{"push_id":1781927156,"size":1,"distinct_size":1,"ref":"refs/heads/v6_bridge_plugin","head":"37f8c0ab007936e18ce5fa3179ebaa03b966250f","before":"4804d311b3f258c4bbef8cd42f8c132c06caac9e","commits":[{"sha":"37f8c0ab007936e18ce5fa3179ebaa03b966250f","author":{"name":"Dane LeBlanc","email":"6b48fc52b02860b4cd95cc6f214afcdcc2b2e300@gmail.com"},"message":"bridge: Add support for IPv6 to bridge plugin\n\nThis change adds support for IPv6 container/pod addresses to the CNI\nbridge plugin, both for dual-stack (IPv4 + IPv6) and for IPv6-only\nnetwork configurations.\n\nThe proposed changes support multiple IPv6 addresses on a container\ninterface. If isGW is configured, the bridge will also be configured with\ngateway addresses for each IPv6 subnet.\n\nPlease note that both the dual-stack functionality and support for multiple\nIPv6 container/gateway addresses depends upon containernetworking/cni\nPR 451 \"ipam/host-local: support multiple IP ranges\".\nThis change could potentially be committed independently from this host-local\nplugin change, however the dual-stack and multiple IPv6 address\nfunctionality that is enabled by this change can't be exercised/tested\nuntil the host-local plugin change is committed.\n\nThere are some IPv6 unit test cases that are currently commented out\nin the proposed changes because these test cases will fail without the\nprior commits of the multiple IP range host-local change.\n\nThis pull request includes a temporary workaround for Kubernetes\nIssue #32291 (Container IPv6 address is marked as duplicate (dadfailed).\nThe problem is that kubelet enables hairpin mode on bridge veth\ninterfaces. Hairpin mode causes the container/pod to see echos of its\nIPv6 neighbor solicitation packets, so that it declares duplicate address\ndetection (DAD) failure. The long-term fix is to use enhanced-DAD\nwhen that feature is readily available in kernels. The short-term fix is\nto disable IPv6 DAD in the container. Unfortunately, this has to be done\nunconditionally (i.e. without a check for whether hairpin mode is enabled)\nbecause hairpin mode is turned on by kubelet after the CNI bridge plugin\nhas completed cmdAdd processing. Disabling DAD should be okay if\nIPv6 addresses are guaranteed to be unique (which is the case for\nhost-local IPAM plugin).","distinct":true,"url":"https://api.github.com/repos/leblancd/plugins/commits/37f8c0ab007936e18ce5fa3179ebaa03b966250f"}]}
{"actor":{"display_login":"leblancd"}}