HDDS-16969. Add an IPv6-only acceptance smoke test

[smengcl]

Generated-by: Claude Code (Opus 5.5)

What changes were proposed in this pull request?

No test currently runs an Ozone cluster over IPv6 end to end. The IPv6 fixes under HDDS-15763 only have unit tests, so a regression in listener setup, peer addressing or a client path would not be caught.

This adds an acceptance test that runs the non-secure ozone-ha compose cluster (SCM HA, OM HA, three datanodes, Recon, S3 Gateway, HttpFS) on a Docker network with IPv4 disabled:

• compose/ozone-ha/ipv6.yaml is a compose override that sets enable_ipv4: false and enable_ipv6: true on the network and sets the bind host properties to ::, including httpfs.http.hostname. SCM HA reads its RPC bind hosts only from the keys suffixed with service ID and node ID, so those are set per node. Existing environments are unchanged.
• compose/ozone-ha/test-ipv6.sh (suite HA-unsecure) reuses existing robot suites: shell, ofs, S3 object put and get, HttpFS WebHDFS, admincli datanode, pipeline and SCM roles, OM roles and OM leader transfer. When OZONE_WITH_COVERAGE=true, JaCoCo is disabled for this script because the coverage collector uses the IPv4 docker bridge gateway, which is unreachable on the IPv6-only network.
• smoketest/ipv6/ipv6.robot adds checks specific to this environment:
  • no host resolves to an IPv4 address, so a test cannot silently fall back to IPv4
  • datanodes register with IPv6 addresses
  • ozone admin reconfig --service=DATANODE --in-service-datanodes properties reaches each datanode by its IPv6 address
  • SCM, OM, Recon, S3 Gateway and HttpFS HTTP servers answer on a bracketed IPv6 literal (/jmx proves listen/reachability)
  • SCM and OM are reachable when the client addresses are overridden with bracketed IPv6 literals

Not covered here:

• Bracketed IPv6 literals in the servers' own configuration. That needs static container addresses and can be a follow-up.
• A secure (Kerberos) variant, which is a separate subtask.
• If Docker cannot create an IPv6-only network, the test fails. It does not report itself as skipped.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-16969

How was this patch tested?

Ran compose/ozone-ha/test-ipv6.sh from a locally built distribution on Docker 29.8.2 with Compose v2. All suites passed. The containers had no IPv4 address and every listener was bound to :::port.

GitHub-hosted runners have no outbound IPv6 route, but this test only needs traffic between containers on a local bridge. The acceptance (HA-unsecure) job of this PR is the first run there.

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[jojochuang]

CI failure analysis (HA-unsecure, test-ipv6.sh)

Fork run smengcl/hadoop-ozone/actions/runs/38373381842 / job 115330662593: the HA-unsecure acceptance job failed only on compose/ozone-ha/test-ipv6.sh. Other scripts in the same job (test.sh, test-haproxy-s3g.sh, etc.) passed.

Symptom

• start_docker_env never gets past wait_for_port scm1 9860 (120s) → Timed out waiting on scm1 9860 to become available.
• Logs repeat service "scm1" is not running (container exits during init, not a Robot failure).

Root cause

From artifact ozone-ha/ipv6/docker-ozone-ha-scm1-1.log, SCM aborts on ozone scm --init because the JaCoCo -javaagent fails in premain:

Caused by: java.net.SocketException: Network is unreachable
  at org.jacoco.agent.rt.internal_bac9136.output.TcpClientOutput.createSocket(...)
...
Aborted (core dumped) /opt/hadoop/bin/ozone scm --init

This job runs with with-coverage: true, so every JVM loads JaCoCo and opens a TCP socket to the coverage collector. On the IPv6-only compose network (enable_ipv4: false), that collector address is not reachable (no IPv4 path), the agent fails to load, and SCM never binds 9860.

So this looks like coverage × IPv6-only compose, not a missing Ozone bind key in the first instance—the default HA scripts still use an IPv4-enabled bridge where JaCoCo works.

Suggested directions

1. Disable or skip JaCoCo for test-ipv6.sh when OZONE_WITH_COVERAGE=true (override JAVA_TOOL_OPTIONS / jacoco opts for that script only).
2. Configure JaCoCo to report to an address reachable on the IPv6 bridge (if supported).
3. Run IPv6 acceptance in a separate suite without coverage until (1) or (2) is in place.

Happy to re-review once CI is green with one of these approaches.

[jojochuang]

let's include httpfs too.

[jojochuang]

Good first cut for IPv6-only HA compose smoke. Worth being clear what it is: Docker-only, servers bind :: on the compose network, clients mostly use service hostnames (plus a narrow bracketed-literal CLI path). It does not exercise production-style static literals in config or the full IPv6 address-string matrix—that stays with unit tests and later acceptance work.

Non-blocking follow-ups: add HttpFS (HTTPFS-SITE.XML_httpfs.http.hostname: "::" + the HTTP loop); /jmx only proves listen/reachability, not that HTTP APIs actually work on literals.

Fine to merge once HttpFS is covered; broader roadmap items can wait.

[jojochuang]

Looks good. The IPv6-only compose override, dedicated ipv6.robot checks, and reuse of the existing HA-unsecure suites give useful end-to-end coverage beyond unit tests. HttpFS bind + WebHDFS smoke and clearing OZONE_OPTS under coverage address the earlier CI and review feedback. Fine to merge once HA-unsecure is green.