Add support for deployment on ipv6 kubernetes cluster

[cdrburea]

When we deployed the helm chart on ipv6 kubernetes cluster, the probe for nginx is failed because the pods listen only on ipv4 address

In nginx.conf file , we need for ipv6:

listen [::]:80;

[kiblik]

When we deployed the helm chart on ipv6 kubernetes cluster, the probe for nginx is failed because the pods listen only on ipv4 address

In nginx.conf file , we need for ipv6:

listen [::]:80;

Interesting. I do not have IPv6 cluster available right now, but based on the documentation, it looks like the current definition

django-DefectDojo/nginx/nginx.conf

Line 27 in a406968

listen 8080;

django-DefectDojo/nginx/nginx_TLS.conf

Line 22 in a406968

listen 8080;

django-DefectDojo/nginx/nginx_TLS.conf

Line 34 in a406968

listen 8443 ssl;

should be dual-stack, not IPv4-only.

Could you please try running kubectl exec defectdojo-django-... -c nginx -- netstat -tnlp for me?

[cdrburea]

When we deployed the helm chart on ipv6 kubernetes cluster, the probe for nginx is failed because the pods listen only on ipv4 address
In nginx.conf file , we need for ipv6:
listen [::]:80;

Interesting. I do not have IPv6 cluster available right now, but based on the documentation, it looks like the current definition

django-DefectDojo/nginx/nginx.conf

Line 27 in a406968

listen 8080;

django-DefectDojo/nginx/nginx_TLS.conf

Line 22 in a406968

listen 8080;

django-DefectDojo/nginx/nginx_TLS.conf

Line 34 in a406968

listen 8443 ssl;
should be dual-stack, not IPv4-only.

Could you please try running kubectl exec defectdojo-django-... -c nginx -- netstat -tnlp for me?

Hello,

With the current configuration (listen 8080):

~ $ netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 1/nginx.conf -g dae
~ $

the probe that uses ipv6 adrress failed, the listen port is on 0.0.0.0 (ipv4 only)

When i add listen listen [::]:8080; on the nginx conf:

netstat -tnlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 1/nginx.conf -g dae
tcp 0 0 :::8080 :::* LISTEN 1/nginx.conf -g dae

Probe is ok and deployment ok.

I had same problem with uwsgsi, i replace the http listen port to --http [::]:8081 and all is ok with ipv6

exec uwsgi
"--${DD_UWSGI_MODE}" "${DD_UWSGI_ENDPOINT}"
--protocol uwsgi
--enable-threads
--processes "${DD_UWSGI_NUM_OF_PROCESSES:-2}"
--threads "${DD_UWSGI_NUM_OF_THREADS:-2}"
--wsgi dojo.wsgi:application
--buffer-size="${DD_UWSGI_BUFFER_SIZE:-8192}"
--http [::]:8081 --http-to "${DD_UWSGI_ENDPOINT}" \

[kiblik]

I was testing #12710 on various setups, but as 2.49.0 was released, I discovered a use case where it is not working.

I'm going to try write the fix.