tailscale / tailscale

The easiest, most secure way to use WireGuard and 2FA.

https://tailscale.com

BSD 3-Clause "New" or "Revised" License

16.88k stars 1.28k forks source link

K8S operator fails without IPV6 #11860

Closed disconn3ct closed 4 days ago

disconn3ct commented 3 weeks ago

If ipv6 is disabled, the sysctler container errors out: sysctl: error: 'net.ipv6/conf/all/forwarding' is an unknown key

https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/manifests/proxy.yaml#L20

irbekrm commented 3 weeks ago

I guess your Kubernetes nodes don't have the IPv6 kernel module at all. Could you verify that by running sysctl -a | grep ipv6 on the node? Out of interest, what Kubernetes distribution/what OS is this?

disconn3ct commented 3 weeks ago

Home lab, made of RPI 4 under K3S. IPV6 is explicitly disabled in the kernel commandline.

irbekrm commented 3 weeks ago

I don't have a VM at hand with IPv6 module compiled out to test, but I believe https://github.com/tailscale/tailscale/pull/11867 should fix this

irbekrm commented 2 weeks ago

11867 has been merged and should fix this, I've also cut a new dev release (chart version "1.65.117", app version "unstable-v1.65.117) with this change. Let us know if it fixes your issue

disconn3ct commented 1 week ago

Where is that chart version hosted?

Edit: found it, and it is working as expected. Thanks!

irbekrm commented 4 days ago

Thanks for confirming @disconn3ct ! We will release a stable (1.66) chart that includes the fix soon