fix(datapath): ignore link-local IPv6 addresses for NodePort binding#44778
fix(datapath): ignore link-local IPv6 addresses for NodePort binding#44778joestringer merged 1 commit intocilium:mainfrom
Conversation
|
/test |
In `getAddressesFromDevice`, IPv6 link-local addresses (e.g., fe80::) were not being explicitly filtered out. Because they are not public, the agent categorized them as private IPs. Since the fallback logic prefers private IPs for NodePort addresses, the unroutable link-local address would win the election over the routable global IPv6 address. This commit adds an `!IsLinkLocalUnicast()` filter to ensure link-local addresses are ignored during the NodePort IP selection process, allowing the global IPv6 address to be correctly selected and populated in the eBPF maps. Added unit tests to verify the link-local filtering behavior. Fixes: cilium#44436 Signed-off-by: Ben Bigdelle <bigdelle@google.com>
3ee5e5f to
aee047f
Compare
|
/test |
I didn't identify the specific commit that led to this regression, but AFAIK it was the commit that migrated from this heuristic and architecture fix (#37839) which fixes to the same issue that this code does (#36752) |
Ok I believe the regression from @Bigdelle does that make sense? I think your fix is still the right move (even for older releases) - even if someone intentionally changes the scope for address discovery, they still don't want to use a link-local address for NodePort (or BPF masq) purposes. |
Currently, in environments with dual-stack or IPv6 enabled, NodePorts can fail to route traffic because the agent incorrectly binds the IPv6 frontend to the node's unroutable link-local address (e.g., fe80::) instead of the global IPv6 address.
When dumping the eBPF load balancer maps (cilium-dbg bpf lb list), the NodePort incorrectly points to the link-local address:
In
pkg/datapath/tables/node_address.go(getAddressesFromDevice), the agent evaluates the device's IPv6 addresses. Because a link-local IP isn't considered "public", the agent tags it as a valid "private" IP.Later in the function, the fallback logic states: "Pick the NodePort addresses. Prefer private addresses if possible." Because of this, the unroutable link-local address wins the election and steals the NodePort binding from the actual global IPv6 address.
This fix should also be backported to 1.19
Fixes: #44436