[go: up one dir, main page]

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot push image using ipv6 address literal and port #39033

Closed
cboylan opened this issue Apr 8, 2019 · 5 comments
Closed

Cannot push image using ipv6 address literal and port #39033

cboylan opened this issue Apr 8, 2019 · 5 comments
Labels

Comments

@cboylan
Copy link
cboylan commented Apr 8, 2019

Description

Docker push does not work when specifying the host as an escaped ipv6 address literal with port designation.

Steps to reproduce the issue:

  1. docker push [2607:ff68:100:54:f816:3eff:fe7c:e98a]:5000/zuul/nodepool:latest

Describe the results you received:

"[2607:ff68:100:54:f816:3eff:fe7c:e98a]:5000/zuul/nodepool:latest" is not a valid repository/tag: invalid reference format

Describe the results you expected:

I expected docker to connect via ipv6 to tcp port 5000 at 2607:ff68:100:54:f816:3eff:fe7c:e98a and push the image into the registry running there.

Additional information you deem important (e.g. issue happens only occasionally):

This happens because the domainRegex in docker/distribution/regexp.go doesn't allow for the wrapping []'s. I'm filing the bug here though as the desired end state is that ipv6 addresses will work and chances are fixing the regexp will just run into the next problem with using ipv6 addresses.

Though maybe we get lucky and it just works after updating the regex.

Output of docker version:

root@clarkb-docker-debug:~# docker version
Client:
 Version:           18.09.4
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        d14af54266
 Built:             Wed Mar 27 18:35:44 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.4
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.8
  Git commit:       d14af54
  Built:            Wed Mar 27 18:01:48 2019
  OS/Arch:          linux/amd64
  Experimental:     false

Output of docker info:

root@clarkb-docker-debug:~# docker info
Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 0
Server Version: 18.09.4
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: bb71b10fd8f58240ca47fbb579b9d1028eea7c84
runc version: 2b18fe1d885ee5083ef9f0838fee39b62d653e30
init version: fec3683
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.15.0-47-generic
Operating System: Ubuntu 18.04.2 LTS
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 7.789GiB
Name: clarkb-docker-debug
ID: BQHT:G3FO:IKPY:7X6W:JAAK:VDK4:CD65:YOOM:LF7W:PA57:ECUB:22P6
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):

This was running on an Ubuntu 18.04 VM host with docker installed from the docker ubuntu deb repo.

cboylan added a commit to cboylan/distribution that referenced this issue Apr 10, 2019
Update the reference.regexp.DomainRegexp to allow for IPv6 address
literals with []s escapes. These are necessary to specity a port without
ambiguity.

This is related to fixing moby/moby#39033

Signed-off-by: Clark Boylan <clark.boylan@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Sep 16, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL syntax applied in some places.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

check if proper context applied everywhere

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Sep 20, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL syntax applied in some places.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

check if proper context applied everywhere

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 1, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL syntax applied in some places.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

check if proper context applied everywhere

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 2, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL syntax applied in some places.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

check if proper context applied everywhere

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 2, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL syntax applied in some places.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

check if proper context applied everywhere

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 3, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL address syntax exception ([...]) applied.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 3, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL address syntax exception ([...]) applied.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 4, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL address syntax exception ([...]) applied.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 4, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL address syntax exception ([...]) applied.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Removed neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 4, 2019
Introduce kolla_address filter for "DRY and expand".

Add AF config to vars.

Apply the following subs:
hostvars\[inventory_hostname\]\['ansible_' *[+~] *([^\]]+)_interface\]\['ipv4'\]\['address'\]
'$1' | kolla_address
hostvars\[([^\]]+)\]\['ansible_' *[+~] *hostvars\[[^\]]+\]\['([^\]]+)_interface'\]\]\['ipv4'\]\['address'\]
'$2' | kolla_address($1)

memcache address syntax exception (inet6[...]) applied.
URL address syntax exception ([...]) applied.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Removed neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ will fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred and will fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
BaptisteGerondeau pushed a commit to BaptisteGerondeau/kolla-ansible that referenced this issue Oct 7, 2019
Introduce kolla_address filter.
Introduce put_address_in_context filter.

Add AF config to vars.

Address contexts:
- raw (default): <ADDR>
- memcache: inet6[<ADDR>]
- url: [<ADDR>]

Replace IPv4 addresses and FQDNs usages in all places.

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic source CI jobs for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Remove neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working (also IPv4-only)

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address

haproxy upgrade checks for slaves based on ipv4 secondaries only

ml2 for xenapi

rp_filter setting
(? would require meddling with ip6tables, by default nothing is dropped)

IPv6 internal VIP address used via FQDN in URLs needs some escaping
workaround: use real FQDN

ironic dnsmasq is configured IPv4-only

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname

RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4.
IPv4 is preferred by default and may fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
openstack-gerrit pushed a commit to openstack/kolla-ansible that referenced this issue Oct 16, 2019
Introduce kolla_address filter.
Introduce put_address_in_context filter.

Add AF config to vars.

Address contexts:
- raw (default): <ADDR>
- memcache: inet6:[<ADDR>]
- url: [<ADDR>]

Other changes:

globals.yml - mention just IP in comment

prechecks/port_checks (api_intf) - kolla_address handles validation

3x interface conditional (swift configs: replication/storage)

2x interface variable definition with hostname
(haproxy listens; api intf)

1x interface variable definition with hostname with bifrost exclusion
(baremetal pre-install /etc/hosts; api intf)

neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network

basic multinode source CI job for IPv6

prechecks for rabbitmq and qdrouterd use proper NSS database now

MariaDB Galera Cluster WSREP SST mariabackup workaround
(socat and IPv6)

Ceph naming workaround in CI
TODO: probably needs documenting

RabbitMQ IPv6-only proto_dist

Ceph ms switch to IPv6 mode

Remove neutron-server ml2_type_vxlan/vxlan_group setting
as it is not used (let's avoid any confusion)
and could break setups without proper multicast routing
if it started working (also IPv4-only)

haproxy upgrade checks for slaves based on ipv6 addresses

TODO:

ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
not supported, invalid by default because neutron_external has no address
No idea whether ovs-dpdk works at all atm.

ml2 for xenapi
Xen is not supported too well.
This would require working with XenAPI facts.

rp_filter setting
This would require meddling with ip6tables (there is no sysctl param).
By default nothing is dropped.
Unlikely we really need it.

ironic dnsmasq is configured IPv4-only
dnsmasq needs DHCPv6 options and testing in vivo.

KNOWN ISSUES (beyond us):

One cannot use IPv6 address to reference the image for docker like we
currently do, see: moby/moby#39033
(docker_registry; docker API 400 - invalid reference format)
workaround: use hostname/FQDN

RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4.
This is due to old RabbitMQ versions available in images.
IPv4 is preferred by default and may fail in the IPv6-only scenario.
This should be no problem in real life as IPv6-only is indeed IPv6-only.
Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will
no longer be relevant as we supply all the necessary config.
See: rabbitmq/rabbitmq-server#1982

For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed
to work well). Older Ansible versions are known to miss IPv6 addresses
in interface facts. This may affect redeploys, reconfigures and
upgrades which run after VIP address is assigned.
See: ansible/ansible#63227

Bifrost Train does not support IPv6 deployments.
See: https://storyboard.openstack.org/#!/story/2006689

Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
Implements: blueprint ipv6-control-plane
Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
openstack-gerrit pushed a commit to openstack/openstack that referenced this issue Oct 16, 2019
* Update kolla-ansible from branch 'master'
  - Merge "Implement IPv6 support in the control plane"
  - Implement IPv6 support in the control plane
    
    Introduce kolla_address filter.
    Introduce put_address_in_context filter.
    
    Add AF config to vars.
    
    Address contexts:
    - raw (default): <ADDR>
    - memcache: inet6:[<ADDR>]
    - url: [<ADDR>]
    
    Other changes:
    
    globals.yml - mention just IP in comment
    
    prechecks/port_checks (api_intf) - kolla_address handles validation
    
    3x interface conditional (swift configs: replication/storage)
    
    2x interface variable definition with hostname
    (haproxy listens; api intf)
    
    1x interface variable definition with hostname with bifrost exclusion
    (baremetal pre-install /etc/hosts; api intf)
    
    neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network
    
    basic multinode source CI job for IPv6
    
    prechecks for rabbitmq and qdrouterd use proper NSS database now
    
    MariaDB Galera Cluster WSREP SST mariabackup workaround
    (socat and IPv6)
    
    Ceph naming workaround in CI
    TODO: probably needs documenting
    
    RabbitMQ IPv6-only proto_dist
    
    Ceph ms switch to IPv6 mode
    
    Remove neutron-server ml2_type_vxlan/vxlan_group setting
    as it is not used (let's avoid any confusion)
    and could break setups without proper multicast routing
    if it started working (also IPv4-only)
    
    haproxy upgrade checks for slaves based on ipv6 addresses
    
    TODO:
    
    ovs-dpdk grabs ipv4 network address (w/ prefix len / submask)
    not supported, invalid by default because neutron_external has no address
    No idea whether ovs-dpdk works at all atm.
    
    ml2 for xenapi
    Xen is not supported too well.
    This would require working with XenAPI facts.
    
    rp_filter setting
    This would require meddling with ip6tables (there is no sysctl param).
    By default nothing is dropped.
    Unlikely we really need it.
    
    ironic dnsmasq is configured IPv4-only
    dnsmasq needs DHCPv6 options and testing in vivo.
    
    KNOWN ISSUES (beyond us):
    
    One cannot use IPv6 address to reference the image for docker like we
    currently do, see: moby/moby#39033
    (docker_registry; docker API 400 - invalid reference format)
    workaround: use hostname/FQDN
    
    RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4.
    This is due to old RabbitMQ versions available in images.
    IPv4 is preferred by default and may fail in the IPv6-only scenario.
    This should be no problem in real life as IPv6-only is indeed IPv6-only.
    Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will
    no longer be relevant as we supply all the necessary config.
    See: rabbitmq/rabbitmq-server#1982
    
    For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed
    to work well). Older Ansible versions are known to miss IPv6 addresses
    in interface facts. This may affect redeploys, reconfigures and
    upgrades which run after VIP address is assigned.
    See: ansible/ansible#63227
    
    Bifrost Train does not support IPv6 deployments.
    See: https://storyboard.openstack.org/#!/story/2006689
    
    Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c
    Implements: blueprint ipv6-control-plane
    Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
@rnalrd
Copy link
rnalrd commented Nov 22, 2022

bump. Any hope to get this fixed?

@jlkiri
Copy link
jlkiri commented Mar 22, 2023

Bump. Would DNS work?

@thaJeztah
Copy link
Member

DNS should work. The problem here is in code from https://github.com/distribution/distribution, which parses the reference, and which is used as a build-time dependency .

A fix for that was merged in distribution/distribution#3489, but has not been released yet.

@artificial-intelligence

I think this would work now, I couldn't quite test this end to end just yet, because I used quay.io as a guinea pig and the TLS verification fails in the end (of course):

sven@notfound:~$ docker run busybox echo "fun" > newfile
sven@notfound:~$ docker ps -l
CONTAINER ID   IMAGE     COMMAND      CREATED         STATUS                     PORTS     NAMES
748775aaf91d   busybox   "echo fun"   7 seconds ago   Exited (0) 6 seconds ago             nervous_mclaren
sven@notfound:~$ docker commit 748775aaf91d [2600:1f18:483:cf01:c551:37d5:6cfd:c1c7]/svensaccount/test
sha256:81b17118005acb08a8780c471d2d6c8089d607ca6a826f6ec07670ac2c33b265
sven@notfound:~$ docker push [2600:1f18:483:cf01:c551:37d5:6cfd:c1c7]/svensaccount/test
Using default tag: latest
The push refers to repository [[2600:1f18:483:cf01:c551:37d5:6cfd:c1c7]/svensaccount/test]
Get "https://[2600:1f18:483:cf01:c551:37d5:6cfd:c1c7]/v2/": tls: failed to verify certificate: x509: cannot validate certificate for 2600:1f18:483:cf01:c551:37d5:6cfd:c1c7 because it doesn't contain any IP SANs

@thaJeztah
Copy link
Member

Yeah, I think this should work now; at least parsing the format should work;

echo 'FROM busybox' | docker build -t [::1]:5000/myimage:latest -

docker push [::1]:5000/myimage:latest
The push refers to repository [[::1]:5000/myimage]
49b3a50a2039: Pushed
latest: digest: sha256:79a1955078f1b946770a44e86c517505acf9b0169078839ae3eb04e91cc26220 size: 527

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

6 participants