envoyproxy / envoyproxy/gateway
Setting `ipFamily: IPv4` on a dual stack, IPv6-first cluster results in an IPv6 Service
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
Setting `ipFamily: IPv4` on a dual stack, IPv6-first cluster should result in an IPv4 Service. Instead `envoy-gateway` creates a single stack, IPv6 `Service`.
There's [a comment in the code](https://github.com/envoyproxy/gateway/blob/4140f616451faa1840cc4fc3f774ef1da46ca991/internal/infrastructure/kubernetes/proxy/resource_provider.go#L265):
```
if ipFamily != nil {
// SingleStack+IPv4 is default behavior from K8s and so is omitted
switch *ipFamily {
```
This isn't true according to [the Kubernetes docs](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services):
> The address family of a Service defaults to the address family of the first service cluster IP range (configured via the --service-cluster-ip-range flag to the kube-apiserver).
Unfortunately [simply setting the family of the Service isn't enough](https://github.com/envoyproxy/gateway/pull/6390#issuecomment-2998040677). The health listener doesn't listen on IPv4 if the family is set on the EnvoyProxy but kubernetes tries the first IP of the Pod which is IPv6 in this case.
*Repro steps*:
Set up an EnvoyProxy with `spec.ipFamily: IPv4` on a dual-stack, IPv6-first cluster.
*Environment*:
Envoy gateway v1.4.1
*Logs*:
None relevant
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.