Addition of ipv6 changes for consul-k8s connect inject and cni

.changelog/4779.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ipv6: Addition of ipv6 changes for consul-k8s connect inject and cni
+```

charts/consul/templates/cni-daemonset.yaml

@@ -71,6 +71,8 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.uid
+            - name: CNI_DUAL_STACK
+              value: "{{ .Values.global.dualStack.defaultEnabled }}"
           command:
             - consul-k8s-control-plane
             - install-cni

control-plane/api-gateway/controllers/gateway_controller_integration_test.go

@@ -32,6 +32,7 @@ import (
 	gwv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
+	"github.com/hashicorp/consul/agent/netutil"
 	"github.com/hashicorp/consul/api"
 
 	"github.com/hashicorp/consul-k8s/control-plane/api-gateway/cache"
@@ -41,6 +42,7 @@ import (
 )
 
 func TestControllerDoesNotInfinitelyReconcile(t *testing.T) {
+	netutil.GetAgentBindAddrFunc = netutil.GetMockGetAgentBindAddrFunc("0.0.0.0")
 	s := runtime.NewScheme()
 	require.NoError(t, clientgoscheme.AddToScheme(s))
 	require.NoError(t, gwv1alpha2.Install(s))

control-plane/cni/go.mod

@@ -8,14 +8,15 @@ require (
 	github.com/containernetworking/cni v1.1.2
 	github.com/containernetworking/plugins v1.2.0
 	github.com/hashicorp/consul-k8s/version v0.0.0
-	github.com/hashicorp/consul/sdk v0.16.2
 	github.com/hashicorp/go-hclog v1.5.0
 	github.com/stretchr/testify v1.8.4
 	k8s.io/api v0.29.8
 	k8s.io/apimachinery v0.29.8
 	k8s.io/client-go v0.29.8
 )
 
+require github.com/hashicorp/consul/sdk v0.4.1-0.20250919124332-fe5b36f5014c
+
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
@@ -44,7 +45,7 @@ require (
 	github.com/spf13/pflag v1.0.5 // indirect
 	golang.org/x/net v0.38.0 // indirect
 	golang.org/x/oauth2 v0.28.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/term v0.30.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 	golang.org/x/time v0.3.0 // indirect

control-plane/cni/go.sum

@@ -60,8 +60,8 @@ github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJY
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/consul/sdk v0.16.2 h1:cGX/djeEe9r087ARiKVWwVWCF64J+yW0G6ftZMZYbj0=
-github.com/hashicorp/consul/sdk v0.16.2/go.mod h1:onxcZjYVsPx5XMveAC/OtoIsdr32fykB7INFltDoRE8=
+github.com/hashicorp/consul/sdk v0.4.1-0.20250919124332-fe5b36f5014c h1:MZ4t16Ezmk40fKmYzZVbNo1agmnfEIJHsxqMl0XKTEQ=
+github.com/hashicorp/consul/sdk v0.4.1-0.20250919124332-fe5b36f5014c/go.mod h1:TSPshuYdi1OQwpLund2vkTHpp4WnLyhf7Q/YihGMtp0=
 github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
 github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -174,8 +174,8 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
 golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=

control-plane/cni/main.go

@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net"
+	"os"
 	"path/filepath"
 
 	"github.com/containernetworking/cni/pkg/skel"
@@ -226,8 +227,13 @@ func (c *Command) cmdAdd(args *skel.CmdArgs) error {
 		iptablesCfg.IptablesProvider = c.iptablesProvider
 	}
 
+	dualStack := false
+	if os.Getenv("CNI_DUAL_STACK") == "true" {
+		dualStack = true
+	}
+
 	// Apply the iptables rules.
-	err = iptables.Setup(iptablesCfg)
+	err = iptables.Setup(iptablesCfg, dualStack)
 	if err != nil {
 		return fmt.Errorf("could not apply iptables setup: %v", err)
 	}

control-plane/cni/main_test.go

@@ -35,14 +35,18 @@ func (f *fakeIptablesProvider) AddRule(name string, args ...string) {
 	f.rules = append(f.rules, strings.Join(rule, " "))
 }
 
-func (f *fakeIptablesProvider) ApplyRules() error {
+func (f *fakeIptablesProvider) ApplyRules(command string) error {
 	return nil
 }
 
 func (f *fakeIptablesProvider) Rules() []string {
 	return f.rules
 }
 
+func (f *fakeIptablesProvider) ClearAllRules() {
+	f.rules = nil
+}
+
 func Test_cmdAdd(t *testing.T) {
 	t.Parallel()
 

control-plane/connect-inject/webhook/consul_dataplane_sidecar.go

@@ -17,11 +17,13 @@ import (
 
 	"github.com/hashicorp/consul-k8s/control-plane/connect-inject/common"
 	"github.com/hashicorp/consul-k8s/control-plane/connect-inject/constants"
+	"github.com/hashicorp/consul/agent/netutil"
 )
 
 const (
-	consulDataplaneDNSBindHost = "127.0.0.1"
-	consulDataplaneDNSBindPort = 8600
+	consulDataplaneDNSBindHost     = "127.0.0.1"
+	ipv6ConsulDataplaneDNSBindHost = "::1"
+	consulDataplaneDNSBindPort     = 8600
 )
 
 func (w *MeshWebhook) consulDataplaneSidecar(namespace corev1.Namespace, pod corev1.Pod, mpi multiPortInfo) (corev1.Container, error) {
@@ -321,9 +323,26 @@ func (w *MeshWebhook) getContainerSidecarArgs(namespace corev1.Namespace, mpi mu
 		}
 		envoyConcurrency = int(val)
 	}
+	envoyAdminBindAddress := "127.0.0.1"
+	consulDNSBindAddress := consulDataplaneDNSBindHost
+	consulDPBindAddress := "127.0.0.1"
+	xdsBindAddress := "127.0.0.1"
 
+	ds, err := netutil.IsDualStack(w.ConsulConfig.APIClientConfig, false)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get consul dual stack status with error: %s", err.Error())
+	}
+	if ds {
+		envoyAdminBindAddress = "::1"
+		consulDNSBindAddress = ipv6ConsulDataplaneDNSBindHost
+		consulDPBindAddress = "::"
+		xdsBindAddress = "::1"
+	}
 	args := []string{
 		"-addresses", w.ConsulAddress,
+		"-envoy-admin-bind-address=" + envoyAdminBindAddress,
+		"-consul-dns-bind-addr=" + consulDNSBindAddress,
+		"-xds-bind-addr=" + xdsBindAddress,
 		"-grpc-port=" + strconv.Itoa(w.ConsulConfig.GRPCPort),
 		"-proxy-service-id-path=" + proxyIDFileName,
 		"-log-level=" + w.LogLevel,
@@ -390,6 +409,9 @@ func (w *MeshWebhook) getContainerSidecarArgs(namespace corev1.Namespace, mpi mu
 	if mpi.serviceName != "" {
 		gracefulPort = gracefulPort + mpi.serviceIndex
 	}
+	if consulDPBindAddress != "" {
+		args = append(args, fmt.Sprintf("-graceful-addr=%s", consulDPBindAddress))
+	}
 	args = append(args, fmt.Sprintf("-graceful-port=%d", gracefulPort))
 
 	enableProxyLifecycle, err := w.LifecycleConfig.EnableProxyLifecycle(pod)