atenet Envoy sockets and Services lack IPv6 support (hardcoded to 0.0.0.0) #910
Description
Overview
Currently, all Envoy listener and admin sockets in atenet are hardcoded to bind to the IPv4 wildcard (0.0.0.0), and the gateway Kubernetes Services lack explicit dual-stack configuration. This prevents atenet from functioning correctly on IPv6-only or Dual-Stack clusters.
Hardcoded Bindings
The following components are currently restricted to IPv4:
| Socket | Location | Current Binding |
|---|---|---|
Router Ingress (:8080 / :8443) |
router/xds.go (buildListener, buildHttpsListener) |
0.0.0.0 |
Router Envoy Admin (:9901) |
manifests/ate-install/atenet-router.yaml |
0.0.0.0 |
Egress Envoy Admin (:15000) |
manifests/ate-install/atenet-egress.yaml |
0.0.0.0 |
Egress CONNECT Listener (:443) |
manifests/ate-install/atenet-egress.yaml |
0.0.0.0 |
Gateway Services (atenet-router/-egress) |
Both manifests | SingleStack (Default) |
Impact / Failure Modes
1. IPv6-Only Clusters (CrashLoopBackOff)
On an IPv6-only cluster, the pods never start successfully. The kubelet attempts to probe the pod using its assigned IPv6 address, but Envoy is only listening on 0.0.0.0. This results in connection refusal and causes the pods (like atenet-egress) to crashloop.
Example Error:
Startup probe failed: Get "http://[fd00:10:244::18]:15000/ready": connect: connection refused
2. Dual-Stack Clusters (Dark Data Path)
On a dual-stack cluster, the pods may report as healthy, but half of the data path is dark. The router only answers on its Service's IPv4 ClusterIP and ignores IPv6 traffic entirely. Furthermore, because the Kubernetes Services do not define an ipFamilyPolicy, they only hand out a single IPv4 address, keeping the IPv6 path unreachable.
Not in Scope (Related Outbound IPv4 Restrictions)
The following are distinct IPv4 limitations that leave gateways IPv4-only for outbound resolution and are not covered by this bug:
dns_lookup_family: V4_ONLYon the egress dynamic forward proxy.- The OTLP collector cluster defaults to Envoy's V4-only mode.
cmd/atenet/internal/dns/corefile.goemitstemplate IN Aonly (no AAAA path).atunneloriginal-destination lookup lacks IPv6 support.
Activity
[-]atenet: every Envoy socket binds 0.0.0.0 and neither gateway Service is dual-stack[/-][+]atenet Envoy sockets and Services lack IPv6 support (hardcoded to 0.0.0.0)[/+]