Set ipFamilyPolicy on RTC SFU NodePorts #660
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If the cluster is IPv6 enabled [1], NodePorts created for RTC SFU will still default to SingleStack. Set ipFamilyPolicy on these ports to PreferDualStack instead so we can connect with both IPv4 and v6. This should cause no change in behavior on an IPv4-only install. [1] https://docs.k3s.io/networking/basic-network-options#dual-stack-ipv4--ipv6-networking
|
|
dyff of changes in rendered templates of CI manifestsFull contents of manifests and dyffs are available in https://github.com/element-hq/ess-helm/actions/runs/16876490201/artifacts/3733019933 matrix-rtc-checkov-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
matrix-rtc-exposed-services-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-udp-range-0 - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-udp-range-1 - spec @@
+ ipFamilyPolicy: PreferDualStack
matrix-rtc-minimal-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
matrix-rtc-secrets-externally-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
matrix-rtc-secrets-in-helm-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
pytest-matrix-rtc-standalone-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
pytest-matrix-rtc-synapse-wellknown-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-certificates-pg-external-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-certificates-pg-with-helm-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-external-cert-pg-external-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-external-cert-pg-with-helm-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-letsencrypt-pg-external-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-letsencrypt-pg-with-helm-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-wildcard-cert-pg-external-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
quick-setup-wildcard-cert-pg-with-helm-values.yaml@@ Service/ess-ci/release-name-matrix-rtc-sfu-muxed-udp - spec @@
+ ipFamilyPolicy: PreferDualStack
@@ Service/ess-ci/release-name-matrix-rtc-sfu-tcp - spec @@
+ ipFamilyPolicy: PreferDualStack
|
|
Thanks for this contribution. Some notes / thoughts
|
|
Sorry for closing the PR, linking the PRs made github think it should close it. |
I think it only matters for ports that get exposed outside the cluster. Other than the RTC ports I'm enabling in this PR, this chart only exposes http/https via traefik LoadBalancer ingress, and those seem to listen to IPv6 automatically when I enabled it.
I don't think so. There are only a few options for this resource:
I don't see why someone would pick one of others. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the cluster is IPv6 enabled, NodePorts created for RTC SFU will still default to SingleStack. Set ipFamilyPolicy on these ports to PreferDualStack instead so we can connect with both IPv4 and v6.
This should cause no change in behavior on an IPv4-only install.