iso: enable IPv6 iptables support in ISO kernels

[kartikjoshi21]

Prepare the ISO kernels to support IPv6 Services using the legacy iptables/ip6tables backend.

x86_64:

• Explicitly enable IPv6 (CONFIG_IPV6=y).
• Enable IPv6 conntrack defragmentation (CONFIG_NF_DEFRAG_IPV6=m).
• Enable IPv6 iptables raw and NAT support:
  • CONFIG_IP6_NF_RAW=m
  • CONFIG_IP6_NF_NAT=m
  • CONFIG_IP6_NF_TARGET_MASQUERADE=m

aarch64:

• Enable IPv6 conntrack defragmentation (CONFIG_NF_DEFRAG_IPV6=m).
• Enable IPv6 iptables raw table support (CONFIG_IP6_NF_RAW=m).

With these options, the ISO kernels provide the full legacy ip6tables stack (filter/mangle/raw/nat + MASQUERADE) needed by kube-proxy and Calico in iptables mode for IPv6 Services.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kartikjoshi21
Once this PR has been reviewed and has the lgtm label, please assign prezha for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Hi @kartikjoshi21. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[minikube-bot]

Can one of the admins verify this patch?

[kartikjoshi21]

Steps to test this PR

1. Build iso image from root of directory make minikube-iso-x86_64

PS C:\Users\kartikjoshi\headlamp-desktop\minikube> minikube ssh -- 'sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0 net.ipv6.conf.default.disable_ipv6=0'
>> minikube ssh -- 'sysctl -n net.ipv6.conf.all.disable_ipv6 net.ipv6.conf.default.disable_ipv6'
>>
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
0
0
PS C:\Users\kartikjoshi\headlamp-desktop\minikube> minikube ssh -- 'for t in filter mangle raw nat; do printf "%s: " $t; sudo -n ip6tables -t $t -S >/dev/null 2>&1; echo $?; done'
>>
filter:0
mangle:0
raw:0
nat:0
PS C:\Users\kartikjoshi\headlamp-desktop\minikube> minikube ssh -- 'sysctl -n net.ipv6.conf.all.disable_ipv6; sysctl -n net.ipv6.conf.default.disable_ipv6'
>>
0
0
PS C:\Users\kartikjoshi\headlamp-desktop\minikube> minikube ssh -- 'sudo modprobe ip6_tables ip6table_filter ip6table_mangle ip6table_raw ip6table_nat nf_conntrack nf_nat || true'
>> minikube ssh -- 'for t in filter mangle raw nat; do printf "%s: " $t; sudo -n ip6tables -t $t -S >/dev/null 2>&1; echo $?; done'
filter:0
mangle:0
raw:0
nat:0

[medyagh]

/ok-to-build-iso

[medyagh]

@kartikjoshi21 do you have an example of working with ipv6 with this ISO?

[minikube-bot]

Hi @kartikjoshi21, we have updated your PR with the reference to newly built ISO. Pull the changes locally if you want to test with them or update your PR further.

[k8s-ci-robot]

Keywords which can automatically close issues and at(@) or hashtag(#) mentions are not allowed in commit messages.

The list of commits with invalid commit messages:

• 2259701 iso: enable IPv6 iptables support in ISO kernels

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kartikjoshi21]

@kartikjoshi21 do you have an example of working with ipv6 with this ISO?

Hi @medyagh Thankyou for reviewing the PR, i have just tested if modules are present and ipv6 tables are enabled , test results can be seen here #21910 (comment) . For testing if ipv6 is working i will have to make changes to hyperv driver to support ipv6 which can be added after this change is reviewed #21630. Thanks