Change:
Clusters created with kubeadm using DualStack are not able to work, because CoreDNS pods never get ready Seeing one failed job logs It seems that the pod is "waiting for the kubernetes service"?? coredns version seems the same as in the working jobs CoreDNS pod should be ready Instal a Dual-stack cluster using master with kubeadm (or kind ) ! It started to fail on Oct12 <details</details<details</details<details</details<details</details<details</details<details</details
There are no sig labels on this issue. Please add an appropriate label by using one of the following commands: - Please see the for a listing of the SIGs, working groups, and committees available. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/cc I didn't notice it was failing for more than 1 month :facewithhead_bandage: I didn't have time to dig into it yet, but this PR landed just that day how is that the pods running has the version 1.8.4 but the PR seems to update kubeadm to 1.8.6?
Looking into this today. The error from CoreDNS should only happen when the kubernetes plugin fails to sync with the Kubernetes API, either because it can’t connect, or it can’t sync the lists of services/endpointslices. There were changes and fixes to the API connection code, so it could be a regression.
Actually no. The changes I was thinking of were already in 1.8.4.
How can we reproduce it : Instal a Dual-stack cluster using master with kubeadm (or kind ) I was unable to reproduce this issue in a kind dual stack cluster. After upgrading coredns to 1.8.6 (from 1.8.0 installed by kind), and adding list/watch permission for endpointslice, the pods were ready. edit: It also works for coredns 1.8.4 - I'm unclear as to which version I should be checking.
let me check if is a regression in kind :thinking:
working with 1.8.6 and yesterdays kubernetes podIPs
This is weird, I hit a similar issue in openshift, endpoints doesn't match the IP family of the kubernetes.default service apiserver service is single stack, at least until this KEP fixes it What I don't understand is why the order of the IPs in kind is different let me try to fix both things /assign
my fault, sorry for the noise :sweat_smile:

Discussion:
servicecontroller "k8s.io/kubernetes/pkg/registry/core/service/ipallocator/controller" portallocatorcontroller "k8s.io/kubernetes/pkg/registry/core/service/portallocator/controller" "k8s.io/kubernetes/pkg/util/async" <ins> netutils "k8s.io/utils/net" </ins> ) const (

} // NewBootstrapController returns a controller for watching the core capabilities of the master <del> func (c *completedConfig) NewBootstrapController(legacyRESTStorage corerest.LegacyRESTStorage, serviceClient corev1client.ServicesGetter, nsClient corev1client.NamespacesGetter, eventClient corev1client.EventsGetter, readyzClient rest.Interface) *Controller { </del> <ins> func (c *completedConfig) NewBootstrapController(legacyRESTStorage corerest.LegacyRESTStorage, serviceClient corev1client.ServicesGetter, nsClient corev1client.NamespacesGetter, eventClient corev1client.EventsGetter, readyzClient rest.Interface) (*Controller, error) { </ins> _, publicServicePort, err := c.GenericConfig.SecureServing.HostPort() if err != nil { <del> klog.Fatalf("failed to get listener address: %v", err) </del> <ins> return nil, fmt.Errorf("failed to get listener address: %w", err) } // The "kubernetes.default" Service is SingleStack based on the configured ServiceIPRange. // If the bootstrap controller reconcile the kubernetes.default Service and Endpoints, it must // guarantee that the Service ClusterIP and the associated Endpoints have the same IP family, or // it will not work for clients because of the IP family mismatch. // TODO: revisit for dual-stack https://github.com/kubernetes/enhancements/issues/2438 if c.ExtraConfig.EndpointReconcilerType != reconcilers.NoneEndpointReconcilerType { if netutils.IsIPv4CIDR(&c.ExtraConfig.ServiceIPRange) != netutils.IsIPv4(c.GenericConfig.PublicAddress) { return nil, fmt.Errorf("service IP family %q must match public address family %q", c.ExtraConfig.ServiceIPRange.String(), c.GenericConfig.PublicAddress.String()) } </ins> } systemNamespaces := []string{metav1.NamespaceSystem, metav1.NamespacePublic, corev1.NamespaceNodeLease}

ExtraEndpointPorts:        c.ExtraConfig.ExtraEndpointPorts, PublicServicePort:         publicServicePort, KubernetesServiceNodePort: c.ExtraConfig.KubernetesServiceNodePort, <del> } </del> <ins> }, nil </ins> } // PostStartHook initiates the core controller loops that must exist for bootstrapping.

discoveryv1 "k8s.io/api/discovery/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/intstr" <ins> genericapiserver "k8s.io/apiserver/pkg/server" </ins> "k8s.io/client-go/kubernetes/fake" <ins> corev1client "k8s.io/client-go/kubernetes/typed/core/v1" "k8s.io/client-go/rest" </ins> core "k8s.io/client-go/testing" "k8s.io/kubernetes/pkg/controlplane/reconcilers" <ins> corerest "k8s.io/kubernetes/pkg/registry/core/rest" </ins> netutils "k8s.io/utils/net" )

} } } <ins> func Test_completedConfig_NewBootstrapController(t *testing.T) { _, ipv4cidr, err := netutils.ParseCIDRSloppy("192.168.0.0/24") if err != nil { t.Fatalf("Unexpected error %v", err) } _, ipv6cidr, err := netutils.ParseCIDRSloppy("2001:db8::/112") if err != nil { t.Fatalf("Unexpected error %v", err) } ipv4address := netutils.ParseIPSloppy("192.168.1.1") ipv6address := netutils.ParseIPSloppy("2001:db8::1") type args struct { legacyRESTStorage corerest.LegacyRESTStorage serviceClient     corev1client.ServicesGetter nsClient          corev1client.NamespacesGetter eventClient       corev1client.EventsGetter readyzClient      rest.Interface } tests := []struct { name        string config      genericapiserver.Config extraConfig *ExtraConfig args        args wantErr     bool }{ { name: "master endpoint reconciler - IPv4 families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.MasterCountReconcilerType, ServiceIPRange:         *ipv4cidr, }, config: genericapiserver.Config{ PublicAddress: ipv4address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: false, }, { name: "master endpoint reconciler - IPv6 families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.MasterCountReconcilerType, ServiceIPRange:         *ipv6cidr, }, config: genericapiserver.Config{ PublicAddress: ipv6address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: false, }, { name: "master endpoint reconciler - wrong IP families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.MasterCountReconcilerType, ServiceIPRange:         *ipv4cidr, }, config: genericapiserver.Config{ PublicAddress: ipv6address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: true, }, { name: "master endpoint reconciler - wrong IP families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.MasterCountReconcilerType, ServiceIPRange:         *ipv6cidr, }, config: genericapiserver.Config{ PublicAddress: ipv4address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: true, }, { name: "lease endpoint reconciler - IPv4 families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.LeaseEndpointReconcilerType, ServiceIPRange:         *ipv4cidr, }, config: genericapiserver.Config{ PublicAddress: ipv4address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: false, }, { name: "lease endpoint reconciler - IPv6 families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.LeaseEndpointReconcilerType, ServiceIPRange:         *ipv6cidr, }, config: genericapiserver.Config{ PublicAddress: ipv6address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: false, }, { name: "lease endpoint reconciler - wrong IP families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.LeaseEndpointReconcilerType, ServiceIPRange:         *ipv4cidr, }, config: genericapiserver.Config{ PublicAddress: ipv6address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: true, }, { name: "lease endpoint reconciler - wrong IP families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.LeaseEndpointReconcilerType, ServiceIPRange:         *ipv6cidr, }, config: genericapiserver.Config{ PublicAddress: ipv4address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: true, }, { name: "none endpoint reconciler - wrong IP families", extraConfig: &ExtraConfig{ EndpointReconcilerType: reconcilers.NoneEndpointReconcilerType, ServiceIPRange:         *ipv4cidr, }, config: genericapiserver.Config{ PublicAddress: ipv6address, SecureServing: &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}}, }, wantErr: false, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { c := &completedConfig{ GenericConfig: tt.config.Complete(nil), ExtraConfig:   tt.extraConfig, } _, err := c.NewBootstrapController(tt.args.legacyRESTStorage, tt.args.serviceClient, tt.args.nsClient, tt.args.eventClient, tt.args.readyzClient) if (err != nil) != tt.wantErr { t.Errorf("completedConfig.NewBootstrapController() error = %v, wantErr %v", err, tt.wantErr) return } }) } } </ins>

controllerName := "bootstrap-controller" coreClient := corev1client.NewForConfigOrDie(c.GenericConfig.LoopbackClientConfig) <del> bootstrapController := c.NewBootstrapController(legacyRESTStorage, coreClient, coreClient, coreClient, coreClient.RESTClient()) </del> <ins> bootstrapController, err := c.NewBootstrapController(legacyRESTStorage, coreClient, coreClient, coreClient, coreClient.RESTClient()) if err != nil { return fmt.Errorf("error creating bootstrap controller: %v", err) } </ins> m.GenericAPIServer.AddPostStartHookOrDie(controllerName, bootstrapController.PostStartHook) m.GenericAPIServer.AddPreShutdownHookOrDie(controllerName, bootstrapController.PreShutdownHook)

t.Fatalf("bad cidr: %v", err) } cfg.ExtraConfig.ServiceIPRange = *cidr <ins> cfg.GenericConfig.PublicAddress = netutils.ParseIPSloppy("2001:db8::10") </ins> _, s, closeFn := framework.RunAnAPIServer(cfg) defer closeFn()

t.Fatalf("bad cidr: %v", err) } cfg.ExtraConfig.ServiceIPRange = *cidr <ins> cfg.GenericConfig.PublicAddress = netutils.ParseIPSloppy("2001:db8::10") </ins> _, secCidr, err := netutils.ParseCIDRSloppy(secondaryServiceCIDR) if err != nil {

// TODO: get rid of these tests or port them to secure serving genericConfig.SecureServing = &genericapiserver.SecureServingInfo{Listener: fakeLocalhost443Listener{}} <ins> // if using endpoint reconciler the service subnet IP family must match the Public address genericConfig.PublicAddress = netutils.ParseIPSloppy("10.1.1.1") </ins> err = etcdOptions.ApplyWithStorageFactoryTo(storageFactory, genericConfig) if err != nil { panic(err)