hack: fix DNS on IPv6-only kind clusters - #958
Draft
Yuan Gao (ygao-g) wants to merge 1 commit into
Draft
Conversation
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
2 times, most recently
from
August 18, 2026 16:00
45bac3d to
ecf1fc6
Compare
Yuan Gao (ygao-g)
changed the title
CoreDNS runs dnsPolicy: Default and inherits the node's Docker-generated /etc/resolv.conf, which always names an IPv4 resolver -- unreachable from a v6-only pod, so every external lookup SERVFAILs and anything that fetches at runtime never starts. Behind that sits a second failure: the registry is wired into containerd on the node, but atelet pulls actor images from its own pod netns, where kind-registry does not resolve at all. On IPv6-only clusters CoreDNS now answers for kind-registry and forwards everything else to an IPv6 upstream, overridable with IPV6_DNS_UPSTREAM where the default is unreachable. A pod resolves external names and reaches the registry, so atelet fetches its sandbox assets and actors boot. One component, atenet-egress, still crashloops on a v6-only cluster for an unrelated Envoy bind bug. IPv4 and dual-stack clusters are unchanged.
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 18, 2026 21:31
ecf1fc6 to
e6fc8a8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #246.
On a fresh
IP_FAMILY=ipv6cluster nothing resolves from inside a pod, so noactor ever boots. CoreDNS runs
dnsPolicy: Defaultand inherits the node'sDocker-generated
/etc/resolv.conf, which always names an IPv4 resolver av6-only pod cannot reach. Separately, the script wires the registry into
containerd on the node, which does not help atelet — it pulls actor images
from its own netns, where
kind-registrydoes not resolve at all.On IPv6-only clusters CoreDNS now answers for
kind-registryand forwardseverything else to an IPv6 upstream, overridable with
IPV6_DNS_UPSTREAMwherethe default (Google Public DNS) is unreachable. A pod resolves external names
and reaches the registry, so the control plane installs and the counter demo
boots. IPv4 and dual-stack clusters are untouched.
Exercised by the IPv6-only CI job in #939, which stacks on this: control-plane
install plus the
demoandnetworkingsuites on a v6-only cluster. That joboverrides
IPV6_DNS_UPSTREAMfor NAT64, since GitHub runners have no IPv6egress.
🤖 Generated with Claude Code