Benjamin Knofe

If your host has an IPv6 address (check with ip a ) and your microk8s runs in dual-stack mode, then you can do a

and after your calico-node is restarted, it should work. For testing if it works, you can run:

which will ping Cloudflare’s 1.1.1.1 DNS service with its official IPv6 address.


The adoption of IPv6 throughout the internet goes slow, but it makes progress. One significant change was when AWS started charging for in-use IPv4 addresses this February. 

For several years now the death knell has rung on IPv4 addresses and the predicted force move to IPv6’s larger addressable space. Market forces have provided a more gentle transition, with increased prices for IPv4 addresses and the implementation of dual stack solutions that allow support for both address types. The change of pricing at AWS was discussed at length on Hacker News last year.

Moving to IPv6 has other developer experience advantages, especially when running on AWS and using their VPC offering: Every time you create a new VPC, you will just get your own block of IPv6 addresses and that’s it, you can use it as you want from now on, no EIP allocation, NAT’ing or anything complicated, just assign IPs from that space and get going. It’s awesome!

More generally, the vast address space of IPv6 eliminates the need for network address translation (NAT), allowing every device to have a unique global address, which simplifies network design and improves end-to-end connectivity. Auto-configuration capabilities streamline network setup, reducing the reliance on DHCP for address assignment. Without private address collisions, networks can interoperate without the complex workarounds required in IPv4. IPv6 enhances multicast routing efficiency, supporting more robust and scalable distribution of data. Its simplified header format and improved routing mechanisms enable more efficient packet processing. IPv6 introduces true QoS through flow labeling, allowing for better traffic prioritization. Security is fundamentally integrated, with support for authentication and privacy directly in the protocol. The architecture of IPv6 is designed to be extensible, accommodating future needs with flexible options and extensions.

No operations discussion would be complete without considering how end-to-end testing and synthetic monitoring will be affected. Of course, Checkly also supports IPv6!

a dual-stack (or IPv6 only) microk8s cluster

When on AWS, to assign an EC2 instance automatically an IPv6 address, make sure to create a subnet with a IPv6 CIDR range. Terraform example would be something like this:

Then spin up an instance in that subnet, connect to it and run ip a. It should look something like this:

To set up a dual-stack microk8s cluster, these exact steps will get us working for our demonstration.

Before installing microk8s, create a file at /var/snap/microk8s/common/.microk8s.yaml with the following contents:

This is called the microk8s launch configuration[4]. It includes all the default settings plus everything necessary for IPv6.

Then install microk8s with snap install microk8s --classic

First check if pods get an IPv4 and an IPv6 address assigned, for example by running

It should show something like this for each pod there:

I am not sure why but microk8s’ calico does not automatically allow NAT’ing outside of the cluster, to enable it, just run a

And should be able to see pinging work with something like that (after some installation output from apt):

Success! Look at that gorgeous 128-bit IPv6 address.


If you'd like to share your own experience with IPv6 or the other trials and tribulations of modern operations, join the Checkly Slack to meet the team!

IPv6 masquerading for egress on microk8s on EC2

Detect

Communicate

Resolve

Monitoring as Code

Developers

Resources

Community

IPv6 masquerading for egress on microk8s on EC2