atenet/dns: publish the router's IPv6 ClusterIP as an AAAA - #938
Open
Yuan Gao (ygao-g) wants to merge 4 commits into
Open
atenet/dns: publish the router's IPv6 ClusterIP as an AAAA#938Yuan Gao (ygao-g) wants to merge 4 commits into
Yuan Gao (ygao-g) wants to merge 4 commits into
Conversation
Yuan Gao (ygao-g)
force-pushed
the
atenet-dns-aaaa
branch
from
August 13, 2026 21:32
fd1ffd6 to
4b0e7c7
Compare
Yuan Gao (ygao-g)
force-pushed
the
atenet-dns-aaaa
branch
2 times, most recently
from
August 14, 2026 17:02
79d4f34 to
ed6eaa7
Compare
Before, the actor zone answered A queries and failed everything else -- AAAA for a valid actor, and any name in the zone that is not an actor. A failure reads as a temporary error rather than an answer, so clients retry it and then give up on the name; Alpine actors could not resolve each other at all, even on an IPv4-only cluster. After, those queries return a correct empty answer, and one that resolvers can cache. A unit test pins the whole rendered zone as a literal, so editing the name pattern or the suffix fails there rather than passing silently.
Yuan Gao (ygao-g)
force-pushed
the
atenet-dns-aaaa
branch
from
August 18, 2026 14:45
ed6eaa7 to
5a7967f
Compare
Splits a Service's cluster IPs into its IPv4 and IPv6 entries, returning "" for a family the Service has no address in. No behavior change on its own -- nothing calls it until the AAAA change later in this series. It is shared rather than package-local because a Service with no ipFamilyPolicy is SingleStack, so one empty family is the steady state on every cluster, not an error, and each caller would otherwise have to decide that for itself. Unit tests cover single- and dual-stack Services and the unallocated and malformed cases.
No behavior change -- buildTemplate() already ran once, from init(). The next commit renders the Corefile on every call instead, where a stamp taken inline would differ each time: reconcile compares the render against the file on disk, so it would rewrite and reload CoreDNS every tick.
Before, an actor name never resolved over IPv6: the zone published the router's primary cluster IP, always as an A record whatever family it was. On a dual-stack cluster the v6 address went unpublished; on an IPv6-only cluster the record was malformed, so every A query for an actor name failed. After, the zone publishes an address record per family the router has an address in, and answers empty for a family it has none in. Unit tests pin the rendered zone for each family combination, verified against the pinned coredns/coredns:1.11.1.
Yuan Gao (ygao-g)
force-pushed
the
atenet-dns-aaaa
branch
from
August 18, 2026 15:50
5a7967f to
36cde91
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #874, whose commit appears in this diff until it merges.
Actor names have no IPv6 address. Every actor name resolves to the same
place — the
atenet-routerClusterIP, with per-actor demux at Envoy on theHost header — so the zone now publishes an address record per family the
router has a ClusterIP in. That also fixes a hard failure on IPv6-only
clusters, where the router's only ClusterIP is a v6 address published as an
IN A: everyAquery for an actor name SERVFAILs there today, for everyclient, not just musl.
Ordering against #911. Prefer landing after it, but the dependency is
soft — without #911 the router Service is SingleStack, so no dual-stack
cluster has a v6 ClusterIP to publish and the rendered zone is unchanged. The
case to avoid is #911 landing split: a dual-stack Service without the
::listener publishes an AAAA nothing is bound to, and Happy Eyeballs takes the
working IPv4 path down with it.
Part of #246.
🤖 Generated with Claude Code