At the moment, we are binding only to 127.0.0.1 for listeners, which forces IPv4 only.

According to envoy's SocketAddress doc, we would need to bind to :: and set ipv4_compat: true in order to support dual stack.

As far as I understand, communication inside a pod on localhost addresses, no matter the stack, are not affected by networkpolicies.

I've updated the task description to match the work needed :)

In T355686#9481762, @Clement_Goubert wrote:

At the moment, we are binding only to 127.0.0.1 for listeners, which forces IPv4 only.

According to envoy's SocketAddress doc, we would need to bind to :: and set ipv4_compat: true in order to support dual stack.

Let's avoid ipv4_compat: true please. It can be a mess. Look at T255568 about a long discussion regarding this. The proper way is to listen on both address families (dual-stack binding), effectively (and unfortunately, but that's how envoy works) duplicating the configuration. I 've followed that approach already in that task, admittedly for a subset of our envoy installations.

As far as I understand, communication inside a pod on localhost addresses, no matter the stack, are not affected by networkpolicies.

Absolutely correct.

Change 1003368 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/deployment-charts@master] eventstreams: Bump mesh.configuration to 1.7

https://gerrit.wikimedia.org/r/1003368

Change 1003369 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/deployment-charts@master] cxserver: Bump mesh.configuration to 1.7

https://gerrit.wikimedia.org/r/1003369

Change 1003376 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/deployment-charts@master] rec-api: Bump mesh.configuration to 1.7

https://gerrit.wikimedia.org/r/1003376

Change 1003377 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/deployment-charts@master] wikifunctions: Add mesh.configuration in package.json

https://gerrit.wikimedia.org/r/1003377

Change 1003368 merged by jenkins-bot:

[operations/deployment-charts@master] eventstreams: Bump mesh.configuration to 1.7

https://gerrit.wikimedia.org/r/1003368

Change 1003376 merged by jenkins-bot:

[operations/deployment-charts@master] rec-api: Bump mesh.configuration to 1.7

https://gerrit.wikimedia.org/r/1003376

I 've posted changes to revert the hardcoded of localhost to 127.0.0.1. I 've already deployed eventstreams and recommendation-api changes since Luca isn't currently around. cxserver and function-orchestrator devs have been added to the other 2 changes.

Change 1003377 merged by jenkins-bot:

[operations/deployment-charts@master] wikifunctions: Add mesh.configuration in package.json

https://gerrit.wikimedia.org/r/1003377

Change 1003369 merged by jenkins-bot:

[operations/deployment-charts@master] cxserver: Bump mesh.configuration to 1.7

https://gerrit.wikimedia.org/r/1003369

Mentioned in SAL (#wikimedia-operations) [2024-02-20T12:04:12Z] <kart_> cxserver: Update to 2024-02-15-085232-production + Bump mesh.configuration to 1.7 (T333969, T352747, T355686, T255568)