Addition of ipv6 changes for consul-k8s connect inject and cni

.changelog/4779.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ipv6: Addition of ipv6 changes for consul-k8s connect inject and cni
+```

acceptance/framework/config/config.go

@@ -110,6 +110,7 @@ type TestConfig struct {
 	UseOpenshift    bool
 
 	helmChartPath string
+	DualStack     bool
 }
 
 // HelmValuesFromConfig returns a map of Helm values
@@ -160,6 +161,10 @@ func (t *TestConfig) HelmValuesFromConfig() (map[string]string, error) {
 		}
 	}
 
+	if t.DualStack {
+		setIfNotEmpty(helmValues, "global.dualStack.enabled", "true")
+	}
+
 	// UseGKEAutopilot is a temporary hack that we need in place as GKE Autopilot is already installing
 	// Gateway CRDs in the clusters. There are still other CRDs we need to install though (see helm cluster install)
 	if t.UseGKEAutopilot {

acceptance/framework/config/config_test.go

@@ -120,6 +120,16 @@ func TestConfig_HelmValuesFromConfig(t *testing.T) {
 				"connectInject.transparentProxy.defaultEnabled": "false",
 			},
 		},
+		{
+			"sets dualstack helm value",
+			TestConfig{
+				DualStack: true,
+			},
+			map[string]string{
+				"global.dualStack.enabled":                      "true",
+				"connectInject.transparentProxy.defaultEnabled": "false",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

acceptance/framework/flags/flags.go

@@ -62,6 +62,8 @@ type TestFlags struct {
 
 	flagDisablePeering bool
 
+	flagDualStack bool
+
 	once sync.Once
 }
 
@@ -165,6 +167,8 @@ func (t *TestFlags) init() {
 	flag.BoolVar(&t.flagSkipDatadogTests, "skip-datadog", false,
 		"If true, datadog acceptance tests will not run.")
 
+	flag.BoolVar(&t.flagDualStack, "dual-stack", false, "Dual stack test with both IPv4 and IPv6")
+
 	if t.flagEnterpriseLicense == "" {
 		t.flagEnterpriseLicense = os.Getenv("CONSUL_ENT_LICENSE")
 	}
@@ -252,6 +256,7 @@ func (t *TestFlags) TestConfigFromFlags() *config.TestConfig {
 		UseGKEAutopilot:    t.flagUseGKEAutopilot,
 		UseKind:            t.flagUseKind,
 		UseOpenshift:       t.flagUseOpenshift,
+		DualStack:          t.flagDualStack,
 	}
 
 	return c

acceptance/framework/helpers/helpers.go

@@ -252,6 +252,7 @@ func RunCommand(t testutil.TestingTB, options *k8s.KubectlOptions, command Comma
 		if res.err != nil {
 			logger.Logf(t, "Output: %v.", res.output)
 		}
+
 		return res.output, res.err
 		// Sometimes this func runs for too long handle timeout if needed.
 	case <-time.After(320 * time.Second):

acceptance/framework/k8s/helpers.go

@@ -6,6 +6,8 @@ package k8s
 import (
 	"context"
 	"fmt"
+	"net"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -94,7 +96,7 @@ func KubernetesAPIServerHost(t *testing.T, cfg *config.TestConfig, ctx environme
 		// The Kubernetes AuthMethod host is read from the endpoints for the Kubernetes service.
 		kubernetesEndpoint, err := ctx.KubernetesClient(t).CoreV1().Endpoints("default").Get(context.Background(), "kubernetes", metav1.GetOptions{})
 		require.NoError(t, err)
-		k8sAPIHost = fmt.Sprintf("https://%s:%d", kubernetesEndpoint.Subsets[0].Addresses[0].IP, kubernetesEndpoint.Subsets[0].Ports[0].Port)
+		k8sAPIHost = fmt.Sprintf("https://%s", net.JoinHostPort(kubernetesEndpoint.Subsets[0].Addresses[0].IP, strconv.Itoa(int(kubernetesEndpoint.Subsets[0].Ports[0].Port))))
 	} else {
 		k8sAPIHost = KubernetesAPIServerHostFromOptions(t, ctx.KubectlOptions(t))
 	}

acceptance/framework/k8s/kubectl.go

@@ -68,7 +68,7 @@ func RunKubectlAndGetOutputWithLoggerE(t testutil.TestingTB, options *k8s.Kubect
 	var output string
 	var err error
 	retry.RunWith(counter, t, func(r *retry.R) {
-		output, err = helpers.RunCommand(r, options, command)
+		output, err = helpers.RunCommand(t, options, command)
 		if err != nil {
 			// Want to retry on errors connecting to actual Kube API because
 			// these are intermittent.

acceptance/tests/peering/peering_connect_namespaces_test.go

@@ -315,6 +315,7 @@ func TestPeering_ConnectNamespaces(t *testing.T) {
 			// Kubernetes namespace.
 			// If a single destination namespace is set, we expect all services
 			// to be registered in that destination Consul namespace.
+
 			// Server cluster.
 			services, _, err := staticServerPeerClient.Catalog().Service(staticServerName, "", serverQueryOpts)
 			require.NoError(t, err)

charts/consul/templates/cni-daemonset.yaml

@@ -71,6 +71,8 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.uid
+            - name: CONSUL_DUAL_STACK
+              value: "{{ .Values.global.dualStack.defaultEnabled }}"
           command:
             - consul-k8s-control-plane
             - install-cni

charts/consul/templates/connect-inject-deployment.yaml

@@ -112,6 +112,8 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
+            - name: CONSUL_DUAL_STACK
+              value: "{{ .Values.global.dualStack.defaultEnabled }}"
             {{- include "consul.consulK8sConsulServerEnvVars" . | nindent 12 }}
             {{- if .Values.global.acls.manageSystemACLs }}
             - name: CONSUL_LOGIN_AUTH_METHOD

charts/consul/values.yaml

@@ -66,7 +66,7 @@ global:
   # image: "hashicorp/consul-enterprise:1.10.0-ent"
   # ```
   # @default: hashicorp/consul:<latest version>
-  image: docker.mirror.hashicorp.services/hashicorppreview/consul:1.22.0-dev
+  image: hashicorp/consul:1.22.0-rc1
 
   # Array of objects containing image pull secret names that will be applied to each service account.
   # This can be used to reference image pull secrets if using a custom consul or consul-k8s-control-plane Docker image.
@@ -86,7 +86,7 @@ global:
   # image that is used for functionality such as catalog sync.
   # This can be overridden per component.
   # @default: hashicorp/consul-k8s-control-plane:<latest version>
-  imageK8S: docker.mirror.hashicorp.services/hashicorppreview/consul-k8s-control-plane:1.7-dev
+  imageK8S: hashicorp/consul-k8s-control-plane:1.9.0-rc1
 
   # The image pull policy used globally for images controlled by Consul (consul, consul-dataplane, consul-k8s, consul-telemetry-collector).
   # One of "IfNotPresent", "Always", "Never", and "". Refer to https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
@@ -793,7 +793,7 @@ global:
   # The name (and tag) of the consul-dataplane Docker image used for the
   # connect-injected sidecar proxies and mesh, terminating, and ingress gateways.
   # @default: hashicorp/consul-dataplane:<latest supported version>
-  imageConsulDataplane: docker.mirror.hashicorp.services/hashicorppreview/consul-dataplane:1.7-dev
+  imageConsulDataplane: hashicorp/consul-dataplane:1.9.0-rc1
 
   # Configuration for running this Helm chart on the Red Hat OpenShift platform.
   # This Helm chart currently supports OpenShift v4.x+.

cli/common/envoy/http.go

@@ -12,6 +12,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"strconv"
 	"strings"
 
 	"github.com/hashicorp/consul-k8s/cli/common"
@@ -190,7 +191,7 @@ func (c *EnvoyConfig) UnmarshalJSON(b []byte) error {
 	for _, clusterStatus := range root.Clusters.ClusterStatuses {
 		var addresses []string
 		for _, status := range clusterStatus.HostStatuses {
-			address := fmt.Sprintf("%s:%d", status.Address.SocketAddress.Address, int(status.Address.SocketAddress.PortValue))
+			address := net.JoinHostPort(status.Address.SocketAddress.Address, strconv.Itoa(int(status.Address.SocketAddress.PortValue)))
 			addresses = append(addresses, address)
 			endpointMapping[address] = clusterStatus.Name
 		}
@@ -256,7 +257,7 @@ func parseClusters(rawCfg map[string]interface{}, clusterMapping map[string][]st
 			for _, lbEndpoint := range endpoint.LBEndpoints {
 				// Only add endpoints defined by IP addresses.
 				if addr := lbEndpoint.Endpoint.Address.SocketAddress.Address; net.ParseIP(addr) != nil {
-					endpoints = append(endpoints, fmt.Sprintf("%s:%d", addr, int(lbEndpoint.Endpoint.Address.SocketAddress.PortValue)))
+					endpoints = append(endpoints, net.JoinHostPort(addr, strconv.Itoa(int(lbEndpoint.Endpoint.Address.SocketAddress.PortValue))))
 				}
 			}
 		}
@@ -305,7 +306,7 @@ func parseEndpoints(rawCfg map[string]interface{}, endpointMapping map[string]st
 	for _, endpointConfig := range append(endpointsCD.StaticEndpointConfigs, endpointsCD.DynamicEndpointConfigs...) {
 		for _, endpoint := range endpointConfig.EndpointConfig.Endpoints {
 			for _, lbEndpoint := range endpoint.LBEndpoints {
-				address := fmt.Sprintf("%s:%d", lbEndpoint.Endpoint.Address.SocketAddress.Address, int(lbEndpoint.Endpoint.Address.SocketAddress.PortValue))
+				address := net.JoinHostPort(lbEndpoint.Endpoint.Address.SocketAddress.Address, strconv.Itoa(int(lbEndpoint.Endpoint.Address.SocketAddress.PortValue)))
 
 				cluster := endpointConfig.EndpointConfig.Name
 				// Fill in cluster from EDS endpoint mapping.
@@ -346,7 +347,7 @@ func parseListeners(rawCfg map[string]interface{}) ([]Listener, error) {
 	listenersConfig = append(listenersConfig, listenersCD.StaticListeners...)
 
 	for _, listener := range listenersConfig {
-		address := fmt.Sprintf("%s:%d", listener.Listener.Address.SocketAddress.Address, int(listener.Listener.Address.SocketAddress.PortValue))
+		address := net.JoinHostPort(listener.Listener.Address.SocketAddress.Address, strconv.Itoa(int(listener.Listener.Address.SocketAddress.PortValue)))
 
 		// Format the filter chain configs into something more readable.
 		filterChain := []FilterChain{}

control-plane/api-gateway/binding/registration.go

@@ -5,6 +5,8 @@ package binding
 
 import (
 	"fmt"
+	"net"
+	"strconv"
 
 	gatewaycommon "github.com/hashicorp/consul-k8s/control-plane/api-gateway/common"
 	"github.com/hashicorp/consul-k8s/control-plane/connect-inject/common"
@@ -50,7 +52,7 @@ func registrationForPod(metrics gatewaycommon.MetricsConfig, namespace string, g
 	if metrics.Enabled {
 		proxyConfigOverrides = &api.AgentServiceConnectProxyConfig{
 			Config: map[string]interface{}{
-				metricsConfiguration: fmt.Sprintf("%s:%d", pod.Status.PodIP, metrics.Port),
+				metricsConfiguration: net.JoinHostPort(pod.Status.PodIP, strconv.Itoa(metrics.Port)),
 			},
 		}
 	}

control-plane/api-gateway/controllers/gateway_controller.go

@@ -66,6 +66,7 @@ type GatewayController struct {
 	allowK8sNamespacesSet mapset.Set
 	denyK8sNamespacesSet  mapset.Set
 	client.Client
+	ConsulConfig *consul.Config
 }
 
 // Reconcile handles the reconciliation loop for Gateway objects.
@@ -364,7 +365,7 @@ func configEntriesTo[T api.ConfigEntry](entries []api.ConfigEntry) []T {
 }
 
 func (r *GatewayController) deleteGatekeeperResources(ctx context.Context, log logr.Logger, gw *gwv1beta1.Gateway) error {
-	gk := gatekeeper.New(log, r.Client)
+	gk := gatekeeper.New(log, r.Client, r.ConsulConfig)
 	err := gk.Delete(ctx, *gw)
 	if err != nil {
 		return err
@@ -374,7 +375,7 @@ func (r *GatewayController) deleteGatekeeperResources(ctx context.Context, log l
 }
 
 func (r *GatewayController) updateGatekeeperResources(ctx context.Context, log logr.Logger, gw *gwv1beta1.Gateway, gwcc *v1alpha1.GatewayClassConfig) error {
-	gk := gatekeeper.New(log, r.Client)
+	gk := gatekeeper.New(log, r.Client, r.ConsulConfig)
 	err := gk.Upsert(ctx, *gw, *gwcc, r.HelmConfig)
 	if err != nil {
 		return err
@@ -418,6 +419,7 @@ func SetupGatewayControllerWithManager(ctx context.Context, mgr ctrl.Manager, co
 		allowK8sNamespacesSet: config.AllowK8sNamespacesSet,
 		cache:                 c,
 		gatewayCache:          gwc,
+		ConsulConfig:          config.ConsulClientConfig,
 	}
 
 	cleaner := binding.Cleaner{

control-plane/api-gateway/controllers/gateway_controller_integration_test.go

@@ -32,6 +32,7 @@ import (
 	gwv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
+	"github.com/hashicorp/consul/agent/netutil"
 	"github.com/hashicorp/consul/api"
 
 	"github.com/hashicorp/consul-k8s/control-plane/api-gateway/cache"
@@ -41,6 +42,7 @@ import (
 )
 
 func TestControllerDoesNotInfinitelyReconcile(t *testing.T) {
+	netutil.GetAgentBindAddrFunc = netutil.GetMockGetAgentBindAddrFunc("0.0.0.0")
 	s := runtime.NewScheme()
 	require.NoError(t, clientgoscheme.AddToScheme(s))
 	require.NoError(t, gwv1alpha2.Install(s))

control-plane/api-gateway/gatekeeper/dataplane.go

@@ -5,6 +5,7 @@ package gatekeeper
 
 import (
 	"fmt"
+	"os"
 	"strconv"
 
 	corev1 "k8s.io/api/core/v1"
@@ -154,16 +155,38 @@ func getDataplaneArgs(metrics common.MetricsConfig, namespace string, config com
 	proxyIDFileName := "/consul/connect-inject/proxyid"
 	envoyConcurrency := defaultEnvoyProxyConcurrency
 
+	envoyAdminBindAddress := "127.0.0.1"
+	consulDPBindAddress := "127.0.0.1"
+	xdsBindAddress := "127.0.0.1"
+
+	dualStack := false
+	if os.Getenv(constants.ConsulDualStackEnvVar) == "true" {
+		dualStack = true
+	}
+	if dualStack {
+		envoyAdminBindAddress = "::1"
+		consulDPBindAddress = "::"
+		xdsBindAddress = "::1"
+	}
+
 	args := []string{
 		"-addresses", config.ConsulConfig.Address,
+		"-envoy-admin-bind-address=" + envoyAdminBindAddress,
+		"-xds-bind-addr=" + xdsBindAddress,
 		"-grpc-port=" + strconv.Itoa(config.ConsulConfig.GRPCPort),
 		"-proxy-service-id-path=" + proxyIDFileName,
 		"-log-level=" + config.LogLevel,
 		"-log-json=" + strconv.FormatBool(config.LogJSON),
 		"-envoy-concurrency=" + strconv.Itoa(envoyConcurrency),
+		"-graceful-addr=" + consulDPBindAddress,
 	}
 
-	consulNamespace := namespaces.ConsulNamespace(namespace, config.EnableNamespaces, config.ConsulDestinationNamespace, config.EnableNamespaceMirroring, config.NamespaceMirroringPrefix)
+	consulNamespace := namespaces.ConsulNamespace(
+		namespace, config.EnableNamespaces,
+		config.ConsulDestinationNamespace,
+		config.EnableNamespaceMirroring,
+		config.NamespaceMirroringPrefix,
+	)
 
 	if config.AuthMethod != "" {
 		args = append(args,

control-plane/api-gateway/gatekeeper/gatekeeper.go

@@ -14,19 +14,22 @@ import (
 
 	"github.com/hashicorp/consul-k8s/control-plane/api-gateway/common"
 	"github.com/hashicorp/consul-k8s/control-plane/api/v1alpha1"
+	"github.com/hashicorp/consul-k8s/control-plane/consul"
 )
 
 // Gatekeeper is used to manage the lifecycle of Gateway deployments and services.
 type Gatekeeper struct {
-	Log    logr.Logger
-	Client client.Client
+	Log          logr.Logger
+	Client       client.Client
+	ConsulConfig *consul.Config
 }
 
 // New creates a new Gatekeeper from the Config.
-func New(log logr.Logger, client client.Client) *Gatekeeper {
+func New(log logr.Logger, client client.Client, consulConfig *consul.Config) *Gatekeeper {
 	return &Gatekeeper{
-		Log:    log,
-		Client: client,
+		Log:          log,
+		Client:       client,
+		ConsulConfig: consulConfig,
 	}
 }
 

control-plane/api-gateway/gatekeeper/gatekeeper_test.go

@@ -27,6 +27,7 @@ import (
 	"github.com/hashicorp/consul-k8s/control-plane/api-gateway/common"
 	"github.com/hashicorp/consul-k8s/control-plane/api/v1alpha1"
 	"github.com/hashicorp/consul-k8s/control-plane/connect-inject/constants"
+	"github.com/hashicorp/consul/agent/netutil"
 )
 
 const (
@@ -1153,8 +1154,8 @@ func TestUpsert(t *testing.T) {
 
 			objs := append(joinResources(tc.initialResources), &tc.gateway, &tc.gatewayClassConfig)
 			client := fake.NewClientBuilder().WithScheme(s).WithObjects(objs...).Build()
-
-			gatekeeper := New(log, client)
+			netutil.GetAgentBindAddrFunc = netutil.GetMockGetAgentBindAddrFunc("0.0.0.0")
+			gatekeeper := New(log, client, nil)
 
 			err := gatekeeper.Upsert(context.Background(), tc.gateway, tc.gatewayClassConfig, tc.helmConfig)
 			require.NoError(t, err)
@@ -1406,8 +1407,8 @@ func TestDelete(t *testing.T) {
 
 			objs := append(joinResources(tc.initialResources), &tc.gateway, &tc.gatewayClassConfig)
 			client := fake.NewClientBuilder().WithScheme(s).WithObjects(objs...).Build()
-
-			gatekeeper := New(log, client)
+			netutil.GetAgentBindAddrFunc = netutil.GetMockGetAgentBindAddrFunc("0.0.0.0")
+			gatekeeper := New(log, client, nil)
 
 			err := gatekeeper.Delete(context.Background(), tc.gateway)
 			require.NoError(t, err)