Repository navigation
fix(platform): stop advertising IPv6 until the server can serve it - #2641
Merged
Merged
Conversation
…2638) Nothing answers on 2a02:c207:2316:2642::1: Contabo does not route it yet, and the IPv4-only cluster could not serve it anyway (#2640). Senders that prefer IPv6 timed out before falling back, delaying mail. - The zone file and every IngressRoute's external-dns target publish IPv4 only. - The host no longer configures the address or its route. - mail.sh checks the addresses the server serves, IPv4 alone until SERVER_V6 is set again, and flags a published IPv6 address.
Contributor
Changes
No production or test lines added. CoverageNo coverage summary reached this report. Patch coverage: this pull request changes no line that coverage measures.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2638
Why
DNS publishes
2a02:c207:2316:2642::1formail.esa-blueshell.nl, the MX target derived from it, and as an origin for every proxied web host. Nothing answers on it:Senders that prefer IPv6 time out before falling back to IPv4, so mail arrives late. Doing IPv6 properly is #2640.
What changes
infra/dns/esa-blueshell.nl.zonehas no AAAA records, and every IngressRoute'sexternal-dns.alpha.kubernetes.io/targetis IPv4 only.platform/nix/hosts/frankfurt-contabo-1/default.nixno longer configures the address or its route.mail.sh: it checks that DNS gives exactly the addresses the server serves: IPv4 alone whileSERVER_V6is empty, and it flags a published IPv6 address. Reverse DNS checks the same list.infra/dns/README.mdandplatform/docs/bringup-v2.mdsay IPv6 waits on Platform: serve mail and the web over IPv6 #2640.Not done by this PR
upsert-only, so neither removes the existing AAAA records. Delete them in the Cloudflare dashboard: every AAAA record with content2a02:c207:2316:2642::1, and theaaaa-*ownership TXT external-dns made for them.sudo ip -6 route del default; sudo ip -6 addr del 2a02:c207:2316:2642::1/64 dev ens18.Verified
mail.shwithout the cluster, against today's DNS: it flags the MX target andmail.esa-blueshell.nlfor resolving to the IPv6 address, and passes reverse DNS for IPv4.