blob: 6e20ebdef350fa502a8d59c9698d2a15f490565c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
---
title: Calico and outgoing ipv6 traffic on k3s
date: 2022-01-23
description: By default calico does not nat outgoing ipv6 traffic
tags:
- ipv6
- k3s
- kubernetes
---
## Introduction
If you followed my [Making dual stack ipv6 work with k3s]({{< ref k3s-ipv6.md >}}) article a few months ago, you ended up with a setup where outgoing ipv6 traffic does not work. I only needed to have my pods reachable from the internet and did not try to generate ipv6 traffic originating from the cluster so never encountered the problem.
One of my kind readers did and reached out to me about the issue : thank you Mo!
## The problem
The problem is that calico does not provide an outgoing nat rule for ipv6 traffic by default as it does for ipv4 traffic. We can see that by inspecting the following :
```sh
# ip6tables -t nat -nvL cali-nat-outgoing
Chain cali-nat-outgoing (1 references)
pkts bytes target prot opt in out source destination
```
I did not find a way to fix calico's default ipv6 configuration upon installation, but we can patch it afterwards with `kubectl -n kube-system edit ippools default-ipv6-ippool`. Add "natOutgoing: true" to the spec and calico will generate the necessary nat rule :
```sh
# ip6tables -t nat -nvL cali-nat-outgoing
Chain cali-nat-outgoing (1 references)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all * * ::/0 ::/0
```
This can be automated with the following one liner :
```sh
k -n kube-system patch ippools default-ipv6-ippool --type=merge --patch '{"spec":{"natOutgoing":true}}'
```
With this rule, outgoing ipv6 traffic will work normally!
|
