Skip to content

Commit

Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files Browse the repository at this point in the history
- For the linkerd-control-plane chart added the values.yaml entry `disableIPv6`, defaulting to false. If we wan't to explicitly set `disableIPv6=true`, the proxy-init v2.3.0 (containing linkerd/linkerd2-proxy-init#350) needs to be used, otherwise proxy-init will error out because of the unknown flag.
- For the linkerd2-cni chart added the entries `iptablesMode` (defaults to "legacy") and `disableIPv6` (defaults to false). These flags can still be passed to the current proxy-init version (without  linkerd/linkerd2-proxy-init#350) and will simply be ignored.

Note this allows routing IPv6 traffic to the proxy by default, but it's just the first step towards IPv6/dual-stack support. More control plane and proxy changes will come next.
alpeb committed Mar 19, 2024
1 parent 5915ef5 commit 45f2782
Showing 34 changed files with 68 additions and 9 deletions.
1 change: 1 addition & 0 deletions charts/linkerd-control-plane/README.md
Original file line number Diff line number Diff line change
@@ -159,6 +159,7 @@ Kubernetes: `>=1.22.0-0`
| debugContainer.image.version | string | linkerdVersion | Tag for the debug container image |
| deploymentStrategy | object | `{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"}}` | default kubernetes deployment strategy |
| disableHeartBeat | bool | `false` | Set to true to not start the heartbeat cronjob |
| disableIPv6 | bool | `false` | disables routing IPv6 traffic in addition to IPv4 traffic through the proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni v1.4.0) |
| enableEndpointSlices | bool | `true` | enables the use of EndpointSlice informers for the destination service; enableEndpointSlices should be set to true only if EndpointSlice K8s feature gate is on |
| enableH2Upgrade | bool | `true` | Allow proxies to perform transparent HTTP/2 upgrading |
| enablePSP | bool | `false` | Add a PSP resource and bind it to the control plane ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
4 changes: 4 additions & 0 deletions charts/linkerd-control-plane/values.yaml
Original file line number Diff line number Diff line change
@@ -39,6 +39,10 @@ enablePodAntiAffinity: false
enablePprof: false
# -- enables the creation of pod disruption budgets for control plane components
enablePodDisruptionBudget: false
# -- disables routing IPv6 traffic in addition to IPv4 traffic through the
# proxy (IPv6 routing only available as of proxy-init v2.3.0 and linkerd-cni
# v1.4.0)
disableIPv6: false

controller:
# -- sets pod disruption budget parameter for all deployments
2 changes: 2 additions & 0 deletions charts/linkerd2-cni/README.md
Original file line number Diff line number Diff line change
@@ -25,6 +25,7 @@ Kubernetes: `>=1.22.0-0`
| commonLabels | object | `{}` | Labels to apply to all resources |
| destCNIBinDir | string | `"/opt/cni/bin"` | Directory on the host where the CNI configuration will be placed |
| destCNINetDir | string | `"/etc/cni/net.d"` | Directory on the host where the CNI plugin binaries reside |
| disableIPv6 | bool | `false` | Disables adding IPv6 rules on top of IPv4 rules |
| enablePSP | bool | `false` | Add a PSP resource and bind it to the linkerd-cni ServiceAccounts. Note PSP has been deprecated since k8s v1.21 |
| extraInitContainers | list | `[]` | Add additional initContainers to the daemonset |
| ignoreInboundPorts | string | `""` | Default set of inbound ports to skip via iptables |
@@ -34,6 +35,7 @@ Kubernetes: `>=1.22.0-0`
| image.version | string | `"v1.3.0"` | Tag for the CNI container Docker image |
| imagePullSecrets | list | `[]` | |
| inboundProxyPort | int | `4143` | Inbound port for the proxy container |
| iptablesMode | string | `"legacy"` | Variant of iptables that will be used to configure routing |
| logLevel | string | `"info"` | Log level for the CNI plugin |
| outboundProxyPort | int | `4140` | Outbound port for the proxy container |
| podLabels | object | `{}` | Additional labels to add to all pods |
5 changes: 4 additions & 1 deletion charts/linkerd2-cni/templates/cni-plugin.yaml
Original file line number Diff line number Diff line change
@@ -150,6 +150,7 @@ data:
dest_cni_bin_dir: "{{.Values.destCNIBinDir}}"
# The CNI network configuration to install on each node. The special
# values in this config will be automatically populated.
# iptables-mode and ipv6 flags are only considered as of linkerd-cni v1.4.0
cni_network_config: |-
{
"name": "linkerd-cni",
@@ -176,7 +177,9 @@ data:
],
{{- end }}
"simulate": false,
"use-wait-flag": {{.Values.useWaitFlag}}
"use-wait-flag": {{.Values.useWaitFlag}},
"iptables-mode": {{.Values.iptablesMode | quote}},
"ipv6": {{ternary "false" "true" .Values.disableIPv6 }}
}
}
---
4 changes: 4 additions & 0 deletions charts/linkerd2-cni/values.yaml
Original file line number Diff line number Diff line change
@@ -26,6 +26,10 @@ destCNINetDir: "/etc/cni/net.d"
destCNIBinDir: "/opt/cni/bin"
# -- Configures the CNI plugin to use the -w flag for the iptables command
useWaitFlag: false
# -- Variant of iptables that will be used to configure routing
iptablesMode: "legacy"
# -- Disables adding IPv6 rules on top of IPv4 rules
disableIPv6: false
# -- Kubernetes priorityClassName for the CNI plugin's Pods
priorityClassName: ""

3 changes: 3 additions & 0 deletions charts/partials/templates/_proxy-init.tpl
Original file line number Diff line number Diff line change
@@ -7,6 +7,9 @@ args:
- "iptables-nft-save"
{{- else if not (eq .Values.proxyInit.iptablesMode "legacy") }}
{{ fail (printf "Unsupported value \"%s\" for proxyInit.iptablesMode\nValid values: [\"nft\", \"legacy\"]" .Values.proxyInit.iptablesMode) }}
{{end -}}
{{- if .Values.disableIPv6 }}
- --ipv6=false
{{- end }}
- --incoming-proxy-port
- {{.Values.proxy.ports.inbound | quote}}
5 changes: 4 additions & 1 deletion cli/cmd/testdata/install-cni-plugin_default.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install-cni-plugin_fully_configured.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install-cni-plugin_skip_ports.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install_cni_helm_default_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion cli/cmd/testdata/install_cni_helm_override_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_custom_domain.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_custom_registry.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_default.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_default_token.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_ha_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_ha_with_overrides_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_heartbeat_disabled_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_helm_control_plane_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_helm_output_ha_labels.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_no_init_container.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_output.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_proxy_ignores.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cli/cmd/testdata/install_values_file.golden

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion justfile
Original file line number Diff line number Diff line change
@@ -464,7 +464,7 @@ _linkerd-viz-uninit:

##
## linkerd multicluster
##
##

_mc-target-k3d-flags := "--k3s-arg --disable='local-storage,metrics-server@server:*' --k3s-arg '--cluster-cidr=10.23.0.0/24@server:*'"

2 changes: 2 additions & 0 deletions pkg/charts/cni/values.go
Original file line number Diff line number Diff line change
@@ -66,6 +66,8 @@ type Values struct {
CommonLabels map[string]string `json:"commonLabels"`
ImagePullSecrets []map[string]string `json:"imagePullSecrets"`
ExtraInitContainers []interface{} `json:"extraInitContainers"`
IptablesMode string `json:"iptablesMode"`
DisableIPv6 bool `json:"disableIPv6"`
EnablePSP bool `json:"enablePSP"`
Privileged bool `json:"privileged"`
Resources Resources `json:"resources"`
1 change: 1 addition & 0 deletions pkg/charts/linkerd2/values.go
Original file line number Diff line number Diff line change
@@ -49,6 +49,7 @@ type (
HighAvailability bool `json:"highAvailability"`
CNIEnabled bool `json:"cniEnabled"`
EnableEndpointSlices bool `json:"enableEndpointSlices"`
DisableIPv6 bool `json:"disableIPv6"`
ControlPlaneTracing bool `json:"controlPlaneTracing"`
ControlPlaneTracingNamespace string `json:"controlPlaneTracingNamespace"`
IdentityTrustAnchorsPEM string `json:"identityTrustAnchorsPEM"`
1 change: 1 addition & 0 deletions pkg/charts/linkerd2/values_test.go
Original file line number Diff line number Diff line change
@@ -66,6 +66,7 @@ func TestNewValues(t *testing.T) {
PodAnnotations: map[string]string{},
PodLabels: map[string]string{},
EnableEndpointSlices: true,
DisableIPv6: false,
EnablePodDisruptionBudget: false,
Controller: &Controller{
PodDisruptionBudget: &PodDisruptionBudget{

0 comments on commit 45f2782

Please sign in to comment.