IPv4-Only Pods in Dual-Stack

[renyunkang]

If I've enabled dual-stack networking, how can I configure specific pods to use only IPv4 (single-stack)?

Is there a configuration method to achieve this, or is it currently unsupported?

[mazdakn]

@renyunkang Have you tried 'cni.projectcalico.org/ipAddrsNoIpam' annotation. More information here: https://docs.tigera.io/calico/latest/reference/configure-cni-plugins#requesting-a-specific-ip-address

[renyunkang]

@renyunkang Have you tried 'cni.projectcalico.org/ipAddrsNoIpam' annotation. More information here: https://docs.tigera.io/calico/latest/reference/configure-cni-plugins#requesting-a-specific-ip-address

Thank you for your response. @mazdakn "NoIpam" is not the desired outcome. I still want Calico to automatically manage IP addresses (IPAM), but I need a configuration option to specify which namespaces or pods should only use IPv4, instead of both IPv4 and IPv6, even with dual-stack enabled.

[caseydavenport]

Yeah, I agree - the ipAddrsNoIpam is exceptionally niche and not right most for 99.99% of users 😁

Requires that you implement your own IPAM solution external to Calico and CNI 😬

[caseydavenport]

I think an annotation to expose configuration of IP families is appropriate. One thing to think about is whether or not we want to unconditionally allow application developers (i.e., people deploying pods) to control which IP families they have access to regardless of cluster configuration.

Generally for these types of annotations, you want this to be opt-in within the CNI config file itself in some way. Otherwise a cluster admin can configure Calico to behave one way (i.e., requiring dual stack) and then have app devs override that configuration when it's not desirable.

We may want to make this annotation available only if the cluster admin has deferred this capability to application developers - see the existing CNI config "feature_control" section which is used for this sort of thing:

calico/cni-plugin/pkg/types/types.go

Lines 33 to 37 in 840cb65

	// FeatureControl is a struct which controls which features are enabled in Calico.
	type FeatureControl struct {
	IPAddrsNoIpam bool `json:"ip_addrs_no_ipam"`
	FloatingIPs bool `json:"floating_ips"`
	}

[caseydavenport]

Would be something like IPFamilySpecification bool added to that struct, and then checked before parsing the annotation.

[caseydavenport]

On second thought.... maybe that's too paranoid. The Service struct already allows application devs to configure how their services work w.r.t IP families. This seems like a fair parallel.