Creating an IPv4/IPv6 Dual-Stack Cluster in CCE

Overview

IPv6 addresses are used to handle IPv4 address exhaustion. If a worker node (such as an ECS) in the current cluster uses IPv4, the node can run in dual-stack mode after IPv6 is enabled. Specifically, the node has both IPv4 and IPv6 addresses, which can be used to access the intranet or the Internet.

Figure 1 A cluster with IPv4/IPv6 dual-stack enabled

Application Scenarios

• If your application serves IPv6 clients, use IPv6 EIPs or IPv4/IPv6 dual-stack.
• If your application needs to provide Services for users who use IPv6 clients and analyze the access request data, you can only use IPv4/IPv6 dual-stack.
• If internal communication is required between your application systems or between your application system and another system (such as the database system), you can use only IPv4/IPv6 dual-stack.

For details about the dual-stack, see IPv4/IPv6 Dual-Stack Network and IPv6 EIP Overview.

Notes and Constraints

• Clusters that support IPv4/IPv6 dual-stack are listed in the table below.

  Cluster Type	Cluster Network	Version	Remarks
  CCE standard cluster	Container tunnel network	v1.15 or later	IPv4/IPv6 dual-stack will be generally available for clusters of v1.23. ELB dual-stack is not supported.
  CCE Turbo cluster	Cloud Native network 2.0	v1.23.8-r0 or later v1.25.3-r0 or later	Currently, secure containers that use Kata do not support IPv4/IPv6 dual-stack. Only ECS-VM or ECS-PM (c6.22xlarge.4.physical or c7.32xlarge.4.physical) supports IPv4/IPv6 dual-stack.

• Worker nodes and master nodes in a Kubernetes cluster use IPv4 addresses to communicate with each other.
• When there is a DNAT Service in a cluster, only IPv4 addresses are supported.
• Only one IPv6 address can be bound to each network interface.
• When IPv4/IPv6 dual-stack is enabled for a cluster, DHCP unlimited lease cannot be enabled for the selected node subnet.
• If a dual-stack cluster is used, do not change the load balancer protocol version on the ELB console.
• ELB dual-stack can only be used in CCE Turbo clusters with the restrictions below.

  Application Scenario	Dedicated Load Balancer	Shared Load Balancer
  LoadBalancer ingress	Dual stack is supported. Layer 7 dedicated load balancers can only communicate with their backend servers using IPv4. For details, see Does ELB Support IPv6 Networks? If an ingress uses IPv4/IPv6 dual-stack, related alarms will be generated. Backends with IPv6 addresses cannot be added to the associated load balancer. You can view the related alarms by referring to the events of the corresponding ingress.	Only IPv4 is supported.
  Nginx ingress	Dual-stack is supported when the following conditions are met: In clusters from v1.19 to v1.23, NGINX Ingress Controller of 2.1.7 or later is used. In clusters of v1.25 or later, NGINX Ingress Controller of 2.2.5 or later is used.	Only IPv4 is supported.
  LoadBalancer Service	Layer 7 (HTTP/HTTPS): Dual-stack is supported. Layer 7 dedicated load balancers can only communicate with their backend servers using IPv4. For details, see Does ELB Support IPv6 Networks? If a Service uses IPv4/IPv6 dual-stack, related alarms will be generated. Backends with IPv6 addresses cannot be added to the associated load balancer. You can view the related alarms by referring to the events of the corresponding Service. To avoid alarms, you can select IPv4 when creating a Service and select a dedicated Layer 7 load balancer with dual-stack enabled. Layer 4 (TCP/UDP): Dual-stack is supported.	Only IPv4 is supported.

Step 1: Create a VPC with a Subnet

Before creating VPCs, determine how many VPCs, subnets, and what IP address ranges you will need. For details, see VPC Network Planning Suggestions.

• The basic operations for IPv4/IPv6 dual-stack are the same as those for IPv4. Only some parameters are different.
• For details about the IPv6 billing, supported ECS types, and supported regions, see IPv4/IPv6 Dual-Stack Network.

Perform the following operations to create a VPC named vpc-ipv6 and its default subnet subnet-ipv6.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region and a project.
3. Choose Networking > Virtual Private Cloud.
4. Click Create VPC.
5. Configure the VPC and the subnet following instructions. For details about the mandatory parameters, see Table 1 and Table 2. For details about other parameters, see Creating a VPC with a Subnet.

   When configuring a subnet, enable IPv6 CIDR Block. This can automatically allocate an IPv6 CIDR block to the subnet. This function cannot be disabled once enabled. Custom IPv6 CIDR blocks are not supported currently.

   Table 1 VPC parameters

   Parameter	Description	Example Value
   Region	The desired region. Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For low network latency and quick resource access, select the nearest region.	AP-Singapore
   Name	A VPC name.	vpc-ipv6
   IPv4 CIDR Block	The VPC CIDR block. The subnet CIDR blocks in the VPC must be within this CIDR block. The following CIDR blocks are supported: 10.0.0.0/8–24 172.16.0.0/12–24 192.168.0.0/16–24	192.168.0.0/16
   Enterprise Project	When creating a VPC, add the VPC to an enabled enterprise project. An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default. For details about how to create and manage enterprise projects, see Enterprise Management User Guide.	default

   Table 2 Subnet parameters

   Parameter	Description	Example Value
   Subnet Name	A subnet name.	subnet-ipv6
   AZ	A geographic location with independent power supply and network facilities in a region. AZs are physically isolated, and AZs in the same VPC are interconnected through an internal network.	AZ 2
   IPv4 CIDR Block	The IPv4 CIDR block for a subnet. This value must be within the VPC CIDR block.	192.168.0.0/24
   IPv6 CIDR Block	Enabling it will automatically assign an IPv6 CIDR block to a subnet. This function cannot be disabled once enabled. Custom IPv6 CIDR blocks are not supported currently.	N/A
   Associated Route Table	The default route table to which a subnet will be associated. You can change the route table to a custom route table.	Default
   Advanced Settings (IPv6)
   Gateway	The gateway address of a subnet. It is used to communicate with other subnets.	192.168.0.1
   DNS Server Address	By default, two DNS server addresses are configured. You can change them if necessary. When multiple IP addresses are available, separate them with commas (,).	100.125.x.x
   IPv4 DHCP Lease Time	The time during which a client can use an IP address automatically assigned by the DHCP server. After the lease time expires, a new IP address will be assigned to the client. If a DHCP lease time is changed, the new lease automatically takes effect when half of the current lease time has passed. To make the change take effect immediately, restart the ECS or log in to the ECS to cause the DHCP lease to automatically renew. CAUTION: When IPv4/IPv6 dual-stack is enabled for a cluster, DHCP unlimited lease cannot be enabled for the selected node subnet.	365 days or 300 hours

6. Click Create Now.

Step 2: Create a CCE Cluster

Step 3: Buy Shared Bandwidth and Add an IPv6 Address to the Shared Bandwidth

By default, an IPv6 address can only be used for private network communication. If you want to use this IPv6 address to access the Internet or be accessed by IPv6 clients on the Internet, buy a shared bandwidth and add the IPv6 address to it.

If you already have shared bandwidth, simply add the IPv6 address to the shared bandwidth.

Buying a Shared Bandwidth

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Choose Service List > Networking > Virtual Private Cloud.
4. In the navigation pane, choose Elastic IP and Bandwidth > Shared Bandwidths.
5. In the upper right corner, click Buy Shared Bandwidth. On the displayed page, configure parameters following instructions.

   Table 3 Parameters

   Parameter	Description	Example Value
   Billing Mode	Specifies the billing mode of the shared bandwidth. The billing mode can be: Yearly/Monthly: You pay for the bandwidth by year or month before using it. No charges will be incurred for the bandwidth during its validity period. Pay-per-use: You pay for the bandwidth based on the amount of time you use the bandwidth.	Yearly/Monthly
   Region	The desired region. Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For low network latency and quick resource access, select the nearest region.	AP-Singapore N/A
   Billed By	Specifies the shared bandwidth billing factor.	Select Bandwidth.
   Bandwidth	Specifies the shared bandwidth size in Mbit/s. The minimum bandwidth that can be purchased is 5 Mbit/s.	10
   Name	Specifies the name of the shared bandwidth.	Bandwidth-001
   Enterprise Project	When assigning the shared bandwidth, add the shared bandwidth to an enabled enterprise project. An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default. For details about how to create and manage enterprise projects, see Enterprise Management User Guide.	default
   Required Duration	Specifies the required duration of the shared bandwidth to be purchased. Configure this parameter only in yearly/monthly billing mode.	2 months

6. Click Next.

Adding an IPv6 Address to the Shared Bandwidth

1. On the shared bandwidth list page, locate the row containing the shared bandwidth and click Add Public IP Address in the Operation column.
   Figure 3 Adding an IPv6 address to the shared bandwidth
   
2. Add the IPv6 address to the shared bandwidth.
   Figure 4 Adding an IPv4/IPv6 dual-stack network interface
   
3. Click OK.

Verifying the Result

Log in to an ECS and ping an IPv6 address on the Internet to verify the connectivity. ping6 ipv6.baidu.com is used as an example here. The execution result is shown in Figure 5.

Figure 5 Result verification