Creating an IPv4/IPv6 Dual-Stack Cluster in CCE

Overview

IPv6 addresses are used to deal with the problem of IPv4 address exhaustion. If a worker node (such as an ECS) in the current cluster uses IPv4, the node can run in dual-stack mode after IPv6 is enabled. Specifically, the node has both IPv4 and IPv6 addresses, which can be used to access the intranet or public network.

Figure 1 Diagram of an IPv4/IPv6 dual-stack enabled cluster

Application Scenarios

• If your application needs to provide Services for users who use IPv6 clients, you can use IPv6 EIPs or the IPv4 and IPv6 dual-stack function.
• If your application needs to both provide Services for users who use IPv6 clients and analyze the access request data, you can use only the IPv4 and IPv6 dual-stack function.
• If internal communication is required between your application systems or between your application system and another system (such as the database system), you can use only the IPv4 and IPv6 dual-stack function.

For details about the dual-stack, see IPv4 and IPv6 Dual-Stack Network and IPv6 EIP.

Constraints

• Clusters that support IPv4/IPv6 dual-stack:

  Cluster Type	Cluster Network Model	Version	Remarks
  CCE standard cluster	Container tunnel network	v1.15 or later	IPv4/IPv6 dual-stack will be generally available for clusters of v1.23. ELB dual-stack is not supported.
  CCE Turbo cluster	Cloud Native 2.0 Network	v1.23.8-r0 or later v1.25.3-r0 or later	Currently, Kata containers do not support IPv4/IPv6 dual-stack. Only ECS-VM or ECS-physical server (c6.22xlarge.4.physical or c7.32xlarge.4.physical) supports IPv4/IPv6 dual-stack.

• Worker nodes and master nodes in Kubernetes clusters use IPv4 addresses to communicate with each other.
• When there is a DNAT Service in a cluster, only IPv4 addresses are supported.
• Only one IPv6 address can be bound to each NIC.
• When IPv4/IPv6 dual-stack is enabled for the cluster, DHCP unlimited lease cannot be enabled for the selected node subnet.
• If a dual-stack cluster is used, do not change the load balancer protocol version on the ELB console.
• ELB dual-stack can be used in only CCE Turbo clusters with the following restrictions.

  Application Scenario	Dedicated Load Balancer	Shared Load Balancer
  ELB ingress	Dual stack is supported. Layer-7 dedicated load balancers can only communicate with their backend servers using IPv4. For details, see Does ELB Support IPv6 Networks? If an ingress uses IPv6/IPv4 dual-stack, related alarms will be generated. (Backends with IPv6 addresses cannot be added to the associated load balancer.) You can view related alarms by referring to the events of the corresponding ingress.	Only IPv4 is supported.
  Nginx ingress	Dual-stack is supported when the following conditions are met: For clusters from v1.19 to v1.23, nginx-ingress of v2.1.7 or later supports dual-stack. For clusters of v1.25 or later, nginx-ingress of v2.2.5 or later supports dual-stack.	Only IPv4 is supported.
  LoadBalancer Service	Layer 7 (HTTP/HTTPS): Dual-stack is supported. Layer-7 dedicated load balancers can only communicate with their backend servers using IPv4. For details, see Does ELB Support IPv6 Networks? If a Service uses IPv6/IPv4 dual-stack, related alarms will be generated. (Backends with IPv6 addresses cannot be added to the associated load balancer.) You can view related alarms by referring to the events of the corresponding Service. To avoid alarms, you can select the IPv4 protocol when creating a Service and select a dedicated Layer-7 load balancer with dual-stack enabled. Layer 4 (TCP/UDP): Dual-stack is supported.	Only IPv4 is supported.

Step 1: Create a VPC

Before creating your VPCs, determine how many VPCs, the number of subnets, and what IP address ranges you will need. For details, see Network Planning.

• The basic operations for IPv4 and IPv6 dual-stack networks are the same as those for IPv4 networks. Only some parameters are different.
• For details about the IPv6 billing policy, supported ECS types, and supported regions, see IPv4 and IPv6 Dual-Stack Network.

Perform the following operations to create a VPC named vpc-ipv6 and its default subnet named subnet-ipv6.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region and a project.
3. Under Networking, select Virtual Private Cloud.
4. Click Create VPC.
5. Configure the VPC and subnet following instructions. For details about the mandatory parameters, see Table 1 and Table 2. For details about other parameters, see Creating a VPC and Subnet.

   When configuring a subnet, select Enable for IPv6 CIDR Block to automatically allocate an IPv6 CIDR block to the subnet. IPv6 cannot be disabled after the subnet is created. Currently, you are not allowed to specify a custom IPv6 CIDR block.

   Table 1 VPC configuration parameters

   Parameter	Description	Example Value
   Region	Specifies the desired region. Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you.	AP-Singapore
   Name	VPC name.	vpc-ipv6
   IPv4 CIDR Block	Specifies the Classless Inter-Domain Routing (CIDR) block of the VPC. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC) or a subset (for multiple subnets in the VPC). The following CIDR blocks are supported: 10.0.0.0/8–24 172.16.0.0/12–24 192.168.0.0/16–24	192.168.0.0/16
   Enterprise Project	When creating a VPC, you can add the VPC to an enabled enterprise project. An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default. For details about how to create and manage enterprise projects, see Enterprise Management User Guide.	default

   Table 2 Subnet parameters

   Parameter	Description	Example Value
   Subnet Name	Specifies the subnet name.	subnet-ipv6
   AZ	An AZ is a geographic location with independent power supply and network facilities in a region. AZs are physically isolated, and AZs in the same VPC are interconnected through an internal network.	AZ 2
   IPv4 CIDR Block	Specifies the IPv4 CIDR block for the subnet. This value must be within the VPC CIDR range.	192.168.0.0/24
   IPv6 CIDR Block	Select Enable for IPv6 CIDR Block. An IPv6 CIDR block will be automatically assigned to the subnet. IPv6 cannot be disabled after the subnet is created. Currently, you are not allowed to specify a custom IPv6 CIDR block.	N/A
   Associated Route Table	Specifies the default route table to which the subnet will be associated. You can change the route table to a custom route table.	Default
   Advanced Settings
   Gateway	Specifies the gateway address of the subnet. This IP address is used to communicate with other subnets.	192.168.0.1
   DNS Server Address	By default, two DNS server addresses are configured. You can change them if necessary. When multiple IP addresses are available, separate them with a comma (,).	100.125.x.x
   IPv4 DHCP Lease Time	Specifies the period during which a client can use an IP address automatically assigned by the DHCP server. After the lease time expires, a new IP address will be assigned to the client. If a DHCP lease time is changed, the new lease automatically takes effect when half of the current lease time has passed. To make the change take effect immediately, restart the ECS or log in to the ECS to cause the DHCP lease to automatically renew. CAUTION: When IPv4/IPv6 dual-stack is enabled for the cluster, DHCP unlimited lease cannot be enabled for the selected node subnet.	365 days or 300 hours

6. Click Create Now.

Step 2: Create a CCE Cluster

Step 3: Buy a Shared Bandwidth and Adding an IPv6 Address to It

By default, the IPv6 address can only be used for private network communication. If you want to use this IPv6 address to access the Internet or be accessed by IPv6 clients on the Internet, buy a shared bandwidth and add the IPv6 address to it.

If you already have a shared bandwidth, you can add the IPv6 address to the shared bandwidth without purchasing one.

Buying a Shared Bandwidth

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region and a project.
3. Choose Service List > Networking > Virtual Private Cloud.
4. In the navigation pane, choose Elastic IP and Bandwidth > Shared Bandwidths.
5. In the upper right corner, click Buy Shared Bandwidth. On the displayed page, configure parameters following instructions.

   Table 3 Parameters

   Parameter	Description	Example Value
   Billing Mode	Specifies the billing mode of a shared bandwidth. The billing mode can be: Yearly/Monthly: You pay for the bandwidth by year or month before using it. No charges will be incurred for the bandwidth during its validity period. Pay-per-use: You pay for the bandwidth based on the amount of time you use the bandwidth.	Yearly/Monthly
   Region	Specifies the desired region. Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across different regions. For lower network latency and faster access to your resources, select the region nearest you.	AP-Singapore -
   Billed By	Specifies the shared bandwidth billing factor.	Select Bandwidth.
   Bandwidth	Specifies the shared bandwidth size in Mbit/s. The minimum bandwidth that can be purchased is 5 Mbit/s.	10
   Name	Specifies the name of the shared bandwidth.	Bandwidth-001
   Enterprise Project	When assigning the shared bandwidth, you can add the shared bandwidth to an enabled enterprise project. An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default. For details about how to create and manage enterprise projects, see Enterprise Management User Guide.	default
   Required Duration	Specifies the required duration of the shared bandwidth to be purchased. Configure this parameter only in yearly/monthly billing mode.	2 months

6. Click Next.

Adding an IPv6 Address to a Shared Bandwidth

1. On the shared bandwidth list page, locate the row containing the target shared bandwidth and click Add Public IP Address in the Operation column.
   Figure 3 Adding an IPv6 address to a shared bandwidth
   
2. Add the IPv6 address to the shared bandwidth.
   Figure 4 Adding a dual-stack NIC IPv6 address
   
3. Click OK.

Verifying the Result

Log in to an ECS and ping an IPv6 address on the Internet to verify the connectivity. ping6 ipv6.baidu.com is used as an example here. The execution result is displayed in Figure 5.

Figure 5 Result verification