tasks have no access to ipv6 services #5919
Replies: 4 comments 4 replies
-
|
This is also an issue if you're running on AWS in private subnets and utilizing the IPv6 Egress only gateways. |
Beta Was this translation helpful? Give feedback.
-
|
For now, I'm running an http proxy on the same docker network as the worker, and pointing the worker at it via the That seems to help, at least for http stuff. ssh is still an issue. (I also tried a socks5 proxy. That got |
Beta Was this translation helpful? Give feedback.
-
For ssh, the git resource can use the same proxy trick to access ipv6-only name: thing-git
type: git
source:
uri: ssh://git@git.server/user/thing
branch: master
private_key: ((git-ssh-key))
https_tunnel:
proxy_host: proxy.hostname
proxy_port: 12345Despite being named "https_tunnel", the worker connects to the proxy via http, and uses that to connect to ssh on the git server. |
Beta Was this translation helpful? Give feedback.
-
|
I am having similar issues, but with the registry-image resource, which does not appear to support https_tunnel or proxies. |
Beta Was this translation helpful? Give feedback.
-
|
Hey, any progress on this? It has been six months since this conversation was requested by a Concourse dev, with no commentary from a Concourse dev. Bosh stemcells have supported IPv6 for at least a year (and probably much longer), so I'm wondering what else needs to be done here. There's a legit business reason for fixing this. We (the Bosh Ecosystem team) are seeing
when running Docker 20.10.6 in a Concourse job. (20.10.5 works just fine) If anyone inside VMW would like to do a closer inspection of the situation, the failing build is here: https://main.bosh-ci.cf-app.com/teams/bosh-director/pipelines/bosh-deployment/jobs/test-main-bosh-docker/builds/286 |
Beta Was this translation helpful? Give feedback.
-
|
Hey, we haven't put any thought into this so it's not on the roadmap currently. @scottietremendous I'm not a networking expert, but I imagine this is probably easier for us to do now with containerd and the CNI. |
Beta Was this translation helpful? Give feedback.
-
|
I just stumbled across this in my home setup using The Concourse CNI configuration: There might be some extra work required to make the host<>container firewall rules IPv6-proof, but it should not be hard to add. |
Beta Was this translation helpful? Give feedback.
-
|
TBH, you don't even need to assign ULAs to anything to resolve the problem that I ran into... you can just enable IPv6 |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I run several ipv6-only services, and I'd like concourse pipelines to interact with them. However, when concourse runs tasks, the tasks have no ipv6 connectivity.
I run a worker in docker, using the
concourse/concoursedocker image. This worker has a proper ipv6 setup, with address and gateway. However, therunccontainers spawned by this worker only have link-local addresses, and no route. The task can resolve the hostname, but the connection fails with a "No route to host" error.I'd like to write concourse pipelines that interact with ipv6-only services. Is this possible?
(from issue #1889)
Beta Was this translation helpful? Give feedback.
All reactions