One of the new features Calico v3.11 introduced is full Kubernetes dual stack support – which allows each Kubernetes pod to get an IPv6 address as well as an IPv4 address, and can communicate over both IPv6 and IPv4. This blog explains more about how that works, and how you can make use of it.
Calico has actually supported both IPv4 and IPv6 for a long time already. For example, dual stack operation with OpenStack, and IPv6-only operation with Kubernetes, were both possible before v3.11. What really changed in v3.11 was in the integration between Calico and Kubernetes, specifically with Kubernetes v1.16 allowing multiple IP addresses for each pod, and Calico handling that multiplicity correctly.
Prior to Kubernetes v1.16, the Kubernetes API only supported a single IP address per pod. Typically that would be an IPv4 address. It was also possible to set up an IPv6-only cluster, and in that case it would be an IPv6 address. But the point is that a pod could not have both IPv4 and IPv6. If you’re a guru of the Kubernetes API, you’ll realize that we’re talking here about the PodStatus.PodIP field.
During the development for Kubernetes versions 1.16 and 1.17, the Kubernetes team added the support needed for each pod to have both an IPv4 and an IPv6 address. The full detail of that work is available, but the crucial detail for us here is the introduction of a plural Kubernetes API field, PodStatus.PodIPs. PodStatus.PodIPs can hold multiple IP addresses – thus allowing for both IPv4 and IPv6. The legacy PodStatus.PodIP field is now required to always be the same as PodStatus.PodIPs.
Calico routes IPv6 traffic from pods over the nodes’ own IPv6 connectivity, so there must also be IPv6 connectivity between the cluster nodes. You can check this by provisioning a global-scope IPv6 address on each node, if there isn’t one already, and using ping6 from one node to the IPv6 address of another node. Similarly, for pods to be able to connect to the outside world over IPv6, there must be IPv6 connectivity from the cluster nodes to the outside world. As far as Calico is concerned, there is no complicated IPv6 over IPv4 magic going on; IPv6 should be native IPv6, just as IPv4 is native IPv4. (Of course, there might still be overlay magic somewhere in the underlying network fabric, but Calico and Kubernetes don’t see or get involved with it.)
So how can you enable dual stack operation when installing a new Kubernetes cluster with Calico? With a high-level installer, it should be as simple as toggling a single knob somewhere, but the installers haven’t had a lot of time yet to provide that, so in the meantime and for the sake of understanding, we have to do it The Hard Way ™…
If you followed the steps above successfully then you should see that each new pod gets an IPv6 address as well as IPv4, and can communicate with each other and the outside world over IPv6.
Then you can go and join in the debate about IPv6 extension headers 🙂 Thank you for reading and Happy IPv6ing!
If you enjoyed this blog then you may also like:
Get updates on blog posts, new releases and more!