Unable to Retrieve Neighbour Entry with ndisc6 for Pods Scheduled on Different Nodes

Rouf 0

When inside the pod, I am unable to access the neighbor information of pods deployed on other nodes within the AKS cluster. Even attempts to use ndisc6 prove ineffective in fetching these neighbour records.

Although executing ping6 to the destination pod does add the neighbour entry, however that doens't server our interest.

I'm curious to know if there's a method to enable this neighbour information, even if it involves running ndisc6 just once. If such an option exists, what configuration adjustments are required when setting up the AKS Dual-stack cluster?

Example: EKS forbid ndisc6 however, they do populate permanent neighbour entry in the pod.

1 answer

Anveshreddy Nimmala 2,465 Reputation points Microsoft Vendor

2024-04-08T06:11:58.7966667+00:00

Hello Rouf,

Welcome to microsoft Q&A, Thankyou for posting your query here.

Directly enabling neighbor discovery for pods across nodes in an AKS cluster is challenging due to the nature of Kubernetes' overlay network.

Pods communicate across nodes via the overlay network, which abstracts away the underlying network details.

Azure CNI is one of the network plugins that support dual-stack.

When configuring the cluster, specify both IPv4 and IPv6 ranges for the --pod-cidrs and --service-cidrs options.

Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network

you can refer this links if any one can help you to achieve your goal.

dual-stack kubenet networking in Azure Kubernetes Service (AKS)

and

Azure CNI Overlay networking in Azure Kubernetes Service

Hope this helps you ,If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!
Please sign in to rate this answer.
Rouf 0 Reputation points

2024-04-15T16:48:23.4466667+00:00

Thank you for your response. As you mentioned that directly enabling neighbour discovery is challenging. Would it be feasible to utilize ndisc6 to retrieve that information?

Anveshreddy Nimmala 2,465 Reputation points Microsoft Vendor

2024-04-16T04:50:05.55+00:00

Hello Rouf,

ndisc6 is a tool which contains a set of utilities for managing and troubleshooting IPv6 networks. The primary functions of ndisc6 relate to neighbor discovery and network diagnostics specific to IPv6. it is not directly applicable for retrieving information about Kubernetes pods or their scheduling across different nodes in an Azure Kubernetes Service (AKS) cluster.

Deepanshu Bhatia 0 Reputation points

2024-04-17T05:39:46.4533333+00:00

Hi Anvesh,

We are able to send the the ping6 packets and IP6 packets as well between pods across the nodes in such a overlay setup.

Can you elaborate a bit why these NDP requests are failing/forbidden when ICMP6/IP6 are reachable fine?

Additionally, what is your recommendation to check aliveness of the neighbour pod on a different node from the node on which my current pod is sitting?

Anveshreddy Nimmala 2,465 Reputation points Microsoft Vendor

2024-04-17T09:02:35.01+00:00

Hello Deepanshu Bhatia,

NDP uses DAD (Duplicate Address Detection) to ensure that IPv6 addresses are unique on the network. If DAD fails, the IPv6 address might not be assigned to the interface, leading to communication failures.

Firewalls configured to allow ICMPv6 might still block NDP if not correctly set up, as NDP uses different types of ICMPv6 messages

Few network devices implement rate limiting or DoS protection mechanisms that might inadvertently affect NDP traffic.

Deepanshu Bhatia 0 Reputation points

2024-04-17T09:22:11.0933333+00:00

Hi Anvesh,

Thanks for the elaborate information. We do see success in NDP between pods within the same worker node. It is only when packet goes to a different node, it is timing out. I guess probably a firewall issue.

Any way we can configure our firewalls to allow these NDP packets?

We are using NDP mainly to resolve mac address of the pod sitting on different node. If you have a suggestion how to configure the firewall to allow these NDP packets or use something else to do this mac address resolution, that will be helpful.

Deepanshu Bhatia 0 Reputation points

2024-04-23T05:57:51.29+00:00

Hello @Anveshreddy Nimmala ,

Any updates on the previous comment?

Anveshreddy Nimmala 2,465 Reputation points Microsoft Vendor

2024-04-23T06:05:19.6766667+00:00

Hello Rouf,

Support team will be able to help on this. I would recommend you to open a azure support case. If you don't have a support plan enabled on your subscription, I request you to send an email to AzCommunity@Microsoft.com with Subject as "Attn:Vikas" referencing this thread along with your subscription ID. He can then enable your subscription with a one-time free technical support. Once the issue is resolved, request you to post the resolution here for the benefit of community.
Sign in to comment