fix(agents-login): strip AAAA via CoreDNS sidecar so codex sign-in uses IPv4#746
Merged
Merged
Conversation
…uses IPv4 The /etc/hosts init container (#745) and gai.conf (#742) were both ineffective: codex's musl-static Rust client ignores /etc/hosts and /etc/gai.conf, and a hosts A-record doesn't suppress the DNS AAAA — so codex still resolved auth.openai.com's IPv6, tried it, and failed (no IPv6 egress, no IPv4 fallback). Confirmed live: even with the IPv4 hosts pin, `getent hosts auth.openai.com` returned the DNS IPv6 and `codex login --device-auth` still exited 1. Replace that approach with a per-pod CoreDNS sidecar that answers AAAA with NODATA (`template IN AAAA . { rcode NOERROR }`) and forwards everything else to kube-dns (10.43.0.10). Point the pod at it via dnsPolicy: None + dnsConfig nameserver 127.0.0.1, preserving the cluster search domains + ndots. With no AAAA ever returned, codex resolves only IPv4 (which has working egress). Resolver-agnostic — works regardless of codex bypassing libc. Needs live deploy validation (sandbox can't reach the cluster). Runtime codex in the agent-runner needs the same treatment separately. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why the prior two attempts failed
gai.conf(fix(agents-login): prefer IPv4 so codex login can reach auth.openai.com #742): codex is musl-static — musl ignores/etc/gai.conf./etc/hostsinit container (fix(agents-login): pin OpenAI auth host to IPv4 so codex sign-in works (musl + broken IPv6) #745): codex's Rust resolver ignores/etc/hosts, and a hosts A-record doesn't suppress the DNS AAAA. Confirmed live: even with the IPv4 pin,getent hosts auth.openai.comreturned the DNS IPv6 andcodex login --device-authstill exited 1.Definitive fix
A per-pod CoreDNS sidecar that answers
AAAAwith NODATA (template IN AAAA . { rcode NOERROR }) and forwards everything else to kube-dns (10.43.0.10). The pod usesdnsPolicy: None+dnsConfig→127.0.0.1, preserving cluster search domains +ndots:5. With no AAAA ever returned, codex resolves only IPv4 (which has working egress) — resolver-agnostic, regardless of codex bypassing libc. Replaces the ineffective #745 init container.Validation
Needs a real deploy (sandbox can't reach the cluster). After Flux reconciles I'll verify: AAAA→NODATA, A still resolves (incl. cluster names), and
codex login --device-authreaches the user-code step. Runtime codex in agent-runner needs the same — separate follow-up.🤖 Generated with Claude Code