networking: option to enable ipv6 on bridge network #23882
Conversation
| ipRanges = append(ipRanges, []Range{{Subnet: conf.IPv6Subnet}}) | ||
| ipRoutes = append(ipRoutes, Route{Dst: "::/0"}) |
There was a problem hiding this comment.
these are the meat and potatoes; everything else revolves around this.
gulducat
force-pushed
the
ipv6-bridge-rebase
branch
from
bb411c4
to
6f8a98d
Compare
Co-authored-by: Martina Santangelo <[email protected]>
gulducat
force-pushed
the
ipv6-bridge-rebase
branch
from
6f8a98d
to
014865a
Compare
| "bridge_network_subnet": "custom_bridge_subnet", | ||
| "bridge_network_subnet_ipv6": "custom_bridge_subnet_ipv6", |
There was a problem hiding this comment.
It's a little weird that our tests have invalid values here (I think these aren't valid?)
There was a problem hiding this comment.
It's a good point - they're not validated anywhere until they actually get used at allocation-time.
I always hated finding out about bad client config that way, when an alloc fails through no fault of the jobspec. I would prefer to have the client fail to start instead of be sitting around quietly poisoned. Would this be a good place to add a check?
I can also add validation for custom ipv4 subnet while I'm in here, too. A major version bump is probably a good time to go for that, eh?
There was a problem hiding this comment.
Yeah, that looks like as good a place as any... there's a few other bits of client config validation we do there.
There was a problem hiding this comment.
I went down the road of requiring that these test configs be valid, but the test cases are really about parsing the HCL, not also validating them, which happens a little later.
So in a2f436b I just added unit tests around the one function that I added the validation to, and left these values as they are.
Users may optionally enable IPv6 on the Nomad
bridgenetwork mode by settingbridge_network_subnet_ipv6in the client config.Aside from that, there is a small functional change regarding our attempt to force-cleanup iptables if CNI fails to do so. Now if the postrouting rule is not found, it only logs that instead of returning an error. This way the new best-effort attempt to cleanup
ip6tablescan be less frightening in the logs if ipv6 isn't even enabled on the bridge.Resolves #14101