hack: fix DNS on IPv6-only kind clusters - #958
Open
Yuan Gao (ygao-g) wants to merge 2 commits into
Open
Conversation
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
2 times, most recently
from
August 18, 2026 16:00
45bac3d to
ecf1fc6
Compare
Yuan Gao (ygao-g)
changed the title
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
3 times, most recently
from
August 18, 2026 22:07
e812e99 to
3350f55
Compare
This was referenced Aug 18, 2026
Yuan Gao (ygao-g)
added
kind/bug
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 19, 2026 00:16
3350f55 to
302995d
Compare
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 19, 2026 00:28
302995d to
e336c22
Compare
Yuan Gao (ygao-g)
requested review from
Benjamin Elder (BenTheElder) and
Bowei Du (bowei)
August 19, 2026 00:29
Yuan Gao (ygao-g)
marked this pull request as ready for review
August 19, 2026 00:32
Collaborator
Author
TestingManual Testing: CI has no IPv6 job and this PR does not add one — #1065 is a signal-only draft that produces that coverage on demand. |
Yuan Gao (ygao-g)
marked this pull request as draft
August 19, 2026 15:46
This was referenced Aug 19, 2026
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 19, 2026 16:40
533811a to
0212c2c
Compare
Yuan Gao (ygao-g)
marked this pull request as ready for review
August 19, 2026 16:45
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 19, 2026 17:17
0212c2c to
e5e975d
Compare
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
4 times, most recently
from
August 20, 2026 03:05
9cc9703 to
3dbf64b
Compare
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
11 times, most recently
from
August 27, 2026 16:41
beb7dc6 to
a0b159f
Compare
haiyanmeng
reviewed
Aug 27, 2026
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 27, 2026 20:03
a0b159f to
a22c540
Compare
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 27, 2026 20:28
a22c540 to
f3e7447
Compare
This was referenced Aug 27, 2026
Benjamin Elder (BenTheElder)
left a comment
Benjamin Elder (BenTheElder)
left a comment
Collaborator
There was a problem hiding this comment.
Bowei Du (@bowei) we're going to have to rewrite this in go too, sigh
this is meant to represent a portable cluster, if we customize it heavily then we're really not proving substrate works generically
can we please file upstream issues with the relevant projects for each thing we're working around, so we can actually fix them?
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 27, 2026 23:31
f3e7447 to
c711eca
Compare
Yuan Gao (ygao-g)
marked this pull request as draft
August 28, 2026 16:14
Yuan Gao (ygao-g)
changed the title
Yuan Gao (ygao-g)
changed the title
Yuan Gao (ygao-g)
marked this pull request as ready for review
August 28, 2026 16:17
On an IPv6-only cluster the script rewrote kind's `https://[::1]:PORT` kubeconfig entry to `https://localhost:PORT` unconditionally. That breaks any host whose `/etc/hosts` leaves `localhost` off the `::1` line, including the Ubuntu cloud image Lima runs: `localhost` resolves v4-only and every later kubectl fails at connect. The rewrite existed for one case, a macOS client reaching kind inside a Lima VM, where limactl re-forwards the published port to the host's v4 loopback only. Running the loop inside the guest reaches `[::1]` directly and avoids that path entirely.
On a fresh IPv6-only kind cluster nothing resolves from inside a pod, so the install never completes. CoreDNS inherits the node's IPv4 resolver, which a v6-only pod cannot reach, and the in-cluster registry has no name a pod can look up. This gives the cluster its own Corefile, gated on ipv6: a forward to an IPv6 upstream, overridable with IPV6_DNS_UPSTREAM, and a kind-registry:53 server block so atelet can pull from its own network namespace. The Corefile patch runs kubectl straight after `kind create`, which returns before the apiserver answers, so the script now waits for the control plane from inside the node first.
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns
branch
from
August 28, 2026 16:23
c711eca to
1cb5a78
Compare
This was referenced Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An IPv6-only kind cluster is unusable today:
For 1., remove the overwrite, which is only needed for a macOS client reaching kind inside a Lima VM.
For 2., forward to a upstream IPv6 DNS upstream instead of the node's IPv4 resolver, and a kind-registry:53 server block so atelet can pull from its own
network namespace.
Verified in a Lima guest on mac OS. IP_FAMILY=ipv6 comes up clean; kind's untouched
https://[::1]:PORT answers ok; from a v6-only pod www.google.com,
kubernetes.default.svc.cluster.local and kind-registry. all resolve. IPv4 is
unaffected — the new block is gated on ipv6.
Part of #1099.
Part of #246.
🤖 Generated with Claude Code