--- reviewers: - lachie83 - khenidak - bridgetkromhout min-kubernetes-server-version: v1.23 title: Validate IPv4/IPv6 dual-stack content_type: task --- This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clusters. ## {{% heading "prerequisites" %}} * Provider support for dual-stack networking (Cloud provider or otherwise must be able to provide Kubernetes nodes with routable IPv4/IPv6 network interfaces) * A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack networking. * [Dual-stack enabled](/docs/concepts/services-networking/dual-stack/) cluster {{< version-check >}} {{< note >}} While you can validate with an earlier version, the feature is only GA and officially supported since v1.23. {{< /note >}} ## Validate addressing ### Validate node addressing Each dual-stack Node should have a single IPv4 block and a single IPv6 block allocated. Validate that IPv4/IPv6 Pod address ranges are configured by running the following command. Replace the sample node name with a valid dual-stack Node from your cluster. In this example, the Node's name is `k8s-linuxpool1-34450317-0`: ```shell kubectl get nodes k8s-linuxpool1-34450317-0 -o go-template --template='{{range .spec.podCIDRs}}{{printf "%s\n" .}}{{end}}' ``` ``` 10.244.1.0/24 2001:db8::/64 ``` There should be one IPv4 block and one IPv6 block allocated. Validate that the node has an IPv4 and IPv6 interface detected. Replace node name with a valid node from the cluster. In this example the node name is `k8s-linuxpool1-34450317-0`: ```shell kubectl get nodes k8s-linuxpool1-34450317-0 -o go-template --template='{{range .status.addresses}}{{printf "%s: %s\n" .type .address}}{{end}}' ``` ``` Hostname: k8s-linuxpool1-34450317-0 InternalIP: 10.0.0.5 InternalIP: 2001:db8:10::5 ``` ### Validate Pod addressing Validate that a Pod has an IPv4 and IPv6 address assigned. Replace the Pod name with a valid Pod in your cluster. In this example the Pod name is `pod01`: ```shell kubectl get pods pod01 -o go-template --template='{{range .status.podIPs}}{{printf "%s\n" .ip}}{{end}}' ``` ``` 10.244.1.4 2001:db8::4 ``` You can also validate Pod IPs using the Downward API via the `status.podIPs` fieldPath. The following snippet demonstrates how you can expose the Pod IPs via an environment variable called `MY_POD_IPS` within a container. ```yaml env: - name: MY_POD_IPS valueFrom: fieldRef: fieldPath: status.podIPs ``` The following command prints the value of the `MY_POD_IPS` environment variable from within a container. The value is a comma separated list that corresponds to the Pod's IPv4 and IPv6 addresses. ```shell kubectl exec -it pod01 -- set | grep MY_POD_IPS ``` ``` MY_POD_IPS=10.244.1.4,2001:db8::4 ``` The Pod's IP addresses will also be written to `/etc/hosts` within a container. The following command executes a cat on `/etc/hosts` on a dual stack Pod. From the output you can verify both the IPv4 and IPv6 IP address for the Pod. ```shell kubectl exec -it pod01 -- cat /etc/hosts ``` ``` # Kubernetes-managed hosts file. 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet fe00::0 ip6-mcastprefix fe00::1 ip6-allnodes fe00::2 ip6-allrouters 10.244.1.4 pod01 2001:db8::4 pod01 ``` ## Validate Services Create the following Service that does not explicitly define `.spec.ipFamilyPolicy`. Kubernetes will assign a cluster IP for the Service from the first configured `service-cluster-ip-range` and set the `.spec.ipFamilyPolicy` to `SingleStack`. {{% code_sample file="service/networking/dual-stack-default-svc.yaml" %}} Use `kubectl` to view the YAML for the Service. ```shell kubectl get svc my-service -o yaml ``` The Service has `.spec.ipFamilyPolicy` set to `SingleStack` and `.spec.clusterIP` set to an IPv4 address from the first configured range set via `--service-cluster-ip-range` flag on kube-controller-manager. ```yaml apiVersion: v1 kind: Service metadata: name: my-service namespace: default spec: clusterIP: 10.0.217.164 clusterIPs: - 10.0.217.164 ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - port: 80 protocol: TCP targetPort: 9376 selector: app.kubernetes.io/name: MyApp sessionAffinity: None type: ClusterIP status: loadBalancer: {} ``` Create the following Service that explicitly defines `IPv6` as the first array element in `.spec.ipFamilies`. Kubernetes will assign a cluster IP for the Service from the IPv6 range configured `service-cluster-ip-range` and set the `.spec.ipFamilyPolicy` to `SingleStack`. {{% code_sample file="service/networking/dual-stack-ipfamilies-ipv6.yaml" %}} Use `kubectl` to view the YAML for the Service. ```shell kubectl get svc my-service -o yaml ``` The Service has `.spec.ipFamilyPolicy` set to `SingleStack` and `.spec.clusterIP` set to an IPv6 address from the IPv6 range set via `--service-cluster-ip-range` flag on kube-controller-manager. ```yaml apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/name: MyApp name: my-service spec: clusterIP: 2001:db8:fd00::5118 clusterIPs: - 2001:db8:fd00::5118 ipFamilies: - IPv6 ipFamilyPolicy: SingleStack ports: - port: 80 protocol: TCP targetPort: 80 selector: app.kubernetes.io/name: MyApp sessionAffinity: None type: ClusterIP status: loadBalancer: {} ``` Create the following Service that explicitly defines `PreferDualStack` in `.spec.ipFamilyPolicy`. Kubernetes will assign both IPv4 and IPv6 addresses (as this cluster has dual-stack enabled) and select the `.spec.ClusterIP` from the list of `.spec.ClusterIPs` based on the address family of the first element in the `.spec.ipFamilies` array. {{% code_sample file="service/networking/dual-stack-preferred-svc.yaml" %}} {{< note >}} The `kubectl get svc` command will only show the primary IP in the `CLUSTER-IP` field. ```shell kubectl get svc -l app.kubernetes.io/name=MyApp ``` ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE my-service ClusterIP 10.0.216.242 80/TCP 5s ``` {{< /note >}} Validate that the Service gets cluster IPs from the IPv4 and IPv6 address blocks using `kubectl describe`. You may then validate access to the service via the IPs and ports. ```shell kubectl describe svc -l app.kubernetes.io/name=MyApp ``` ``` Name: my-service Namespace: default Labels: app.kubernetes.io/name=MyApp Annotations: Selector: app.kubernetes.io/name=MyApp Type: ClusterIP IP Family Policy: PreferDualStack IP Families: IPv4,IPv6 IP: 10.0.216.242 IPs: 10.0.216.242,2001:db8:fd00::af55 Port: 80/TCP TargetPort: 9376/TCP Endpoints: Session Affinity: None Events: ``` ### Create a dual-stack load balanced Service If the cloud provider supports the provisioning of IPv6 enabled external load balancers, create the following Service with `PreferDualStack` in `.spec.ipFamilyPolicy`, `IPv6` as the first element of the `.spec.ipFamilies` array and the `type` field set to `LoadBalancer`. {{% code_sample file="service/networking/dual-stack-prefer-ipv6-lb-svc.yaml" %}} Check the Service: ```shell kubectl get svc -l app.kubernetes.io/name=MyApp ``` Validate that the Service receives a `CLUSTER-IP` address from the IPv6 address block along with an `EXTERNAL-IP`. You may then validate access to the service via the IP and port. ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE my-service LoadBalancer 2001:db8:fd00::7ebc 2603:1030:805::5 80:30790/TCP 35s ```