[Feature] Support IPv6 iptables/netfilter in AKS Pod Sandboxing (Kata) guest VMs
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
KIND running inside AKS Kata isolated workloads attempts to create IPv6 Docker networks.
Kata guest kernel lacks required IPv6 iptables/netfilter functionality.
```
Creating cluster "local" ...
• Ensuring node image ([docker.io/kindest/node:v1.32.1](http://docker.io/kindest/node:v1.32.1)) 🖼 ...
ERROR: failed to create cluster: failed to ensure docker network: command "docker network create -d=bridge -o com.docker.network.bridge.enable_ip_masquerade=true -o com.docker.network.driver.mtu=1500 --ipv6 --subnet fc00:f853:ccd:e793::/64 kind" failed with error: exit status 1
Command Output: Error response from daemon: Failed to Setup IP tables: Unable to enable ACCEPT OUTGOING rule: (iptables failed: ip6tables --wait -t filter -A DOCKER-FORWARD -i br-4bc7e192034c -j ACCEPT: ip6tables: No chain/target/match by that name.
```
Resulting workaround requires pre-creating Docker networks.
```
$ docker network create kind
```
**Describe the solution you'd like**
IPv6 iptables/netfilter support in the Kata guest VM image.
I should be able to run kind commands without extra configuration since ipv6 is enabled on the kernel.
**Describe alternatives you've considered**
Workaround requires creating networking resources prior to executing kind:
```
$ docker network create kind
```
Contributor guide
Assessment
This issue has not been assessed yet.