[Bug] Data plane is hard IPv4

[tz-torchai]

Expected Behavior

IPv6 only cluster support

Actual Behavior

Envoy DNS resolver pinned V4_ONLY (atenet/.../xds.go:241), 0.0.0.0 binds, and the actor interior net is hard-coded 169.254.17.x/30 forced through .To4() which rejects non-IPv4.

[EItanya]

I agree that ipv6 only support is super important, but I also think we have so many open networking questions we're looking to answer that maybe this should be a fast follow from those.
Some examples:

• Add transparent actor egress policy and credential injection #126
• Should ateom share network access with the actor sandbox? #240

[bowei]

I think that would be good to have as a first step is a way to start the Kind setup with IPv6 single-stack and IPv6 dual stack. Otherwise, if we get patches to fix IPv6 support, we would not be able to test the fixes.

[BenTheElder]

I think that would be good to have as a first step is a way to start the Kind setup with IPv6 single-stack and IPv6 dual stack. Otherwise, if we get patches to fix IPv6 support, we would not be able to test the fixes.

We have to be careful about how much actions time we use up on every PR as long as we're operating with the free default resources. It can add up every quickly covering every dimension.

Also FYI single-stack ipv6 kind has some gaps currently, in general we mostly see ipv4 or dual-stack demand and contributions ...

We're not even running ipv6 kind on every k8s PR currently. We run it periodically post-merge.

[bowei]

I'd be ok with starting with dual-stack for local testing but not in the CI.

[bowei]

Ok, some concrete steps towards chipping away at this:

• PR to add starting up Kind in dual-stack mode, installing Substrate on the cluster
• Fixing the Envoy bind to include IPv6 addresses
• Test (probably draft PR) to show what else is broken right now.

[tz-torchai]

Hello folks, Bowei Du (@bowei), Benjamin Elder (@BenTheElder), Eitan Yarmush (@EItanya),

Following up after PR #559 merged: the pod-IP:80 → actor-veth:80 DNAT is gone with no fallback, so atunnel's mTLS listener is now the only actor ingress path. The listen address itself is flag-configurable, but the egress redirect in internal/atunnel/original_dst_linux.go is SO_ORIGINAL_DST-only (IPv6 variant still a TODO), and internal/ateomnet's interior actor network is still hard IPv4 after the #548 refactor moved it into a shared package.

I was previously able to fork-patch around this to run Substrate on an IPv6-only cluster; with atunnel now mandatory and no fallback, that's no longer straightforward. Could we raise the priority on IPv6/dual-stack support, and what's actually blocking it at this point? Please let me know I could help here.

Thanks!

[bowei]

See my comment: first step is to enable creating an ipv6 enabled kind cluster so so ipv6 support can be tested.