Azure / Azure/AKS

[Feature] Support IPv6 iptables/netfilter in AKS Pod Sandboxing (Kata) guest VMs

Open
#5,844 1 comment 0 reactions 1 assignee Claimed by @shashankbarsin View on GitHub
ConfidentialCompute feature-request
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
2d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**
KIND running inside AKS Kata isolated workloads attempts to create IPv6 Docker networks.
Kata guest kernel lacks required IPv6 iptables/netfilter functionality.

```
Creating cluster "local" ...
• Ensuring node image ([docker.io/kindest/node:v1.32.1](http://docker.io/kindest/node:v1.32.1)) 🖼 ...
ERROR: failed to create cluster: failed to ensure docker network: command "docker network create -d=bridge -o com.docker.network.bridge.enable_ip_masquerade=true -o com.docker.network.driver.mtu=1500 --ipv6 --subnet fc00:f853:ccd:e793::/64 kind" failed with error: exit status 1
Command Output: Error response from daemon: Failed to Setup IP tables: Unable to enable ACCEPT OUTGOING rule: (iptables failed: ip6tables --wait -t filter -A DOCKER-FORWARD -i br-4bc7e192034c -j ACCEPT: ip6tables: No chain/target/match by that name.
```

Resulting workaround requires pre-creating Docker networks.

```
$ docker network create kind
```

**Describe the solution you'd like**
IPv6 iptables/netfilter support in the Kata guest VM image.

I should be able to run kind commands without extra configuration since ipv6 is enabled on the kernel.

**Describe alternatives you've considered**
Workaround requires creating networking resources prior to executing kind:
```
$ docker network create kind
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.