Summary
DefectDojo does not fully work on IPv6-only Kubernetes clusters (e.g. EKS with IPv6 pod networking).
Related: #12695, #12710, #12916, #12938. Nginx IPv6 listen directives were added in #12710, fully reverted in #12916, and never restored. #12938 only added entrypoint logic to strip listen [::]: when IPv6 is unavailable. uWSGI’s HTTP probe listener remains IPv4-only.
Problems
1. nginx listens on IPv4 only
nginx/nginx.conf and nginx/nginx_TLS.conf currently have only:
listen 8080;listen 8443 ssl; (TLS config)
There are no listen [::]:8080; / listen [::]:8443 ssl; lines. docker/entrypoint-nginx.sh already removes listen [::]: when IPv6 loopback is missing, but the configs never include those directives, so dual-stack never activates. On IPv6-only pods, kubelet probes against the pod’s IPv6 address fail.
2. uWSGI HTTP probe bind is hardcoded to IPv4
In docker/entrypoint-uwsgi.sh:
--http 0.0.0.0:8081 --http-to "${DD_UWSGI_ENDPOINT}"This HTTP endpoint is for Kubernetes liveness checks. On IPv6-only pods, probes fail because the listener is IPv4-only. The main nginx↔uWSGI path via DD_UWSGI_ENDPOINT (Unix socket) is fine; only this probe bind needs fixing.
Requested changes
-
Restore dual-stack nginx listens (entrypoint already handles IPv4-only hosts):
listen [::]:8080;listen [::]:8443 ssl;- Optionally add
::1/128 to the metrics geo bypass alongside 127.0.0.1/32.
-
Make the uWSGI HTTP probe bind configurable via env, e.g.:
--http "${DD_UWSGI_HTTP:-0.0.0.0:8081}"
- Expose it in the Helm chart (e.g.
django.uwsgi.http → DD_UWSGI_HTTP) so IPv6-only / dual-stack clusters can set [::]:8081 without rebuilding images. (django.uwsgi.extraEnv alone is not enough while the bind address stays hardcoded in the entrypoint.)
Workaround
We currently rebuild the official nginx/django images to add the nginx listen [::]:... directives and change uWSGI to --http [::]:8081.
Summary
DefectDojo does not fully work on IPv6-only Kubernetes clusters (e.g. EKS with IPv6 pod networking).
Related: #12695, #12710, #12916, #12938. Nginx IPv6
listendirectives were added in #12710, fully reverted in #12916, and never restored. #12938 only added entrypoint logic to striplisten [::]:when IPv6 is unavailable. uWSGI’s HTTP probe listener remains IPv4-only.Problems
1. nginx listens on IPv4 only
nginx/nginx.confandnginx/nginx_TLS.confcurrently have only:listen 8080;listen 8443 ssl;(TLS config)There are no
listen [::]:8080;/listen [::]:8443 ssl;lines.docker/entrypoint-nginx.shalready removeslisten [::]:when IPv6 loopback is missing, but the configs never include those directives, so dual-stack never activates. On IPv6-only pods, kubelet probes against the pod’s IPv6 address fail.2. uWSGI HTTP probe bind is hardcoded to IPv4
In
docker/entrypoint-uwsgi.sh:--http 0.0.0.0:8081 --http-to "${DD_UWSGI_ENDPOINT}"This HTTP endpoint is for Kubernetes liveness checks. On IPv6-only pods, probes fail because the listener is IPv4-only. The main nginx↔uWSGI path via
DD_UWSGI_ENDPOINT(Unix socket) is fine; only this probe bind needs fixing.Requested changes
Restore dual-stack nginx listens (entrypoint already handles IPv4-only hosts):
listen [::]:8080;listen [::]:8443 ssl;::1/128to the metricsgeobypass alongside127.0.0.1/32.Make the uWSGI HTTP probe bind configurable via env, e.g.:
--http "${DD_UWSGI_HTTP:-0.0.0.0:8081}"django.uwsgi.http→DD_UWSGI_HTTP) so IPv6-only / dual-stack clusters can set[::]:8081without rebuilding images. (django.uwsgi.extraEnvalone is not enough while the bind address stays hardcoded in the entrypoint.)Workaround
We currently rebuild the official nginx/django images to add the nginx
listen [::]:...directives and change uWSGI to--http [::]:8081.