NodePortLocal: Support IPv6 and dual-stack

[antoninbas]

While NodePortLocal was graduated to GA a while back (#5491), it still doesn't support IPv6 and dual-stack, which seems like a big gap. We should investigate adding this support. Note that NodePortLocal supports Windows Nodes as well. We can either handle Linux + Windows support at once, or tackle Linux first and Windows as a follow-up.

[antoninbas]

Windows is out-of-scope of this issue since we do not currently support IPv6 on Windows Nodes: #5162

[antoninbas]

The main decision that has to be made is whether we will require the same Node port to be used for IPv4 and IPv6 in the case of a dual-stack Service.

Let's consider the following Service:

apiVersion: v1
kind: Service
metadata:
  name: nginx
  annotations:
    nodeportlocal.antrea.io/enabled: "true"
spec:
  ipFamilyPolicy: PreferDualStack
  ports:
  - name: web
    port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 3
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx

Now let's look at one of the Pods for the Deployment (dual-stack cluster):

apiVersion: v1
kind: Pod
metadata:
  name: nginx-6799fc88d8-9rx8z
  labels:
    app: nginx
  annotations:
    nodeportlocal.antrea.io: '[{"podPort":8080,"nodeIP":"10.10.10.10","nodePort":61002,"protocol":"tcp","ipFamily":"IPv4"},{"podPort":8080,"nodeIP":"fd12:3456:789a:1::1","nodePort":61003,"protocol":"tcp","ipFamily":"IPv6"}]'

In this example, we have the following 2 NPL mapping:

• {"podPort":8080,"nodeIP":"10.10.10.10","nodePort":61002,"protocol":"tcp","ipFamily":"IPv4"}
• {"podPort":8080,"nodeIP":"fd12:3456:789a:1::1","nodePort":61003,"protocol":"tcp","ipFamily":"IPv6"}

This assumes that the Node port can be different for IPv4 and IPv6. We also introduce an ipFamily field for convenience.

The alternative would be to always use the same port for IPv4 and IPv6. For example, the mappings would always look like this:

• {"podPort":8080,"nodeIP":"10.10.10.10","nodePort":61004,"protocol":"tcp","ipFamily":"IPv4"}
• {"podPort":8080,"nodeIP":"fd12:3456:789a:1::1","nodePort":61004,"protocol":"tcp","ipFamily":"IPv6"}

I am leaning towards the first option (do not always allocate the same port) for the following reasons:

1. it is simpler to handle the rules individually in the implementation - we used to always allocate the same port for different transport protocols (TCP / UDP), and then decided to stop doing that
2. a dual-stack cluster with IPv4 as the primary IP family can technically be using NodePortLocal today (only IPv4 NPL mappings will be created). When updating Antrea to a version that supports dual-stack NPL, there is no guarantee that the same port can be allocated for the new IPv6 mappings. It is easier if we can just use new ports for IPv6, and we can preserve existing IPv4 mappings.