Skip to content

Conversation

@arodd
Copy link
Contributor

@arodd arodd commented Nov 17, 2025

Description

This is an attempted resolution for the issue reported in #27108 with missing IPv6 address entries for CNI plugins that don't specifically return the IPv6 address as part of the initial CNI result. In a macvlan+dhcp chain the DHCP plugin emits only the IPv4 lease. The IPv6 addresses inside the allocation’s namespace are being configured later by kernel SLAAC/DHCPv6 and never appear in res.Interfaces, so netStatus.AddressIPv6 is left empty. This breaks upstream service registration when using address_mode = alloc_ipv6 since the referenced fields are empty.

For plugins where this issue is known(any relying on kernel addressing for IPv6), we briefly enter the network namespace to retrieve the network address instead of relying solely on the CNI result. There is likely a more elegant approach here, but this fix confirmed this was the issue I was running into with missing service registration addresses. This likely also applies to ipvlan, but I still need to validate. I opted to only perform the additional lookup when we determine that a known plugin is being used to avoid the lookup churn on most cases where bridge networking or standard IPv4 networking is being used and there isn't an IPv6 address to find, but curious if there is a more elegant approach here.

Testing & Reproduction steps

Links

Attemps to resolve #27108

Contributor Checklist

  • [ x] Changelog Entry If this PR changes user-facing behavior, please generate and add a
    changelog entry using the make cl command.
  • [ x] Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
    ensure regressions will be caught.
  • [ na] Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
    and job configuration, please update the Nomad website documentation to reflect this. Refer to
    the website README for docs guidelines. Please also consider whether the
    change requires notes within the upgrade guide.

Reviewer Checklist

  • [ x] Backport Labels Please add the correct backport labels as described by the internal
    backporting document.
  • [ x] Commit Type Ensure the correct merge method is selected which should be "squash and merge"
    in the majority of situations. The main exceptions are long-lived feature branches or merges where
    history should be preserved.
  • [ na] Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
    within the public repository.
  • If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

@arodd arodd requested review from a team as code owners November 17, 2025 16:21
@arodd arodd added backport/ent/1.8.x+ent Changes are backported to 1.8.x+ent backport/ent/1.10.x+ent backport to 1.10.x+ent release line backport/1.11.x backport to 1.11.x release line labels Nov 17, 2025
@arodd
Copy link
Contributor Author

arodd commented Nov 18, 2025

I'm realizing that this doesn't fully solve the issue in it's current form because we will only periodically find the address during the moment we check. Sometimes the address hasn't finished populating by the kernel yet. Adding retry logic and a timeout feels even hackier, but it consistently returns addresses afterwards when doing so. If this was the best option, gating it behind a client configuration flag also seems necessary. I'm realizing another approach may be to either replace the dhcp IPAM plugin with something custom that waits for RA to finish, or have another plugin at the end of the chain that waits. I may abandon this PR in favor of someone else more qualified determining the ideal solution, but it allows my hack week project to work for now :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport/ent/1.8.x+ent Changes are backported to 1.8.x+ent backport/ent/1.10.x+ent backport to 1.10.x+ent release line backport/1.11.x backport to 1.11.x release line

Projects

Development

Successfully merging this pull request may close these issues.

IPv6 Addresses Missing from Allocation Status with Macvlan/DHCP CNI plugins

2 participants