI plugin to use the -w flag for the iptables command
 useWaitFlag:      false
+# -- Variant of iptables that will be used to configure routing
+iptablesMode: "legacy"
+# -- Disables adding IPv6 rules on top of IPv4 rules
+disableIPv6: false
 # -- Kubernetes priorityClassName for the CNI plugin's Pods
 priorityClassName: ""
 

charts/partials/templates/_proxy-init.tpl

@@ -7,6 +7,9 @@ args:
 - "iptables-nft-save"
 {{- else if not (eq .Values.proxyInit.iptablesMode "legacy") }}
 {{ fail (printf "Unsupported value \"%s\" for proxyInit.iptablesMode\nValid values: [\"nft\", \"legacy\"]" .Values.proxyInit.iptablesMode) }}
+{{end -}}
+{{- if .Values.disableIPv6 }}
+- --ipv6=false
 {{- end }}
 - --incoming-proxy-port
 - {{.Values.proxy.ports.inbound | quote}}

justfile

@@ -463,7 +463,7 @@ _linkerd-viz-uninit:
 
 ##
 ## linkerd multicluster
-## 
+##
 
 _mc-target-k3d-flags := "--k3s-arg --disable='local-storage,metrics-server@server:*' --k3s-arg '--cluster-cidr=10.23.0.0/24@server:*'"
 

pkg/charts/cni/values.go

@@ -66,6 +66,8 @@ type Values struct {
 	CommonLabels        map[string]string   `json:"commonLabels"`
 	ImagePullSecrets    []map[string]string `json:"imagePullSecrets"`
 	ExtraInitContainers []interface{}       `json:"extraInitContainers"`
+	IptablesMode        string              `json:"iptablesMode"`
+	DisableIPv6         bool                `json:"disableIPv6"`
 	EnablePSP           bool                `json:"enablePSP"`
 	Privileged          bool                `json:"privileged"`
 	Resources           Resources           `json:"resources"`

pkg/charts/linkerd2/values.go

@@ -49,6 +49,7 @@ type (
 		HighAvailability             bool                   `json:"highAvailability"`
 		CNIEnabled                   bool                   `json:"cniEnabled"`
 		EnableEndpointSlices         bool                   `json:"enableEndpointSlices"`
+		DisableIPv6                  bool                   `json:"disableIPv6"`
 		ControlPlaneTracing          bool                   `json:"controlPlaneTracing"`
 		ControlPlaneTracingNamespace string                 `json:"controlPlaneTracingNamespace"`
 		IdentityTrustAnchorsPEM      string                 `json:"identityTrustAnchorsPEM"`

pkg/charts/linkerd2/values_test.go

@@ -66,6 +66,7 @@ func TestNewValues(t *testing.T) {
 		PodAnnotations:               map[string]string{},
 		PodLabels:                    map[string]string{},
 		EnableEndpointSlices:         true,
+		DisableIPv6:                  false,
 		EnablePodDisruptionBudget:    false,
 		Controller: &Controller{
 			PodDisruptionBudget: &PodDisruptionBudget{