Skip to content

Commit 4fcd4fe

Browse files
teoincontattoteoincontatto
committed
Merge branch '3049-confidential-issue' into 'main-1.17'
Resolve "Fix support for IPv6" See merge request ongresinc/stackgres!1691
2 parents 6adfc06 + fde543c commit 4fcd4fe

13 files changed

Lines changed: 99 additions & 33 deletions

File tree

‎stackgres-k8s/e2e/envs/kind‎

Lines changed: 46 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ KIND_CONTAINERD_CACHE_RESET="${K8S_CACHE_RESET:-$KIND_CONTAINERD_CACHE_RESET}"
88
KIND_LOG_PATH="${KIND_LOG_PATH:-$TARGET_PATH/kind-logs}"
99
KIND_LOG_RESOURCES_POLICY_PATH="${KIND_LOG_RESOURCES_POLICY_PATH:-$TARGET_PATH/kind-apiserver-audit-policy}"
1010
KIND_EXPANDABLE_STORAGE_CLASSNAME="${EXPANDABLE_STORAGE_CLASSNAME:-expandable-sc}"
11+
K8S_IP_FAMILY="${K8S_IP_FAMILY:-ipv4}"
1112
KIND_0_15_0="${KIND_0_15_0:-kind-0.15.0}"
1213
KIND_0_20_0="${KIND_0_20_0:-kind-0.20.0}"
1314
KIND_0_23_0="${KIND_0_23_0:-kind-0.23.0}"
@@ -122,10 +123,17 @@ update_k8s_config() {
122123
kubectl config set "clusters.kind-$KIND_NAME.insecure-skip-tls-verify" --set-raw-bytes true
123124
kubectl config unset "clusters.kind-$KIND_NAME.certificate-authority-data"
124125

125-
screen -ls 2>/dev/null | grep '\.kind-daemon' \
126+
screen -ls 2>/dev/null | grep '\.kind-tag-import-images' \
126127
| tr '[:space:]' ' ' | cut -d ' ' -f 2 | cut -d . -f 1 \
127128
| xargs -r -I % kill % || true
128-
E2E_ENV=kind screen -dmS kind-daemon -L -Logfile "$HOME/.kind-daemon.log" "$SHELL" stackgres-k8s/e2e/e2e properly_tag_not_found_import_images
129+
E2E_ENV=kind screen -dmS kind-tag-import-images -L -Logfile "$HOME/.kind-tag-import-images.log" "$SHELL" stackgres-k8s/e2e/e2e properly_tag_not_found_import_images
130+
if [ "$K8S_IP_FAMILY" = ipv6 ]
131+
then
132+
screen -ls 2>/dev/null | grep '\.kind-ipv6-dns-socat' \
133+
| tr '[:space:]' ' ' | cut -d ' ' -f 2 | cut -d . -f 1 \
134+
| xargs -r -I % kill %
135+
screen -dmS kind-ipv6-dns-socat -L -Logfile "$HOME/.crc/kind-ipv6-dns-socat.log" socat UDP6-RECVFROM:5300,fork UDP4-SENDTO:127.0.0.53:53
136+
fi
129137
}
130138

131139
properly_tag_not_found_import_images() {
@@ -273,7 +281,8 @@ INNER_EOF
273281
fi
274282
)
275283
networking:
276-
disableDefaultCNI: true
284+
ipFamily: "${K8S_IP_FAMILY}"
285+
disableDefaultCNI: $(if [ "$K8S_DISABLE_CALICO" != true ]; then printf true; else printf false; fi)
277286
apiServerAddress: "0.0.0.0"
278287
nodes:
279288
- role: control-plane
@@ -397,26 +406,36 @@ EOF
397406
kubectl patch deployment -n kube-system coredns --type json \
398407
--patch '[{"op":"replace","path":"/spec/template/spec/containers/0/image","value":"k8s.gcr.io/coredns:1.3.1"}]'
399408
fi
409+
if [ "$K8S_IP_FAMILY" = ipv6 ]
410+
then
411+
DOCKER_IPV6="$(docker inspect "$KIND_NAME-control-plane" --format='{{range .NetworkSettings.Networks}}{{.IPv6Gateway}}{{end}}')"
412+
kubectl get -oyaml -n=kube-system configmap/coredns \
413+
| sed "s/forward .*$/forward . [$DOCKER_IPV6]:5300 {/" \
414+
| kubectl replace -f -
415+
fi
400416

401-
echo "Setting up calico for kind..."
402-
until kubectl get node --template '{{ if (index .items 0).spec.podCIDR }}true{{ end }}' | grep -q 'true'
403-
do
404-
sleep 3
405-
done
406-
K8S_POD_CIDR="$(kubectl get node --template '{{ (index .items 0).spec.podCIDR }}')"
407-
if [ "$(echo "$K8S_VERSION" | tr . '\n' | head -n 2 | xargs -I @ printf '%05d' @)" \
408-
-ge "$(echo "1.22" | tr . '\n' | xargs -I @ printf '%05d' @)" ]
417+
if [ "$K8S_DISABLE_CALICO" != true ]
409418
then
410-
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.4/manifests/tigera-operator.yaml
411-
wait_until kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.4/manifests/custom-resources.yaml
412-
kubectl patch installations.operator.tigera.io default --type json \
413-
-p '[{"op":"replace","path":"/spec/calicoNetwork/ipPools/0/cidr","value":"'"$K8S_POD_CIDR"'"}]'
414-
else
415-
kubectl apply -f https://docs.projectcalico.org/v3.12/manifests/calico.yaml
416-
kubectl -n kube-system set env daemonset/calico-node CALICO_IPV4POOL_CIDR="$K8S_POD_CIDR"
417-
kubectl -n kube-system set env daemonset/calico-node FELIX_IGNORELOOSERPF=true
419+
echo "Setting up calico for kind..."
420+
until kubectl get node --template '{{ if (index .items 0).spec.podCIDR }}true{{ end }}' | grep -q 'true'
421+
do
422+
sleep 3
423+
done
424+
K8S_POD_CIDR="$(kubectl get node --template '{{ (index .items 0).spec.podCIDR }}')"
425+
if [ "$(echo "$K8S_VERSION" | tr . '\n' | head -n 2 | xargs -I @ printf '%05d' @)" \
426+
-ge "$(echo "1.22" | tr . '\n' | xargs -I @ printf '%05d' @)" ]
427+
then
428+
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.4/manifests/tigera-operator.yaml
429+
wait_until kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.4/manifests/custom-resources.yaml
430+
kubectl patch installations.operator.tigera.io default --type json \
431+
-p '[{"op":"replace","path":"/spec/calicoNetwork/ipPools/0/cidr","value":"'"$K8S_POD_CIDR"'"}]'
432+
else
433+
kubectl apply -f https://docs.projectcalico.org/v3.12/manifests/calico.yaml
434+
kubectl -n kube-system set env daemonset/calico-node CALICO_IPV4POOL_CIDR="$K8S_POD_CIDR"
435+
kubectl -n kube-system set env daemonset/calico-node FELIX_IGNORELOOSERPF=true
436+
fi
437+
echo "...done"
418438
fi
419-
echo "...done"
420439

421440
if [ "$K8S_DISABLE_VOLUME_SNAPSHOT" != true ]
422441
then
@@ -604,9 +623,15 @@ delete_k8s() {
604623
echo "...done"
605624
fi
606625

607-
screen -ls 2>/dev/null | grep '\.kind-daemon' \
626+
screen -ls 2>/dev/null | grep '\.kind-tag-import-images' \
608627
| tr '[:space:]' ' ' | cut -d ' ' -f 2 | cut -d . -f 1 \
609628
| xargs -r -I % kill % || true
629+
if [ "$K8S_IP_FAMILY" = ipv6 ]
630+
then
631+
screen -ls 2>/dev/null | grep '\.kind-ipv6-dns-socat' \
632+
| tr '[:space:]' ' ' | cut -d ' ' -f 2 | cut -d . -f 1 \
633+
| xargs -r -I % kill % || true
634+
fi
610635
}
611636

612637
has_image_k8s() {

‎stackgres-k8s/e2e/spec/dbops-security-upgrade‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ e2e_test_install() {
2828
VERSION_AS_NUMBER_1_15_0="$(get_version_as_number 1.15.0-SNAPSHOT)"
2929
VERSION_AS_NUMBER_1_16_0="$(get_version_as_number 1.16.0-SNAPSHOT)"
3030
VERSION_AS_NUMBER_1_17_0="$(get_version_as_number 1.17.0-SNAPSHOT)"
31+
VERSION_AS_NUMBER_1_18_0="$(get_version_as_number 1.18.0-SNAPSHOT)"
3132

3233
CLUSTER_CRD="sgclusters.stackgres.io"
3334

@@ -849,6 +850,13 @@ check_cluster_before_security_upgrade() {
849850
| del(.postgresql.parameters.ssl_key_file)
850851
')"
851852
fi
853+
if [ "$PREVIOUS_VERSION_AS_NUMBER" -lt "$VERSION_AS_NUMBER_1_18_0" ]
854+
then
855+
PREVIOUS_PATRONI_CONFIG="$(printf '%s' "$PREVIOUS_PATRONI_CONFIG" | jq -Sc '.
856+
| .postgresql.parameters.listen_addresses = "localhost,::1"
857+
| .postgresql.pg_hba = (.postgresql.pg_hba|[.[0:5][], "host all all ::/0 md5", .[5:][], "host replication replicator ::/0 md5"])
858+
')"
859+
fi
852860
853861
if [ "$PATRONI_CONFIG" = "$PREVIOUS_PATRONI_CONFIG" ]
854862
then
@@ -874,6 +882,13 @@ check_cluster_before_security_upgrade() {
874882
| sed '/server_check_query = ;/d' \
875883
| sed 's/stats_users = /server_check_query = ;\nstats_users = /' > "$LOG_PATH/previous-pgbouncer-config-filtered.ini"
876884
PREVIOUS_PGBOUNCER_CONFIG="$(cat "$LOG_PATH/previous-pgbouncer-config-filtered.ini")"
885+
if [ "$PREVIOUS_VERSION_AS_NUMBER" -lt "$VERSION_AS_NUMBER_1_18_0" ]
886+
then
887+
PGBOUNCER_CONFIG="$(printf '%s' "$PGBOUNCER_CONFIG" \
888+
| sed "s/listen_addr = [\"']\?127\.0\.0\.1.*/listen_addr = 127.0.0.1,::1/")"
889+
PREVIOUS_PGBOUNCER_CONFIG="$(printf '%s' "$PREVIOUS_PGBOUNCER_CONFIG" \
890+
| sed "s/listen_addr = [\"']\?127\.0\.0\.1.*/listen_addr = 127.0.0.1,::1/")"
891+
fi
877892
878893
if [ "$PGBOUNCER_CONFIG" = "$PREVIOUS_PGBOUNCER_CONFIG" ]
879894
then

‎stackgres-k8s/e2e/utils/operator‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1765,6 +1765,13 @@ set_helm_values_for_developer() {
17651765
--set-string developer.extraOpts[11]=-Dquarkus.log.category."stackgres-extensions-cache".level=DEBUG
17661766
--set-string developer.extraOpts[12]=-Dquarkus.log.category."io.stackgres.operator.conciliation".level=TRACE
17671767
EOF
1768+
if [ "$K8S_IP_FAMILY" = ipv6 ]
1769+
then
1770+
cat << EOF
1771+
--set-string developer.extraOpts[13]=-Djava.net.preferIPv6Addresses=true
1772+
--set-string developer.extraOpts[14]=-Djava.net.preferIPv4Stack=false
1773+
EOF
1774+
fi
17681775
if [ -n "$E2E_EXTRA_MOUNT_BUILD_PATH" ]
17691776
then
17701777
cat << EOF

‎stackgres-k8s/install/helm/stackgres-operator/templates/extensions-cache-configmap.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ data:
3434
server_name localhost;
3535
3636
listen 8080;
37+
listen [::]:8080;
3738
root /opt/app-root/src;
3839
3940
location / {

‎stackgres-k8s/install/helm/stackgres-operator/templates/extensions-cache-statefulset.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,12 +133,14 @@ spec:
133133
echo "$EXTENSIONS_CACHE_LOG_LEVEL" | grep -v -q '^\(DEBUG\|TRACE\)$' || set -x
134134
cd /opt/app-root/src
135135
sh /usr/local/bin/extensions-cache-conciliator.sh run "$OPERATOR_NAMESPACE" '{{ .Release.Name }}-extensions-cache'
136+
{{- if not .Values.disableExtensionsCacheProbe }}
136137
readinessProbe:
137138
exec:
138139
command:
139140
- test
140141
- -f
141142
- /tmp/extensions-cache-ready
143+
{{- end }}
142144
volumeMounts:
143145
- name: extensions-cache-config
144146
mountPath: /usr/local/bin/extensions-cache-conciliator.sh

‎stackgres-k8s/src/operator/src/main/java/io/stackgres/operator/conciliation/factory/cluster/patroni/PatroniConfigEndpoints.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,9 @@ PatroniConfig getPatroniConfig(StackGresClusterContext context) {
250250
"host all all ::1/128 md5",
251251
"local replication all trust",
252252
"host all all 0.0.0.0/0 md5",
253-
"host replication " + PatroniSecret.getReplicatorCredentials(context).v1 + " 0.0.0.0/0 md5")
253+
"host all all ::/0 md5",
254+
"host replication " + PatroniSecret.getReplicatorCredentials(context).v1 + " 0.0.0.0/0 md5",
255+
"host replication " + PatroniSecret.getReplicatorCredentials(context).v1 + " ::/0 md5")
254256
.toList());
255257
patroniConf.getPostgresql().setParameters(
256258
getPostgresConfigValues(cluster, pgConfig, isBackupConfigurationPresent));
@@ -314,7 +316,7 @@ private Map<String, String> getPostgresParameters(
314316
.map(StackGresClusterSpec::getPods)
315317
.map(StackGresClusterPods::getDisableEnvoy)
316318
.orElse(false);
317-
params.put("listen_addresses", isEnvoyDisabled ? "0.0.0.0" : "localhost");
319+
params.put("listen_addresses", isEnvoyDisabled ? "0.0.0.0,::" : "localhost,::1");
318320
params.put("port", String.valueOf(EnvoyUtil.PG_PORT));
319321

320322
if (isBackupConfigurationPresent) {

‎stackgres-k8s/src/operator/src/main/java/io/stackgres/operator/conciliation/factory/cluster/patroni/PatroniConfigMap.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,11 +116,11 @@ public static String name(ClusterContext clusterContext) {
116116
.flatMap(StackGresClusterPatroniConfig::getPgCtlTimeout)
117117
.map(Object::toString)
118118
.orElse("60"));
119-
data.put("PATRONI_POSTGRESQL_LISTEN", (isEnvoyDisabled ? "0.0.0.0:" : "127.0.0.1:") + EnvoyUtil.PG_PORT);
119+
data.put("PATRONI_POSTGRESQL_LISTEN", (isEnvoyDisabled ? "0.0.0.0,[::]:" : "127.0.0.1,[::1]:") + EnvoyUtil.PG_PORT);
120120
data.put("PATRONI_POSTGRESQL_CONNECT_ADDRESS",
121121
"${POD_IP}:" + (isEnvoyDisabled ? EnvoyUtil.PG_PORT : EnvoyUtil.PG_REPL_ENTRY_PORT));
122122

123-
data.put("PATRONI_RESTAPI_LISTEN", "0.0.0.0:" + EnvoyUtil.PATRONI_PORT);
123+
data.put("PATRONI_RESTAPI_LISTEN", "*:" + EnvoyUtil.PATRONI_PORT);
124124
data.put("PATRONI_POSTGRESQL_DATA_DIR", ClusterPath.PG_DATA_PATH.path());
125125
data.put("PATRONI_POSTGRES_UNIX_SOCKET_DIRECTORY", ClusterPath.PG_RUN_PATH.path());
126126

‎stackgres-k8s/src/operator/src/main/java/io/stackgres/operator/conciliation/factory/cluster/sidecars/pooling/PgBouncerPooling.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -287,7 +287,7 @@ private String getPgBouncerSection(
287287
.map(StackGresClusterSpec::getPods)
288288
.map(StackGresClusterPods::getDisableEnvoy)
289289
.orElse(false);
290-
parameters.put("listen_addr", isEnvoyDisabled ? "*" : "127.0.0.1");
290+
parameters.put("listen_addr", isEnvoyDisabled ? "0.0.0.0,::" : "127.0.0.1,::1");
291291
parameters.put("listen_port", String.valueOf(EnvoyUtil.PG_POOL_PORT));
292292
parameters.put("unix_socket_dir", ClusterPath.PG_RUN_PATH.path());
293293
parameters.put("auth_file", ClusterPath.PGBOUNCER_AUTH_FILE_PATH.path());

‎stackgres-k8s/src/operator/src/main/java/io/stackgres/operator/conciliation/factory/distributedlogs/DistributedLogsFlunetdConfigMap.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,11 @@ private String getFluentdConfig(final StackGresDistributedLogsContext distribute
9898
+ " bind 0.0.0.0\n"
9999
+ " port " + DistributedLogsCluster.FORWARD_PORT + "\n"
100100
+ " </source>\n"
101+
+ " <source>\n"
102+
+ " @type forward\n"
103+
+ " bind \"::\"\n"
104+
+ " port " + DistributedLogsCluster.FORWARD_PORT + "\n"
105+
+ " </source>\n"
101106
+ "\n"
102107
+ " <filter *.*.*.*.*>\n"
103108
+ " @type record_transformer\n"

‎stackgres-k8s/src/operator/src/main/resources/envoy/envoy-lds.yaml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ resources:
33
name: patroni_listener
44
address:
55
socket_address:
6-
address: 0.0.0.0
6+
ipv4_compat: true
7+
address: "::"
78
port_value: '$patroni_entry_port'
89
filter_chains:
910
- filters:
@@ -32,7 +33,8 @@ resources:
3233
per_connection_buffer_limit_bytes: 1048576 # 1 MiB
3334
address:
3435
socket_address:
35-
address: 0.0.0.0
36+
ipv4_compat: true
37+
address: "::"
3638
port_value: '$postgres_entry_port'
3739
filter_chains:
3840
- filters:
@@ -64,7 +66,8 @@ resources:
6466
per_connection_buffer_limit_bytes: 1048576 # 1 MiB
6567
address:
6668
socket_address:
67-
address: 0.0.0.0
69+
ipv4_compat: true
70+
address: "::"
6871
port_value: '$postgres_repl_entry_port'
6972
filter_chains:
7073
- filters:
@@ -79,7 +82,8 @@ resources:
7982
per_connection_buffer_limit_bytes: 1048576 # 1 MiB
8083
address:
8184
socket_address:
82-
address: 0.0.0.0
85+
ipv4_compat: true
86+
address: "::"
8387
port_value: '$babelfish_entry_port'
8488
filter_chains:
8589
- filters:

0 commit comments

Comments
 (0)