atenet/dns: publish the router's IPv6 ClusterIP as an AAAA - #938
Open
Yuan Gao (ygao-g) wants to merge 3 commits into
Open
atenet/dns: publish the router's IPv6 ClusterIP as an AAAA#938Yuan Gao (ygao-g) wants to merge 3 commits into
Yuan Gao (ygao-g) wants to merge 3 commits into
Conversation
Yuan Gao (ygao-g)
force-pushed
the
atenet-dns-aaaa
branch
from
August 13, 2026 21:32
fd1ffd6 to
4b0e7c7
Compare
2 tasks
Before, the actor zone answered A queries and failed everything else -- AAAA for a valid actor, and any name in the zone that is not an actor. A failure reads as a temporary error rather than an answer, so clients retry it and then give up on the name; Alpine actors could not resolve each other at all, even on an IPv4-only cluster. After, those queries return a correct empty answer, and one that resolvers can cache. Unit tests pin the rendered zone. The before/after behaviour was verified against the pinned coredns/coredns:1.11.1, where an Alpine getent for an actor name goes from timing out to answering immediately.
Splits a Service's cluster IPs into its IPv4 and IPv6 entries, returning "" for a family the Service has no address in. No behaviour change on its own -- nothing calls it until the next commit. Shared rather than package-local because the DNS controller and the e2e dual-stack tests both have to agree on what "no address in that family" means: a Service with no ipFamilyPolicy is SingleStack, so that is the steady state everywhere, not an error. Unit tests cover single- and dual-stack Services and the unallocated and malformed cases.
Before, an actor name never resolved over IPv6. The zone published only the router's primary cluster IP and always as an A record, whatever family it was: on a dual-stack cluster the v6 address went unpublished, and on an IPv6-only cluster the record was malformed, so every A query for an actor name failed. After, the zone publishes an address record per family the router has an address in, and answers empty for a family it has none in. Also stops recomputing the Corefile generation timestamp per render, which was reloading CoreDNS on every reconcile tick. Unit tests pin the rendered zone for each family combination. The behaviour was verified against the pinned coredns/coredns:1.11.1.
Yuan Gao (ygao-g)
force-pushed
the
atenet-dns-aaaa
branch
from
August 14, 2026 01:24
4b0e7c7 to
79d4f34
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #874, whose commit appears in this diff until it merges.
Actor names have no IPv6 address. #874 made the zone answer
AAAAcorrectly but emptily; this gives it something to answer with. Every actor name resolves to the same address — theatenet-routerClusterIP, with per-actor demux happening at Envoy on the Host header — so publishing AAAA means publishing the router's v6 ClusterIP. The zone now publishes an address record per family the router has a ClusterIP in.It also fixes a hard failure on IPv6-only clusters, where the router's only ClusterIP is a v6 address and the zone published it as an
IN Arecord. EveryAquery for an actor name SERVFAILs there today, for every client, not just musl.Ordering against #911. Prefer landing after it, but the dependency is soft: without #911 the router Service is SingleStack, so no dual-stack cluster has a v6 ClusterIP to publish and the rendered zone is unchanged. The case to avoid is #911 being split — a dual-stack Service without the
::listener publishes an AAAA nothing is bound to, and Happy Eyeballs takes the working IPv4 path down with it.Also stops the Corefile generation timestamp from being recomputed per render, which was reloading CoreDNS on every reconcile tick.
Testing. Unit tests compare the whole rendered zone against a golden for each family combination, plus a manual pass against the pinned
coredns/coredns:1.11.1.TestActorDNSAAAAis the e2e counterpart and stays out of this PR — it needs the dual-stack e2e scaffolding, the same carve-out #874 makes forTestActorDNSZone.Part of #246.