nginx: also listen on ipv6

[euank]

This allows a brave user to run this in host networking mode and support
ipv6.

• - Manual testing

I've been running a very similar patch against the contrib version with no trouble for a while.

[bprashanth]

Don't see why not, defer to Manuel. Do we really need all 4 listen directives?

[coveralls]

Coverage remained the same at 40.231% when pulling 73a4ec4e5b6332e19a8e3b18e5afe5c2b3654c50 on euank:nginx-ipv6ish into d1fb96a on kubernetes:master.

[aledbf]

@euank what happens if the ipv6 is not enabled?

can you test what happens if only listen [::]:80 and listen [::]:443 exists?
(no listen 80 and listen 443 sections because is not clear from the nginx docs)

[euank]

@aledbf I don't have a kernel without CONFIG_IPV6 handy, but even if ipv6 is turned off via --ipv6=false on dockerd + the net.ipv6...disable_ipv6 sysctls, docker containers still get a linklocal ipv6 address to listen on and everything should work fine. (edit, forgot I'm running this in --net=host where the previous don't apply, I'll experiment)

When I had only listen [::]:80, I expected it to listen on both based on my reading of the docs, but experimentally it didn't, only listening on ipv6

[bprashanth]

I think Manuel was asking to verify that this isn't required https://codinginthetrenches.com/2013/12/14/nginx-ipv6only-setting-gotcha/

[k8s-oncall]

This change is 

[euank]

With both (as it is now), I don't think I need that setting. I'll see if ipv6only=off lets me get away with only one listen though. Thanks for the pointer!

I'll do some testing today or tomorrow and report back

[aledbf]

@euank if using ipv6only=off works please add that flag here

[aledbf]

@euank any update on this?

[euank]

Thanks for the ping, I just now got back to this. I ended up hitting a couple unrelated snags with my test cluster which slowed this down.

There were a couple things that made it more complicated, namely that you can only have one ipv6only per port (and there are many listen 80 directives, so there had to be something extra for that).

I've manually tested that the current commit (image euank/nginx-ingress-controller:8fe1efe) works on my test cluster of CoreOS machines using my hostNetwork ingress daemonset.

When using that, doing a curl of its ipv4 or ipv6 address returns the default backend, and adding -H "Host: $service" for my services works as expected for both ips as well.

One thing to note, however, is that logs produced by nginx change slightly.

A line that before might read 1.2.3.4 service [1.2.3.4 443 - [12/Dec/2016:18:04:59 +0000] "GET / .... now reads as ::ffff:1.2.3.4 - [::ffff:1.2.3.4] - - [12/Dec/2016:18:04:59 +0000] "GET / ...

I mention that only because if you know of people doing log ingestion/parsing, this could impact them.

[coveralls]

Coverage remained the same at 39.753% when pulling 8fe1efe on euank:nginx-ipv6ish into 6262aa8 on kubernetes:master.

[aledbf]

/lgtm