atunnel: bind actor ingress/egress listeners dual-stack (:port) - #977
Closed
SURAJ KUMAR (krsnaSuraj) wants to merge 2 commits into
Closed
atunnel: bind actor ingress/egress listeners dual-stack (:port)#977SURAJ KUMAR (krsnaSuraj) wants to merge 2 commits into
SURAJ KUMAR (krsnaSuraj) wants to merge 2 commits into
Conversation
…n/metric attrs Two bugs broke the trace chain through the router, creating two separate traces instead of one connected trace for each ResumeActor request. 1. Singleflight detaches trace context (primary): resumer.go used context.Background() inside singleflight.DoChan(). Fixed by propagating the caller's span context into the background context via trace.ContextWithSpanContext. 2. No traceparent injected into upstream request (secondary): extproc.go only rewrote the :authority header. Fixed by calling injectTraceContext(ctx, mutation) which uses otel.GetTextMapPropagator() to write traceparent/tracestate with OVERWRITE_IF_EXISTS_OR_ADD AppendAction. 3. Non-namespaced attribute keys: Renamed span and metric attributes to ate.* convention (agent-substrate#412 style). Replaced custom target_addr attribute with stable OTel semconv server.address + server.port.
Default atunnel-listen-address to :443 and atunnel-egress-listen-address to :15001 in both ateom binaries so listeners accept IPv6 + IPv4 on dual-stack clusters and exist on IPv6-only clusters. 0.0.0.0 bound only an IPv4 wildcard, breaking IPv6-only pod networks and dropping the IPv6 leg on dual-stack. Update atecontroller workerpool apply path that passed the old values as explicit flag overrides, plus its expected-args test. Fixes: agent-substrate#943
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
atunnel: bind actor ingress/egress listeners dual-stack (
:port) instead of0.0.0.0Fixes: #943
Problem
The atunnel actor ingress (
atunnel-listen-address) and egress(
atunnel-egress-listen-address) listeners defaulted to0.0.0.0:443/0.0.0.0:15001in bothcmd/ateom-gvisor/main.goandcmd/ateom-microvm/main.go.Binding a specific IPv4 wildcard (
0.0.0.0) has two consequences on modernclusters:
ingress listener only exists on the IPv4 loopback/any address, so the router
cannot reach the actor on an IPv6-only pod network.
IPv6 connections, so dual-stack actors lose the IPv6 path.
Since #559 removed the pod-IP:80 DNAT, the mTLS listener is the only actor
ingress path, so this is the sole ingress surface for actors.
Fix
Use Go's dual-stack wildcard form (
:port) as the default for both listenerflags in both ateom binaries.
net.Listen("tcp", ":443")creates a dual-stacksocket that accepts both IPv6 and IPv4 connections on hosts with IPv6 support,
and falls back to IPv4-only on IPv4-only hosts — the correct default for a
pod-network listener.
Also updated the atecontroller worker-pool deployment apply path, which was
passing the old
0.0.0.0:...values as explicit flag overrides (which wouldhave silently reverted the new default at runtime):
cmd/atecontroller/internal/controllers/workerpool_apply.gocmd/atecontroller/internal/controllers/workerpool_apply_test.goFiles changed
cmd/ateom-gvisor/main.go—:443/:15001defaultscmd/ateom-microvm/main.go—:443/:15001defaultscmd/atecontroller/internal/controllers/workerpool_apply.go— explicit args updatedcmd/atecontroller/internal/controllers/workerpool_apply_test.go— expected args updatedBehavior / compatibility
--atunnel-listen-address=127.0.0.1:8443and it is honored unchanged.SO_ORIGINAL_DSTlookup path (atunnel: IPv6 support for original destination lookup #686) — that is thedestination-address resolution, not the listen address.
--grpc-listen-addr(that flag is unrelated).Verification
gofmt -lclean on all changed files.go vetclean on the affected packages.go test ./internal/atunnel/...passes.0.0.0.0:443/0.0.0.0:15001references in Go sources.