fix(ipv6): do not cache an answer when every family probe is rejected

Probing each family on its own merit lost the control the previous shape had.
A cluster serves at least one family, so two rejections mean something refuses
every Service, not that the cluster has no ranges. The detector treated that as
a resolved answer of "no families" and kept it for the life of the process, so
an admission webhook that was later fixed left the operator on the wrong answer
until a restart.

Signed-off-by: Bence Csati <bence.csati@axoflow.com>

Author: csatib02

pkg/resources/ipfamily/detector.go

@@ -63,6 +63,13 @@ func (d *Detector) Families(ctx context.Context, namespace string) []corev1.IPFa
 		return nil
 	}
 
+	// No cluster serves neither family, so something rejects every Service and the answer is not
+	// ours to cache. An admission webhook doing that would otherwise pin nil until a restart.
+	if !hasIPv6 && !hasIPv4 {
+		d.log.Info("every IP family probe was rejected, leaving the IP families to the cluster for now")
+		return nil
+	}
+
 	switch {
 	case hasIPv6 && hasIPv4:
 		d.families = []corev1.IPFamily{corev1.IPv6Protocol, corev1.IPv4Protocol}
@@ -75,8 +82,6 @@ func (d *Detector) Families(ctx context.Context, namespace string) []corev1.IPFa
 	return d.families
 }
 
-// An admission webhook that rejects every Service is indistinguishable from a missing range, so an
-// error here leaves the answer unresolved rather than caching a guess.
 func (d *Detector) allocatable(ctx context.Context, namespace string, family corev1.IPFamily) (bool, error) {
 	err := d.dryRun(ctx, namespace, family)
 	if err == nil {

pkg/resources/ipfamily/detector_test.go

@@ -53,6 +53,15 @@ func TestFamilies(t *testing.T) {
 			expected: nil,
 			resolved: true,
 		},
+		{
+			name: "a webhook rejecting every service leaves the answer unknown",
+			results: map[corev1.IPFamily]error{
+				corev1.IPv6Protocol: invalidFamilyErr(),
+				corev1.IPv4Protocol: invalidFamilyErr(),
+			},
+			expected: nil,
+			resolved: false,
+		},
 		{
 			name:     "a denied probe leaves the answer unknown",
 			results:  map[corev1.IPFamily]error{corev1.IPv6Protocol: apierrors.NewForbidden(schema.GroupResource{Resource: "services"}, "probe", errors.New("nope"))},

pkg/sdk/logging/api/v1beta1/common_types.go

@@ -228,8 +228,8 @@ func EnableIPv6Options(serviceSpec *corev1.ServiceSpec, clusterFamilies []corev1
 // PreserveAllocatedIPFamilies pins ipFamilies and ipFamilyPolicy to what the API server allocated.
 // A change to an existing Service's primary family is rejected as invalid, not as immutable, so the
 // recreate fallback never fires. It reports whether it overrode a single-stack policy the caller
-// asked for, which the caller should surface: the request is silently not carried out.
-func PreserveAllocatedIPFamilies(desired *corev1.ServiceSpec, current corev1.ServiceSpec) (overrodePolicy bool) {
+// asked for, so the caller can say that the request was not carried out.
+func PreserveAllocatedIPFamilies(desired *corev1.ServiceSpec, current corev1.ServiceSpec) bool {
 	allocated := len(current.ClusterIPs) > 0 && current.ClusterIPs[0] != corev1.ClusterIPNone
 	if len(current.IPFamilies) == 0 || !allocated {
 		return false