Don't masquerade IPv6

kubernetes · Jan 9, 2025 · d6e1429 · d6e1429
1 parent ffe876e
commit d6e1429
Showing 1 changed file with 20 additions and 12 deletions.
diff --git a/pkg/model/components/kindnet.go b/pkg/model/components/kindnet.go
@@ -40,19 +40,27 @@ func (b *KindnetOptionsBuilder) BuildOptions(o *kops.Cluster) error {
 		c.Version = "v1.8.0"
 	}
 
-	// Kindnet should masquerade well known ranges if kops is not doing it
-	if c.Masquerade == nil {
-		c.Masquerade = &kops.KindnetMasqueradeSpec{
-			Enabled: fi.PtrTo(true),
+	if clusterSpec.IsIPv6Only() {
+		if c.Masquerade == nil {
+			c.Masquerade = &kops.KindnetMasqueradeSpec{
+				Enabled: fi.PtrTo(false),
+			}
 		}
-		if clusterSpec.Networking.NetworkCIDR != "" {
-			c.Masquerade.NonMasqueradeCIDRs = append(c.Masquerade.NonMasqueradeCIDRs, clusterSpec.Networking.NetworkCIDR)
-		}
-		if clusterSpec.Networking.PodCIDR != "" {
-			c.Masquerade.NonMasqueradeCIDRs = append(c.Masquerade.NonMasqueradeCIDRs, clusterSpec.Networking.PodCIDR)
-		}
-		if clusterSpec.Networking.ServiceClusterIPRange != "" {
-			c.Masquerade.NonMasqueradeCIDRs = append(c.Masquerade.NonMasqueradeCIDRs, clusterSpec.Networking.ServiceClusterIPRange)
+	} else {
+		// Kindnet should masquerade well known ranges if kops is not doing it
+		if c.Masquerade == nil {
+			c.Masquerade = &kops.KindnetMasqueradeSpec{
+				Enabled: fi.PtrTo(true),
+			}
+			if clusterSpec.Networking.NetworkCIDR != "" {
+				c.Masquerade.NonMasqueradeCIDRs = append(c.Masquerade.NonMasqueradeCIDRs, clusterSpec.Networking.NetworkCIDR)
+			}
+			if clusterSpec.Networking.PodCIDR != "" {
+				c.Masquerade.NonMasqueradeCIDRs = append(c.Masquerade.NonMasqueradeCIDRs, clusterSpec.Networking.PodCIDR)
+			}
+			if clusterSpec.Networking.ServiceClusterIPRange != "" {
+				c.Masquerade.NonMasqueradeCIDRs = append(c.Masquerade.NonMasqueradeCIDRs, clusterSpec.Networking.ServiceClusterIPRange)
+			}
 		}
 	}