Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[NET-10952] fix cluster dns lookup family to gracefully handle ipv6 #21703

Conversation

jm96441n
Copy link
Member

Description

When creating an envoy cluster the default DNS Lookup Family defaults to AUTO, for inter-cluster communication this is not an issue but when creating a cluster that access external sources (like we do for JWTProviders) this can cause an issue. The AUTO setting prefers using ipv6, so if a user has a cluster that is not setup to handle ipv6 they will get an ipv6 address back for the external source and will be unable to connect.

To handle this we will be using the V4_PREFERRED lookup family when STRICT_DNS is enabled (STRICT_DNS will grab all addresses for the target and attempt to make a host for each and load balance between them).

When
LOGICAL_DNS is enabled (LOGICAL_DNS will grab all the addresses and only use the first when a new connection is needed) we will use the ALL lookup family, which fetches all the ip addresses for a given hostname and cycles through them to find the first one that is reachable using happy eyeballs

If any other DNS Discovery Type is used we fallback to the default of AUTO because envoy ignores the Lookup Family for all other cluster types.

Testing & Reproduction

Links

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@jm96441n jm96441n added backport/ent/1.17 This release series is longer active on CE or Ent backport/1.19 This release series is longer active on CE, use backport/ent/1.19 backport/ent/1.18 Changes are backported to 1.18 ent labels Sep 10, 2024
@github-actions github-actions bot added the theme/envoy/xds Related to Envoy support label Sep 10, 2024
@jm96441n jm96441n requested review from a team, missylbytes and NiniOak and removed request for a team September 10, 2024 19:27
Copy link
Contributor

@missylbytes missylbytes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved, don't forget the changelog

@jm96441n jm96441n enabled auto-merge (squash) September 12, 2024 15:24
@jm96441n jm96441n merged commit a3ac555 into main Sep 12, 2024
91 checks passed
@jm96441n jm96441n deleted the NET-10952-fix-cluster-dns-lookup-family-to-gracefully-handle-ipv6 branch September 12, 2024 15:37
philrenaud pushed a commit that referenced this pull request Sep 12, 2024
…21703)

* update jwks cluster creation to gracefully handle ipv6

* update unit tests for dns lookup family

* Add changelog
@hc-github-team-consul-core
Copy link
Collaborator

📣 Hi @jm96441n! a backport is missing for this PR [21703] for versions [1.18] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport/ent/1.17 This release series is longer active on CE or Ent backport/ent/1.18 Changes are backported to 1.18 ent backport/1.19 This release series is longer active on CE, use backport/ent/1.19 theme/envoy/xds Related to Envoy support
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants