Make enabledIPv6 work without breaking single-stack clusters

[csatib02]

Summary

enabledIPv6 produced Services the cluster could not accept, and listeners that did not
match those Services. Three regressions landed after 6.7.0, all from one shared helper.

0321c1d2 changed the requested primary IP family from IPv4 to IPv6. Kubernetes does not
allow the primary family of an existing Service to change. It reports the refusal as
invalid, not as immutable, so operator-tools does not recognise it and never recreates the
Service. Upgrading a cluster with enabledIPv6 left the fluentd or syslog-ng Service
failing to reconcile forever, which stalled every reconciler behind it.

The same helper also names a family outright. A cluster with no range for that family
rejects the Service at create, where there is no recovery path. This branch asks the API
server which families it can allocate, with a dry-run Service, and names only those. The
probe needs no new RBAC and has no version floor.

syslog-ng was affected differently. Its network() source never set ip(), so it listened
on IPv4 only while its Service became IPv6-primary. Fluent Bit resolved the Service to an
AAAA record and the connection reached a pod address with no listener. That took ingestion
down, not just metrics.

The last commits remove the cause. A bind address on the Metrics type decouples the
metrics endpoint from the Service IP families, so wanting IPv6 metrics no longer forces an
IPv6-primary Service. Three smaller defects found on the way are fixed too: the Fluent Bit
config used an invalid Listen key, the syslog-ng config-reloader listened on a port
nothing scraped, and the syslog-ng metrics service overrides were never read.

Context: #2100, #2238, #1835 and #2090 are all closed. #2100 was closed by the commit that
caused two of the regressions above.

Test plan

Verified on a KIND cluster (v1.36.1, service CIDR 10.96.0.0/16) and on envtest API
servers driving the real reconcilers.

• make lint && make test
• Upgrade a dual-stack cluster running 6.7.0 with fluentd.enabledIPv6: true. The
  Service reconciles and keeps its allocated addresses.
• Install on a single-stack IPv4 cluster with enabledIPv6: true. Services are created
  and the Logging converges. The families the previous code asked for are rejected with
  spec.ipFamilies[0]: Invalid value: "IPv6": not configured on this cluster.
• Install on an IPv6-only cluster with enabledIPv6: true. Services are created.
• Send logs through syslog-ng with syslogNG.enabledIPv6: true. A message reaches the
  ip("::") ip-protocol(6) listener through an IPv4 Service.
• Scrape the syslog-ng config-reloader on 9533.
• Set metrics.bind and confirm it reaches the rendered aggregator config.

Not covered: there is no e2e suite for enabledIPv6, so the dual-stack IPv6-primary
ingestion path is verified only at the layers below a cluster. The bind was run against
ghcr.io/axoflow/axosyslog:4.25.0 and the Services against envtest.

[Copilot]

Pull request overview

Improves IPv6 handling across aggregator listeners, metrics endpoints, and Kubernetes Services while preserving existing allocations.

Changes:

• Detects allocatable Service IP families and preserves assigned families during reconciliation.
• Adds configurable metrics bind addresses and corrects Fluent Bit/syslog-ng listeners.
• Fixes syslog-ng metrics overrides and config-reloader scraping.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/sdk/logging/model/syslogng/config/source.go	Adds source IP protocol rendering.
pkg/sdk/logging/model/syslogng/config/config.go	Configures the IPv6 syslog-ng listener.
pkg/sdk/logging/model/syslogng/config/config_test.go	Tests source listener rendering.
pkg/sdk/logging/api/v1beta1/common_types.go	Adds metrics binding and Service family helpers.
pkg/sdk/logging/api/v1beta1/common_types_test.go	Tests metrics bind resolution.
pkg/resources/syslogng/syslogng.go	Carries detected families into reconciliation.
pkg/resources/syslogng/statefulset.go	Corrects config-reloader metrics port.
pkg/resources/syslogng/service.go	Applies family detection and Service overrides.
pkg/resources/syslogng/service_test.go	Tests syslog-ng Service fixes.
pkg/resources/ipfamily/detector.go	Introduces Service IP-family detection.
pkg/resources/ipfamily/detector_test.go	Tests detection and retry behavior.
pkg/resources/fluentd/service.go	Preserves and applies Service families.
pkg/resources/fluentd/service_test.go	Tests Service upgrade behavior.
pkg/resources/fluentd/fluentd.go	Stores detected cluster families.
pkg/resources/fluentd/configsecret.go	Resolves the metrics bind address.
pkg/resources/fluentd/config.go	Renders the configured metrics bind.
pkg/resources/fluentd/appconfigmap_test.go	Updates reconciler construction.
pkg/resources/fluentbit/service.go	Applies detected Service families.
pkg/resources/fluentbit/service_test.go	Tests family-aware metrics Services.
pkg/resources/fluentbit/fluentbit.go	Stores detected cluster families.
pkg/resources/fluentbit/configsecret.go	Resolves the metrics bind address.
pkg/resources/fluentbit/config.go	Fixes Fluent Bit HTTP listener rendering.
docs/configuration/crds/v1beta1/common_types.md	Documents metrics.bind.
controllers/logging/logging_controller.go	Integrates family detection into reconcilers.
config/crd/bases/logging.banzaicloud.io_syslogngconfigs.yaml	Adds syslog-ng bind schema.
config/crd/bases/logging.banzaicloud.io_loggings.yaml	Adds Logging bind schemas.
config/crd/bases/logging.banzaicloud.io_fluentdconfigs.yaml	Adds Fluentd bind schema.
config/crd/bases/logging.banzaicloud.io_fluentbitagents.yaml	Adds Fluent Bit bind schema.
CLAUDE.md	Documents allocated Service field handling.
charts/logging-operator/crds/logging.banzaicloud.io_syslogngconfigs.yaml	Synchronizes syslog-ng chart CRD.
charts/logging-operator/crds/logging.banzaicloud.io_loggings.yaml	Synchronizes Logging chart CRD.
charts/logging-operator/crds/logging.banzaicloud.io_fluentdconfigs.yaml	Synchronizes Fluentd chart CRD.
charts/logging-operator/crds/logging.banzaicloud.io_fluentbitagents.yaml	Synchronizes Fluent Bit chart CRD.
charts/logging-operator/charts/logging-operator-crds/templates/logging.banzaicloud.io_syslogngconfigs.yaml	Updates packaged syslog-ng CRD template.
charts/logging-operator/charts/logging-operator-crds/templates/logging.banzaicloud.io_loggings.yaml	Updates packaged Logging CRD template.
charts/logging-operator/charts/logging-operator-crds/templates/logging.banzaicloud.io_fluentdconfigs.yaml	Updates packaged Fluentd CRD template.
charts/logging-operator/charts/logging-operator-crds/templates/logging.banzaicloud.io_fluentbitagents.yaml	Updates packaged Fluent Bit CRD template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 39 out of 39 changed files in this pull request and generated no new comments.

Suppressed comments (2)

pkg/resources/ipfamily/detector.go:63

• nil means both “IPv4-only” and “the probe failed.” The syslog-ng config path converts it to ClusterHasIPv6=false, while Service generation still sets PreferDualStack without pinning a family. On an IPv6-only cluster, a transient dry-run failure can therefore render an IPv4-only network() listener and then create an IPv6 Service, recreating the ingestion outage. Propagate the probe error (or model the unknown state separately) and abort/requeue instead of continuing with nil.

	hasIPv6, err := d.allocatable(ctx, namespace, corev1.IPv6Protocol)
	if err != nil {
		return nil
	}
	hasIPv4, err := d.allocatable(ctx, namespace, corev1.IPv4Protocol)
	if err != nil {
		return nil

pkg/sdk/logging/api/v1beta1/common_types.go:78

• Metrics is also used by SyslogNGSpec.Metrics, so this field is accepted in the generated syslog-ng CRDs, but syslogNGMetricsSidecarContainer only passes --socket.path and never consumes Bind/BindAddress. Consequently spec.metrics.bind is silently ignored for syslog-ng and the documented default is not applied. Wire the address into the exporter’s listen option, or avoid exposing this field for syslog-ng if the exporter cannot support it.