Giters

GoogleCloudPlatform / guest-agent

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

google-guest-agent breaks down without ipv6 enabled

tomas-nar opened this issue · comments

commented

Summary:

This looks very similar to #54 which is supposedly resolved, but is still happening on google-guest-agent version 20221109.00. The only difference that ipv6 is disabled in grub by adding ipv6.disable=0 option to GRUB_CMDLINE_LINUX in /etc/default/grub.

Issue details:

google-guest-agent service starts, but does not perform any functions, such as setting up ssh keys from metadata and others. The following error is seen in journalctl:

google_guest_agent[6544]: GCE Agent Started (version 20221109.00)
google_guest_agent[6544]: Enabling OS Login
google_guest_agent[6544]: ERROR addresses.go:301 Error configuring IPv6: Internet Systems Consortium DHCP Client 4.2.5
google_guest_agent[6544]: Copyright 2004-2013 Internet Systems Consortium.
google_guest_agent[6544]: All rights reserved.
google_guest_agent[6544]: For info, please visit https://www.isc.org/software/dhcp/
google_guest_agent[6544]: no link-local IPv6 address for eth0
google_guest_agent[6544]: This version of ISC DHCP is based on the release available
google_guest_agent[6544]: on ftp.isc.org.  Features have been added and other changes
google_guest_agent[6544]: have been made to the base software release in order to make
google_guest_agent[6544]: it work better with this distribution.
google_guest_agent[6544]: Please report for this software via the CentOS Bugs Database:
google_guest_agent[6544]: http://bugs.centos.org/
google_guest_agent[6544]: exiting.

Instance details:

  • OS: CentOS 7
  • Custom image created by using projects/centos-cloud/global/images/centos-7-v20230306 public image and applying CIS hardening. No google-guest-agent related configuration changed.

Disabling ipv6 (if it's not used) to reduce attack surface is a common security practice, part of CIS Benchmarks, etc. Therefore I think google-guest-agent shouldn't strictly depend on ipv6 until it's more widely adopted.

commented

ssh keys were not set from metadata due to oslogin being enabled. It seems that this error while shown does not impact google-guest-agent functionality.