Skip to content

Set proper IP family policy on NGINX LB Service (#3475) #3476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 6, 2025
Merged

Set proper IP family policy on NGINX LB Service (#3475) #3476

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e9f50e
Set proper IP family policy on NGINX LB Service (#3475)
sjberman Jun 6, 2025
74d9027
Merge branch 'release-2.0' into cherry-pick/ipv6-fix
sjberman Jun 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions internal/controller/provisioner/objects.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -463,9 +463,12 @@ func buildNginxService(
Ports: servicePorts,
ExternalTrafficPolicy: servicePolicy,
Selector: selectorLabels,
IPFamilyPolicy: helpers.GetPointer(corev1.IPFamilyPolicyPreferDualStack),
},
}

setIPFamily(nProxyCfg, svc)

if serviceCfg.LoadBalancerIP != nil {
svc.Spec.LoadBalancerIP = *serviceCfg.LoadBalancerIP
}
Expand All @@ -479,6 +482,17 @@ func buildNginxService(
return svc
}

func setIPFamily(nProxyCfg *graph.EffectiveNginxProxy, svc *corev1.Service) {
if nProxyCfg != nil && nProxyCfg.IPFamily != nil && *nProxyCfg.IPFamily != ngfAPIv1alpha2.Dual {
svc.Spec.IPFamilyPolicy = helpers.GetPointer(corev1.IPFamilyPolicySingleStack)
if *nProxyCfg.IPFamily == ngfAPIv1alpha2.IPv4 {
svc.Spec.IPFamilies = []corev1.IPFamily{corev1.IPv4Protocol}
} else {
svc.Spec.IPFamilies = []corev1.IPFamily{corev1.IPv6Protocol}
}
}
}

func (p *NginxProvisioner) buildNginxDeployment(
objectMeta metav1.ObjectMeta,
nProxyCfg *graph.EffectiveNginxProxy,
Expand Down
41 changes: 41 additions & 0 deletions internal/controller/provisioner/objects_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ func TestBuildNginxResourceObjects(t *testing.T) {
validateMeta(svc)
g.Expect(svc.Spec.Type).To(Equal(defaultServiceType))
g.Expect(svc.Spec.ExternalTrafficPolicy).To(Equal(defaultServicePolicy))
g.Expect(*svc.Spec.IPFamilyPolicy).To(Equal(corev1.IPFamilyPolicyPreferDualStack))

// service ports is sorted in ascending order by port number when we make the nginx object
g.Expect(svc.Spec.Ports).To(Equal([]corev1.ServicePort{
Expand Down Expand Up @@ -260,6 +261,7 @@ func TestBuildNginxResourceObjects_NginxProxyConfig(t *testing.T) {

resourceName := "gw-nginx"
nProxyCfg := &graph.EffectiveNginxProxy{
IPFamily: helpers.GetPointer(ngfAPIv1alpha2.IPv4),
Logging: &ngfAPIv1alpha2.NginxLogging{
ErrorLevel: helpers.GetPointer(ngfAPIv1alpha2.NginxLogLevelDebug),
AgentLevel: helpers.GetPointer(ngfAPIv1alpha2.AgentLogLevelDebug),
Expand Down Expand Up @@ -321,6 +323,8 @@ func TestBuildNginxResourceObjects_NginxProxyConfig(t *testing.T) {
g.Expect(svc.Spec.LoadBalancerIP).To(Equal("1.2.3.4"))
g.Expect(*svc.Spec.LoadBalancerClass).To(Equal("myLoadBalancerClass"))
g.Expect(svc.Spec.LoadBalancerSourceRanges).To(Equal([]string{"5.6.7.8"}))
g.Expect(*svc.Spec.IPFamilyPolicy).To(Equal(corev1.IPFamilyPolicySingleStack))
g.Expect(svc.Spec.IPFamilies).To(Equal([]corev1.IPFamily{corev1.IPv4Protocol}))

depObj := objects[5]
dep, ok := depObj.(*appsv1.Deployment)
Expand Down Expand Up @@ -961,3 +965,40 @@ func TestBuildNginxResourceObjectsForDeletion_OpenShift(t *testing.T) {
g.Expect(ok).To(BeTrue())
validateMeta(roleBinding, deploymentNSName.Name)
}

func TestSetIPFamily(t *testing.T) {
t.Parallel()
g := NewWithT(t)

newSvc := func() *corev1.Service {
return &corev1.Service{
Spec: corev1.ServiceSpec{},
}
}

// nProxyCfg is nil, should not set anything
svc := newSvc()
setIPFamily(nil, svc)
g.Expect(svc.Spec.IPFamilyPolicy).To(BeNil())
g.Expect(svc.Spec.IPFamilies).To(BeNil())

// nProxyCfg.IPFamily is nil, should not set anything
svc = newSvc()
setIPFamily(&graph.EffectiveNginxProxy{}, svc)
g.Expect(svc.Spec.IPFamilyPolicy).To(BeNil())
g.Expect(svc.Spec.IPFamilies).To(BeNil())

// nProxyCfg.IPFamily is IPv4, should set SingleStack and IPFamilies to IPv4
svc = newSvc()
ipFamily := ngfAPIv1alpha2.IPv4
setIPFamily(&graph.EffectiveNginxProxy{IPFamily: &ipFamily}, svc)
g.Expect(svc.Spec.IPFamilyPolicy).To(Equal(helpers.GetPointer(corev1.IPFamilyPolicySingleStack)))
g.Expect(svc.Spec.IPFamilies).To(Equal([]corev1.IPFamily{corev1.IPv4Protocol}))

// nProxyCfg.IPFamily is IPv6, should set SingleStack and IPFamilies to IPv6
svc = newSvc()
ipFamily = ngfAPIv1alpha2.IPv6
setIPFamily(&graph.EffectiveNginxProxy{IPFamily: &ipFamily}, svc)
g.Expect(svc.Spec.IPFamilyPolicy).To(Equal(helpers.GetPointer(corev1.IPFamilyPolicySingleStack)))
g.Expect(svc.Spec.IPFamilies).To(Equal([]corev1.IPFamily{corev1.IPv6Protocol}))
}