Repository: prequel-dev/cre (go)

Issue:
Istio Ambient Troubleshooting Rules
### Turn a manual troubleshooting guide into a library of [CREs](https://docs.prequel.dev/cres/introduction)

We have a technical guide that walks through a specific set of reliability issues. Your task is to break it down into a structured set of CREs that can be shared with the community and used by `preq` to automate problem detection.

This a great opportunity to get hands-on experience with increasingly popular technologies.  

### 📌 What you’ll do

- Read the [guide](https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient)
- Extract and document multiple CREs based on the key failure modes, signals, and remediations described.
- Submit them in the [Prequel CRE format](https://github.com/prequel-dev/cre#cre-format) following the structure of this repo.  

### ✅ What we’re looking for

- At least 10 high-quality CREs 


### 🏆 Award

**$325** if the submission hits all criteria

### ⚙️ Process
* We'll leave this bounty unassigned for 5 days [June 15 11:59 pm ET].  *We encourage anyone interested to comment /attempt #81 on the issue*
* We will then assign the bounty to a someone based on 
   * quality of plan 
   * past contributions
** The assignee will have 5 days to exclusively pursue the bounty. If the work is not completed, the bounty may be reassigned **


✅ **You must:**

1.  Reproduce the failure scenarios
2.  Share a minimal, working reproductions (e.g., Helm, Docker Compose, etc.)
3.  Write unique [CRE](https://docs.prequel.dev/cres/introduction)-format detection rules for [`preq`](https://github.com/prequel-dev/preq)
4. [Install](https://docs.prequel.dev/install) `preq` and run the rules

📦 **Deliverables:**

*  Reproduction setup and clear README
    *  create a private repo and invite the maintainers (@tonymeehan @lyndon-prequel)
*  Link to your rules in seperate [CRE playgrounds](https://play.prequel.dev/)
*  PR containing 
     * the new CRE rules
     * example logs in test.log files
     * updated tags.yaml and category.yaml files 
     * updated data-sources.yaml file
*  Demo video of 
   *  your reproductions
   *  running the rules

### 📅 Deadline

Will be assigned by June 15
Submit your pull request by **Submit by June 20 11:59 pm ET**

Questions? Open a discussion or find us on [slack](https://inviter.co/prequel). Happy hunting!

/bounty 325

Pull request description:
Add Istio Ambient critical upstream failure detection rule 
This PR adds a new CRE rule based on https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient

Part of #81 
Closes #81 

## Test Environment
 **Live CRE link:** [Playground Link](https://play.prequel.dev/?data=EwBmFYFoQNk4YBUCMAWAXMgHOgzATgDpdhVtwAtAAhqoFMAnBgewdqoEsA7AB2YBN06flwDOPFgA8AnuwBmAQw4AbOvyoAXZlQBG3dVqoL%2B-BnVGiqAbSHIAupnAhwudFQCCJsxaqKAtiqyXMwaVKIArjx8DBpqVAAUzJaMLGz4AOwAlABQQA&rule=E4VwNgpgzgXAUAAgQWgQWwgFwIYBNs7xLEIDWAlgHa4wIAOwEAjiBGIiQuTQgEYAqATgBeABTQBFAO4ANXADEAbgFVgARgCi2AOIALAEwApDiV3You2gEFeAYQDMuDQDM9aw6QAyaAHL7RTABKUPwmCADGjESc3LS2gRrI%2BgAM%2BgCsyMlq2WFIUBCKEMDkmACetPq5CJglkLQARABamCCUlGwIAJKiigBsCABCVLgI8tjkYCCM9VXhBBAA5gD2wOUI9eRQNUvI2Gi85BCUmMiYwEsgvJAWS0s1lAsznAjYIJi6K7SijCxsVbjQSLkOjbSi0AA%2BVSQABEsBBwpgoAgpLojghmq12mAAORI6E%2BADK9HOAA9SggVhElsdzmBkHQwNh2lS0HRqUdMC9MJgIKzEdUlnxhlCBdVUV0ev0wLc6LxsOFSC9cLhGFAkQADADaMBgagAurq0sk0vZ1RTKC8EJQlgDkajGBK%2BlwkbhNtgrhBcAAaEWq8D3BZcC1MhDqqzK1VI5x7Cbk62cqAgOhs4A83BmornYAAOlmr3yEJFqAA0kUschIIUwI7%2BonkytOZsEK6oO7ICNqWKIFabRAi6HugA1XoAfQ0PisA08GmhZvjCHynMwgvV0bA%2BTNVC76JabQ64WpznICymBHI1Kq5FZ8swheeSFQGL3OLxhOJSzJESZ8622FTXuJAoOSoQN8QJZA5hBKZu2cVoEXPShsDAEpSn7Kx9kOY5qmAbBnCPcJ0GwclowmUVVSWMBCgXIpFHIcJu0QjAkUpXhuzQTZzjeT0qnYmoFjPak73vToAFkRJnTorH4DRomeVBAggZAjjbbtuidTt3gY3suGcGtnQQH4QHIRgaBFJB1QsuULDMhcQFwQUoFKKAEWrZApCtLBs2BPpswPShnGzJCwGzFsVJHbzegAXmSGzE3shcnJclB3PaTAvLoHy-ICgFo39EK3Q9cKMqimL72ICz1X7AB5YBmwKyA9IOagQKDHdMQ6XhyUXANWtKC5as6LZzyqugigIT4bIq0o9nYMqkEUJDWFgGykGEXcsVkuakCHUdx0nadoVoNd8kmiz%2BwU39U23J8sQQaFsF5akCSwTbngqqzdBs0hLnhTBXItTZtmQRytl5AyKOlN4DOgHArvwR7KEXBA1va2a5oqkVPCqnxtGQaTAhE17iFQTpKAPYAU3mHsAQrIDqzU-pIPdCYUIiVEFSRKhlwQPqpgiSZQdqhglloqAEJA-tByQ7gqc0gdRGHMcJynGczWcRlAy3XmBqGpYRrG5datsTp6GBNgqGgKocAWZaytQQHz37PYDg5fsUefftUqkFZSCqRhnCKI56Nt%2B9UF0bk6FgAB6KOFhKXRLl8pY0Cjh2llT3Wo6kcgKCj-hOI9G47hA5BBqB9CXeOABiZzlOKHZ3fLEj1zc%2BPkGbz1Th2JrcC73YI2gKBkGyI0TX7lVB-bmMwFKZB42BpMUzTMJQDqKpFyJpAgOOTfiCgfr6NoNPAowjls2lG2RTQAhwksGzUEYBYIBJWhsQ7kZuZ70U8AntUEAAHW1Lqf%2BBo1Cj3sNYAef9ozsRnj2BMi8GyegABQAH5aD-2QUsJEmZKT-1wAAan-gASmIag7EIp2j8R5LQTUeo4BAA)
 **Reproducible test setup (Maintainers invited) :**  [REPO LINK](https://github.com/varshith257/istio-repro/tree/main)

## DEMO


https://github.com/user-attachments/assets/c2328159-d6b7-43ec-948c-d2334c4a3566






Patch:
diff --git a/rules/cre-2025-0112/istio-ambient-troubleshoot.yaml b/rules/cre-2025-0112/istio-ambient-troubleshoot.yaml
new file mode 100644
index 0000000..d9ca9cc
--- /dev/null
+++ b/rules/cre-2025-0112/istio-ambient-troubleshoot.yaml
@@ -0,0 +1,54 @@
+rules:
+  - metadata:
+      kind: prequel
+      id: bT9zPmQwXdFvUr1EaGh2J
+      hash: AbC3dEfGh1JkLmN2PqRsT
+    cre:
+      id: CRE-2025-0111
+      severity: 2
+      title: "Ztunnel IPv6 Bind Failure"
+      category: "istio-ambient-troubleshooting"
+      author: Prequel
+      description: |
+        Detects when Ztunnel's DNS proxy or control-plane component attempts to bind
+        to the IPv6 loopback address `[::1]:15053` on a node where IPv6 is disabled,
+        resulting in an `Address family not supported` error.
+      cause: |
+        - Kernel-level IPv6 support is disabled on the node
+        - `IPV6_ENABLED` not set to `false` in the Ztunnel configuration
+      impact: |
+        - Ztunnel's DNS proxy cannot start, preventing DNS-capture functionality
+        - Ambient traffic may fail to resolve service names or be misrouted
+      mitigation: |
+        IMMEDIATE:
+        - Re-enable IPv6 on the node if IPv6 is required:
+          ```bash
+          sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0
+          sudo sysctl -w net.ipv6.conf.default.disable_ipv6=0
+          ```
+        - Or disable IPv6 binding in Ztunnel by setting in your IstioOperator:
+          ```yaml
+          values:
+            ztunnel:
+              IPV6_ENABLED: false
+          ```
+        - Restart the Ztunnel DaemonSet:
+          ```bash
+          kubectl -n istio-system rollout restart daemonset ztunnel
+          ```
+        LONG-TERM:
+        - Incorporate node-level IPv6 capability checks into your cluster provisioning
+        - Validate the `IPV6_ENABLED` flag in your IstioOperator CI pipelines
+      tags:
+        - istio
+        - ambient
+        - ztunnel
+        - network
+      references:
+        - https://github.com/istio/istio/wiki/Troubleshooting-Istio-Ambient#scenario-ztunnel-fails-with-failed-to-bind-to-address-115053-address-family-not-supported
+    rule:
+      set:
+        event:
+          source: cre.log.ambient
+        match:
+          - regex: 'failed to bind to address \[::1\]:15053: Address family not supported(?: \(os error \d+\))?'
diff --git a/rules/tags/tags.yaml b/rules/tags/tags.yaml
index 56340d0..1d2334b 100644
--- a/rules/tags/tags.yaml
+++ b/rules/tags/tags.yaml
@@ -719,4 +719,4 @@ tags:
     description: Problems where system capacity limits (storage, memory, connections) are exceeded
   - name: data-loss-risk
     displayName: Data Loss Risk
-    description: Conditions that may lead to data loss if not addressed promptly
+    description: Conditions that may lead to data loss if not addressed promptly
\ No newline at end of file


Test patch:
diff --git a/rules/cre-2025-0112/test.log b/rules/cre-2025-0112/test.log
new file mode 100644
index 0000000..5a3bf35
--- /dev/null
+++ b/rules/cre-2025-0112/test.log
@@ -0,0 +1,1 @@
+2025-06-26T14:18:39.324185Z    error    inpod::dnsproxy    failed to bind to address [::1]:15053: Address family not supported (os error 97)