Hello,
I’m preparing the switch to Bullseye for my containers and I’m running into a network problem. I am not using the network management packages provided by Debian. Indeed, I think it is better to use systemd-networkd which is installed anyway.
Here is a part of the network configuration tasks via ansible:
---
# tasks file for common
- name: "systemd-networkd : déployer l'interface de loopback"
become: yes
notify:
- "systemd-networkd : redémarrer le service"
ansible.builtin.copy:
owner: "root"
group: "root"
mode: u=rw,g=r,o=r
dest: /etc/systemd/network/1-lo.network
content: |
[Match]
Name=lo
[Network]
Address=127.0.0.1/8
Address=::1/128
- name: "systemd-networkd : déployer la configuration des interfaces"
become: yes
notify:
- "systemd-networkd : redémarrer le service"
loop: "{{ instance.network.interfaces | dict2items }}"
ansible.builtin.template:
owner: "root"
group: "root"
mode: u=rw,g=r,o=r
src: systemd-networkd.j2
dest: /etc/systemd/network/{{ item.value.filename }}
- name: "systemd-networkd : désactiver le serveur DNS"
become: yes
notify:
- "systemd-networkd : redémarrer le service"
replace:
path: /etc/systemd/resolved.conf
regexp: "#DNSStubListener=yes"
replace: DNSStubListener=no
register: dns
- name: "systemd-networkd : démasquer les services"
become: yes
register: unmask
vars:
items:
- "systemd-networkd.service"
- "systemd-networkd.socket"
- "systemd-networkd-wait-online.service"
- "systemd-resolved.service"
loop: "{{ items | flatten(levels=1) }}"
ansible.builtin.systemd:
masked: no
name: "{{ item }}"
- name: "systemd-networkd : activer les services"
become: yes
register: enable
vars:
items:
- "systemd-networkd.service"
- "systemd-resolved.service"
loop: "{{ items | flatten(levels=1) }}"
ansible.builtin.systemd:
enabled: yes
name: "{{ item }}"
- name: "systemd-networkd : basculer de fournisseur réseau"
become: yes
when: unmask.changed or enable.changed
shell: "systemctl stop networking && systemctl start systemd-networkd.service systemd-resolved.service"
- name: "systemd-networkd : désinstaller les paquets netbase"
become: yes
notify:
- "systemd-networkd : supprimer les résidus de netbase"
- "systemd-networkd : activer la gestion DNS par systemd-resolved"
apt:
state: absent
name:
- ifupdown
- netbase
- resolvconf
This gives the following file:
root@infra-ansible-test:~# cat /etc/systemd/network/2-eth0.network
# Ansible managed
[Match]
Name=eth0
[Network]
DHCP=no
IPv6AcceptRA=no
LinkLocalAddressing=no
Address=192.168.50.214/24
Gateway=192.168.50.254
DNS=192.168.50.254
Address=fd00:ff50::d214/64
Gateway=fd00:ff50::d254
DNS=fd00:ff50::d254
That seems to be the problem:
pulsar@erebe:~$ lxc exec infra-ansible-test -- /bin/bash
WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement
root@infra-ansible-test:~# sudo systemctl status systemd-networkd
● systemd-networkd.service - Network Service
Loaded: loaded (/lib/systemd/system/systemd-networkd.service; enabled; vendor preset: enabled)
Drop-In: /run/systemd/system/service.d
└─zzz-lxc-service.conf
Active: active (running) since Thu 2021-07-01 11:34:53 UTC; 2h 49min ago
TriggeredBy: ● systemd-networkd.socket
Docs: man:systemd-networkd.service(8)
Main PID: 1256 (systemd-network)
Status: "Processing requests..."
Tasks: 1 (limit: 4596)
Memory: 3.8M
CPU: 229ms
CGroup: /system.slice/systemd-networkd.service
└─1256 /lib/systemd/systemd-networkd
Jul 01 11:34:53 infra-ansible-test systemd[1]: Starting Network Service...
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase buffer size for device monitor, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Enumeration completed
Jul 01 11:34:53 infra-ansible-test systemd[1]: Started Network Service.
root@infra-ansible-test:~# sudo networkctl status
● State: off
Jul 01 11:34:53 infra-ansible-test systemd[1]: Starting Network Service...
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Failed to increase buffer size for device monitor, ignoring: Operation not permitted
Jul 01 11:34:53 infra-ansible-test systemd-networkd[1256]: Enumeration completed
Jul 01 11:34:53 infra-ansible-test systemd[1]: Started Network Service.
root@infra-ansible-test:~# sudo networkctl list
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback carrier pending
44 eth0 ether off pending
2 links listed.
root@infra-ansible-test:~# sudo networkctl up eth0
root@infra-ansible-test:~# sudo networkctl list
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback carrier pending
44 eth0 ether degraded pending
2 links listed.
root@infra-ansible-test:~# sudo networkctl status eth0
● 44: eth0
Link File: n/a
Network File: n/a
Type: ether
State: degraded (pending)
HW Address: 00:16:3e:41:43:f0
MTU: 1500 (min: 68, max: 65535)
QDisc: noqueue
IPv6 Address Generation Mode: eui64
Queue Length (Tx/Rx): 1/1
Auto negotiation: no
Speed: 10Gbps
Duplex: full
Port: tp
Address: fe80::216:3eff:fe41:43f0
Gateway: fe80::216:3eff:fe29:fea7
Jul 01 14:28:19 infra-ansible-test systemd-networkd[1256]: eth0: Link UP
Jul 01 14:28:19 infra-ansible-test systemd-networkd[1256]: eth0: Gained carrier
Jul 01 14:28:21 infra-ansible-test systemd-networkd[1256]: eth0: Gained IPv6LL
root@infra-ansible-test:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
44: eth0@if45: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 00:16:3e:41:43:f0 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::216:3eff:fe41:43f0/64 scope link
valid_lft forever preferred_lft forever
It works in privileged mode, but for security reasons you will understand that this is not acceptable. It doesn’t work in nesting mode and in normal mode (neither nesting nor privileged).
Is this a known problem? Is there a solution or a workaround?
Thanks for reading and in advance for your help.