Description

Add support and enable IPv6 on cloudgw.

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
cloudgw: refresh forwarding firewall to accomodate for IPv6	operations/puppet	production	+10 -2
cloudgw: set IPv6 forwarding in all interfaces	operations/puppet	production	+14 -7
cloudgw: fix IPv6 settings	operations/puppet	production	+0 -28
cloudgw: add IPv6 support	operations/puppet	production	+66 -0

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Open	None	T53494 Use Beta cluster as a true canary for code deployments (epic)
Declined	None	T87220 Minimize infrastructure differences between Beta Cluster and production
Open	None	T211677 Support IPv6 in beta
Open	None	T404466 Support IPv6-only VMs
Open	None	T392688 Enable IPv6 on Cloud VPS infrastructure services
Resolved	taavi	T379175 Enable IPv6 for the Cloud VPS web proxy
Open	None	T270694 CloudVPS: introduce tenant networks
Resolved	• aborrero	T364725 Migrate Cloud VPS instances to VXLAN based networks
Open	None	T392509 Enable IPv6 for Toolforge services
Resolved	taavi	T392506 Enable IPv6 for tools.wmflabs.org / *.toolserver.org legacy redirector service
Resolved	taavi	T211575 Enable IPv6 on toolforge.org
Resolved	None	T209460 CloudVPS: network architecture
Resolved	None	T244727 CloudVPS: networking improvements
Open	None	T220306 Add IPv6 monitoring
Resolved	• aborrero	T37947 Enable IPv6 on CloudVPS
Resolved	• aborrero	T245495 CloudVPS: IPv6 in codfw1dev
Resolved	• aborrero	T374716 cloudgw: add support and enable IPv6
Resolved	cmooney	T374713 cloudsw: codfw: enable IPv6
Resolved	• aborrero	T376879 keepalived: it doesn't support mixing IPv4 and IPv6 VIPs on the same VRRP instance

Event Timeline

• aborrero created this task.Sep 13 2024, 12:55 PM

Restricted Application removed a subscriber: taavi. · View Herald TranscriptSep 13 2024, 12:55 PM

• aborrero added a subtask: T374713: cloudsw: codfw: enable IPv6.Sep 13 2024, 12:56 PM

• aborrero mentioned this in T245495: CloudVPS: IPv6 in codfw1dev.

• aborrero moved this task from Backlog to Next on the User-aborrero board.Sep 16 2024, 11:20 AM

• aborrero triaged this task as Medium priority.Sep 18 2024, 2:07 PM

ayounsi moved this task from Backlog to Watching on the netops board.Sep 24 2024, 1:56 PM

taavi added a project: Cloud-VPS.Sep 28 2024, 11:33 AM

taavi moved this task from Unsorted to Network on the Cloud-VPS board.

• aborrero mentioned this in T375847: openstack: initial IPv6 support in neutron.Oct 2 2024, 12:44 PM

Change #1077712 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] cloudgw: add wan IPv6 support

https://gerrit.wikimedia.org/r/1077712

gerritbot added a project: Patch-For-Review.Oct 3 2024, 1:09 PM

• aborrero moved this task from Next to Doing on the User-aborrero board.Oct 7 2024, 10:12 AM

• aborrero moved this task from Doing to Blocked/waiting on the User-aborrero board.Oct 7 2024, 10:15 AM

Change #1077712 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] cloudgw: add IPv6 support

https://gerrit.wikimedia.org/r/1077712

Mentioned in SAL (#wikimedia-cloud) [2024-10-10T09:19:52Z] <arturo> [codfw1dev] enable IPv6 on cloudgw (T374716)

Maintenance_bot removed a project: Patch-For-Review.Oct 10 2024, 9:30 AM

• aborrero closed subtask T376879: keepalived: it doesn't support mixing IPv4 and IPv6 VIPs on the same VRRP instance as Resolved.Oct 10 2024, 10:25 AM

• aborrero reopened subtask T376879: keepalived: it doesn't support mixing IPv4 and IPv6 VIPs on the same VRRP instance as In Progress.Oct 10 2024, 10:48 AM

cmooney closed subtask T374713: cloudsw: codfw: enable IPv6 as Resolved.Oct 10 2024, 1:45 PM

Change #1079449 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] cloudgw: don't enable sysctl rp_filter for IPv6

https://gerrit.wikimedia.org/r/1079449

gerritbot added a project: Patch-For-Review.Oct 11 2024, 8:38 AM

Change #1079449 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] cloudgw: fix IPv6 settings

https://gerrit.wikimedia.org/r/1079449

Maintenance_bot removed a project: Patch-For-Review.Oct 11 2024, 10:30 AM

• aborrero closed subtask T376879: keepalived: it doesn't support mixing IPv4 and IPv6 VIPs on the same VRRP instance as Resolved.Oct 11 2024, 11:26 AM

Change #1079508 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] cloudgw: set IPv6 forwarding in all interfaces

https://gerrit.wikimedia.org/r/1079508

gerritbot added a project: Patch-For-Review.Oct 11 2024, 12:42 PM

Change #1079515 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] cloudgw: refresh forwarding firewall to accomodate for IPv6

https://gerrit.wikimedia.org/r/1079515

Change #1079508 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] cloudgw: set IPv6 forwarding in all interfaces

https://gerrit.wikimedia.org/r/1079508

Change #1079515 merged by Arturo Borrero Gonzalez:

[operations/puppet@production] cloudgw: refresh forwarding firewall to accomodate for IPv6

https://gerrit.wikimedia.org/r/1079515

Maintenance_bot removed a project: Patch-For-Review.Oct 11 2024, 3:30 PM

Mentioned in SAL (#wikimedia-cloud) [2024-10-11T15:31:37Z] <arturo> cloudgw maintenance firewall change T374716

FWIW I was curious about the setting so I labbed this up, and got the exact same results (on vrf-enabled interfaces and without).

net.ipv6.conf.all.forwarding must be set to 1 for forwarding to work for IPv6. This is not the case for IPv4, where it can be set on a per-interface basis. Some docs I found that seem to confirm this here:

https://linux.die.net/HOWTO/Linux+IPv6-HOWTO/proc-sys-net-ipv6..html

Also when setting the 'all' setting on it switches on all the various interface-specific toggles. I found if even I disabled ipv6 forwarding for a given interface after this (i.e. net.ipv6.conf.eth0.forwarding = 0) the system still forwards on that interface. So it seems the 'all' sysctl controls v6 forwarding for everything, and the per-interface controls are basically useless (carry over from v4 which maybe shouldn't be there?)

hashar mentioned this in T218783: `scap clean` failure: SSH Too many authentication failures: 7.Oct 16 2024, 9:01 AM

We got it all working on 2024-10-11.

cloudgw: add support and enable IPv6Closed, ResolvedPublicActions

Description

Details

Related ObjectsSearch...

Event Timeline

cloudgw: add support and enable IPv6
Closed, ResolvedPublic
Actions

Related Objects
Search...