Deploying Teleport in a native IPv6 environment

[harichards]

Do the Teleport proxy and auth services support being deployed in a native IPv6 environment (i.e., no IPv4 addresses are assigned)? I am specifically wondering if an auth server can be deployed in an AWS VPC with an egress-only internet gateway and no NAT.

[webvictim]

Teleport does have native support for IPv6 but being totally honest, it doesn't get tested regularly. I'd be curious to see how it actually does. AFAICT it should work, but it's possible that there are some little edge cases where IPv4 is assumed, or we use 127.0.0.1 instead of localhost resolving to ::1, etc.

[harichards]

Unfortunately, I discovered other barries that prevent me from getting this to work. Many AWS services' endpoints do not support IPv6 which necessitates a dual-stack VPC. Then you need to use VPC endpoints to access those AWS services without a NAT. These endpoints add cost for services other than S3 and DynamoDB. For my configuration, this just isn't worth it and I'm better off running a NAT.

Anyways, thanks for your reply! 😄

[webvictim]

I have to say that when you initially mentioned AWS, I did raise an eyebrow as their IPv6 support is notoriously poor!

Best of luck anyway :)

[chaporgin]

Just 50 cents: tryied to install teleport agent into dualstack AKS cluster and it did not pass the health probes, the only line in logs was

2024-08-21T10:32:02Z INFO             Starting Teleport v13.4.26 with a config file located at "/etc/teleport/teleport.yaml" common/teleport.go:588

So it did not work for us.

[webvictim]

There's nothing that technically prevents Teleport from starting/running in a dual-stacked environment - this error seems unrelated, like maybe it's related to backend provisioning.

If you want to start a new discussion with your /etc/teleport.yaml file we can assist.