public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-08-03 15:29:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix ipv6 sysctl required by non-ipv6 LoadBalancer service

Browse Source 
This is a partial revert of 095ecdb034,
with the workaround moved into klipper-lb.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d4c3422a85)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
This commit is contained in:
Brad Davidson
2024-07-22 23:20:49 +00:00
committed by Derek Nola
parent 47d622dc31
commit f25243bd23
2 changed files with 14 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
pkg/cloudprovider/servicelb.go
View File

@@ -50,7 +50,7 @@ const (
)
var (
DefaultLBImage = "rancher/klipper-lb:v0.4.7"
DefaultLBImage = "rancher/klipper-lb:v0.4.9"
)
func (k *k3s) Register(ctx context.Context,
@@ -435,12 +435,19 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
return nil, err
}
sourceRanges := strings.Join(sourceRangesSet.StringSlice(), ",")
securityContext := &core.PodSecurityContext{}
for _, ipFamily := range svc.Spec.IPFamilies {
if ipFamily == core.IPv6Protocol && sourceRanges == "0.0.0.0/0" {
// The upstream default load-balancer source range only includes IPv4, even if the service is IPv6-only or dual-stack.
// If using the default range, and IPv6 is enabled, also allow IPv6.
sourceRanges += ",::/0"
switch ipFamily {
case core.IPv4Protocol:
securityContext.Sysctls = append(securityContext.Sysctls, core.Sysctl{Name: "net.ipv4.ip_forward", Value: "1"})
case core.IPv6Protocol:
securityContext.Sysctls = append(securityContext.Sysctls, core.Sysctl{Name: "net.ipv6.conf.all.forwarding", Value: "1"})
if sourceRanges == "0.0.0.0/0" {
// The upstream default load-balancer source range only includes IPv4, even if the service is IPv6-only or dual-stack.
// If using the default range, and IPv6 is enabled, also allow IPv6.
sourceRanges += ",::/0"
}
}
}
@@ -476,12 +483,7 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
PriorityClassName: priorityClassName,
ServiceAccountName: "svclb",
AutomountServiceAccountToken: utilsptr.To(false),
SecurityContext: &core.PodSecurityContext{
Sysctls: []core.Sysctl{
{Name: "net.ipv4.ip_forward", Value: "1"},
{Name: "net.ipv6.conf.all.forwarding", Value: "1"},
},
},
SecurityContext: securityContext,
Tolerations: []core.Toleration{
{
Key: util.MasterRoleLabelKey,

2
scripts/airgap/image-list.txt
View File

@@ -1,5 +1,5 @@
docker.io/rancher/klipper-helm:v0.8.4-build20240523
docker.io/rancher/klipper-lb:v0.4.7
docker.io/rancher/klipper-lb:v0.4.9
docker.io/rancher/local-path-provisioner:v0.0.28
docker.io/rancher/mirrored-coredns-coredns:1.10.1
docker.io/rancher/mirrored-library-busybox:1.36.1