From 8cdc61b92403e2150bd40c0dab2125a375e915d9 Mon Sep 17 00:00:00 2001 From: Tero Kauppinen Date: Wed, 4 Mar 2026 14:33:12 +0200 Subject: [PATCH] fix(kube-proxy): fix IPv6 support check for Linux MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The current Linux implementation checks whether a node supports IPv6 by testing for the presence of '/proc/net/if_inet6'. However, that check does not confirm that IPv6 support is actually enabled. As a result, kube-proxy can incorrectly enable dual‑stack support on nodes that do not have IPv6 enabled. The possibility to disable IPv6 support has existed since Linux kernel v2.6.27. Update the IPv6 support check to also consider the contents of '/proc/sys/net/ipv6/conf/all/disable_ipv6'. Signed-off-by: Tero Kauppinen --- cmd/kube-proxy/app/server_linux.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/cmd/kube-proxy/app/server_linux.go b/cmd/kube-proxy/app/server_linux.go index 6b98d40668f..2cde573d5f2 100644 --- a/cmd/kube-proxy/app/server_linux.go +++ b/cmd/kube-proxy/app/server_linux.go @@ -25,6 +25,7 @@ import ( "errors" "fmt" "os" + "strings" v1 "k8s.io/api/core/v1" utilsysctl "k8s.io/component-helpers/node/util/sysctl" @@ -106,7 +107,14 @@ func (s *ProxyServer) platformCheckSupported(ctx context.Context) (ipv4Supported // Check if the OS has IPv6 enabled, by verifying if the IPv6 interfaces are available _, errIPv6 := os.Stat("/proc/net/if_inet6") - if errIPv6 != nil { + if errIPv6 == nil { + // Also check that IPv6 hasn't been disabled + content, err := os.ReadFile("/proc/sys/net/ipv6/conf/all/disable_ipv6") + if err == nil && strings.TrimSpace(string(content)) == "1" { + logger.Info("Kernel support disabled for family", "ipFamily", v1.IPv6Protocol) + ipv6Supported = false + } + } else { logger.Info("No kernel support for family", "ipFamily", v1.IPv6Protocol) ipv6Supported = false }