Skip to content

[feat] Add IPv6 public backends for NodeBalancers#545

Draft
komer3 wants to merge 39 commits intomainfrom
ipv6-backend-support
Draft

[feat] Add IPv6 public backends for NodeBalancers#545
komer3 wants to merge 39 commits intomainfrom
ipv6-backend-support

Conversation

@komer3
Copy link
Contributor

@komer3 komer3 commented Mar 12, 2026

Summary

  • add IPv6 backend support for NodeBalancer services using node public IPv6 SLAAC addresses
  • keep the backend selection explicit through controller flag and service annotation without implying VPC IPv6 backend support
  • add controller/chart/docs and e2e coverage for the IPv6 backend behavior

Behavior

  • introduces --enable-ipv6-for-nodebalancer-backends as a global controller flag
  • introduces service.beta.kubernetes.io/linode-loadbalancer-enable-ipv6-backends as a per-service override
  • applies IPv6 backend selection to NodeBalancer services by using node public IPv6 SLAAC addresses
  • does not add support for VPC IPv6 backends or rely on VPC subnet configuration for backend programming
  • enabling the global flag can migrate existing eligible services from IPv4 to IPv6 backends during reconcile
  • requires the selected public IPv6 address on each backend node and returns an error instead of silently falling back to IPv4
  • uses IPv6-safe backend host:port formatting for NodeBalancer node addresses

Code Changes

  • add the new service annotation constant in cloud/annotations/annotations.go
  • add the new controller option in cloud/linode/options/options.go and register the flag in main.go
  • update cloud/linode/loadbalancers.go to:
    • resolve IPv6 backend selection from the service annotation first, then the global flag
    • choose IPv6 node addresses using the existing node-address path for public IPv6 backends
    • keep backend selection focused on public IPv6 SLAAC addresses rather than VPC IPv6 backend support
    • rebuild backend node configs with IPv6-safe address formatting
  • add Helm chart support for the new controller flag in deploy/chart/templates/daemonset.yaml and deploy/chart/values.yaml
  • document the feature and backend behavior in docs/configuration/loadbalancer.md, docs/configuration/environment.md, and docs/configuration/annotations.md
  • ignore local generated cluster artifacts in .gitignore

Tests

Unit

  • extend cloud/linode/loadbalancers_test.go with coverage for:
    • IPv4 backend selection for the existing path
    • IPv6 backend selection from node IPv6 addresses
    • preserving the existing NodeBalancer request behavior while selecting public IPv6 backends via annotation or global flag
    • failing when IPv6 backends are requested and a node lacks the required public IPv6 address
    • global flag and service annotation precedence
    • IPv6-safe backend address formatting

E2E

  • add a new Chainsaw scenario under e2e/test/lb-with-ipv6-backends/
  • deploy a dual-stack LoadBalancer service annotated with linode-loadbalancer-enable-ipv6-backends: "true"
  • verify NodeBalancer backend node addresses returned by the Linode API are IPv6
  • verify traffic still reaches both backend pods through the service

Verification

  • go test ./cloud/linode/...
  • make test

@github-actions github-actions bot added the new-feature for new features in the changelog. label Mar 12, 2026
@codecov
Copy link

codecov bot commented Mar 12, 2026

Codecov Report

❌ Patch coverage is 86.95652% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.62%. Comparing base (c023298) to head (21d33c7).

Files with missing lines Patch % Lines
cloud/linode/loadbalancers.go 86.95% 6 Missing and 3 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #545      +/-   ##
==========================================
+ Coverage   73.43%   73.62%   +0.19%     
==========================================
  Files          19       19              
  Lines        2906     2927      +21     
==========================================
+ Hits         2134     2155      +21     
  Misses        523      523              
  Partials      249      249              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Move the post-generation CAPL manifest patching into a dedicated hack script so the Makefile stays readable while still injecting the eth1 IPv6 source-routing bootstrap and CCM image overrides into generated manifests.

The routing bootstrap installs a small systemd-backed script on control-plane and worker nodes to pin replies sourced from the public eth1 IPv6 back out through eth1. This avoids the dual-NIC ECMP reply-path issue that was causing public IPv6 backend traffic to leak to eth0 and flap NodeBalancer health.

Also fix the lb-with-node-addition e2e to discover the actual worker MachineDeployment by cluster label instead of assuming capl-cluster-md-0, and wait for ready replicas instead of sleeping blindly. That makes the test match current CAPL naming and removes the deterministic MachineDeployment not found failure.
Run lb-with-node-addition in its own CI step and dedicated Make target, using a Chainsaw label selector instead of the general all test batch. This keeps the cluster-scaling test from mutating node membership while other load-balancer tests are running in parallel.

Also widen the wait windows that were too short for CI: allow up to 10 minutes of 30-second polling for the new MachineDeployment replica to become ready, and extend the IPv6 load balancer readiness gate so backend programming and LB health checks have more time to settle.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

new-feature for new features in the changelog.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants