Re: [IPv6] [v6ops] Smaller prefixes (/64-/96?) for draft-collink-v6ops-ent64pd

[Lorenzo Colitti <[e-mail]>]

On Sat, Apr 1, 2023 at 9:36 PM Fernando Gont <[e-mail]> wrote:

> > I would argue that at least part of the reason why kubernetes doesn't
> > use global IPv6 address is that it can't, because there is no easy way
> > to do that.
>
> Would you mind elaborating on this?
>
> My understanding of the situation is that Kubernetes use ULAs + NATs
> because that was the most straightforward thing to do: mimic IPv4.
>

Maybe. I guess my point is that even if they wanted to do global IPv6
addressing, they would have hit this limitation.

> The companion v6ops draft points out that on some enterprise networks,
> > using more than six addresses simply doesn't work at all. That means
> > that you can only use only three containers :-)
>
> Because of "first hop security" (limit on addresses/mac) or what?
>

The example I was thinking of is the one in draft-linkova-v6ops-ipmaclimi
<https://datatracker.ietf.org/doc/draft-linkova-v6ops-ipmaclimi/>. That one
is interesting because the limitation isn't even intended for security
purposes.



> > This proposal makes it possible to support an unlimited number of
> > containers without any scaling costs on the network. If it were widely
> > deployed, container setups might well switch to using global IPv6
> > addresses for every container. In addition to providing end-to-end
> > connectivity, it's much easier to implement and configure than NAT66+ULA
> > - just bridge the containers together on a virtual ethernet and use
> SLAAC.
>
> With Kubernetes you normally use a load balancer. So you typically don't
> want the containers to be visible to the external world.
>

"Visible" is not a boolean. Just because a container has a global IPv6
address doesn't mean that anyone on the Internet can reach it on any port.
But it could, for example, be visible by its global address on SSH for
connections from the corporate network. It could have a global address to
reach the Internet and download software updates. And so on.