Serve IPv6 clients

You can host public services as dual-stack (accessible over both IPv4 and IPv6) even though Syself Autopilot clusters operate as single-stack IPv4 internally. The Hetzner Load Balancer translates incoming IPv6 requests into IPv4 traffic before forwarding them to your nodes, allowing you to serve IPv6 clients worldwide without reconfiguring your applications, CNI, or pods.

How IPv6 translation works

The Hetzner Load Balancer functions as a dual-stack gateway with built-in IPv6-to-IPv4 translation:

• Public ingress is dual-stack: External clients connect to either the IPv4 or IPv6 address allocated to the load balancer.
• Internal forwarding is IPv4: The load balancer translates external IPv6 requests and proxies them to backend nodes over private IPv4.
• Applications stay unchanged: All nodes, pods, and Services operate purely on standard IPv4 without needing an in-cluster IPv6 stack.

flowchart LR
  C6["IPv6 client"] -->|IPv6| LB["Hetzner load balancer<br/>IPv4 + IPv6"]
  C4["IPv4 client"] -->|IPv4| LB
  LB -->|IPv4 translation| N["Node (IPv4 only)"] --> P["Pod"]

The Hetzner Cloud Controller Manager (CCM) automatically allocates both a public IPv4 and a public IPv6 address for every type: LoadBalancer Service, exposing them in status.loadBalancer.ingress. Once you publish the IPv6 address as an AAAA record in your DNS provider, clients should be able to connect over IPv6.

Publish an AAAA record for the load balancer

		apiVersion: v1
kind: Service
metadata:
  name: my-app
  annotations:
    load-balancer.hetzner.cloud/location: fsn1
spec:
  type: LoadBalancer
  ipFamilyPolicy: SingleStack
  ipFamilies: [IPv4]
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 80
	

		$ kubectl get svc my-app -o jsonpath='{range .status.loadBalancer.ingress[*]}{.ip}{"\n"}{end}'
203.0.113.10
2a01:4f8:1c1e:abcd::1
	

		my-app.example.com.  A     203.0.113.10
my-app.example.com.  AAAA  2a01:4f8:1c1e:abcd::1
	

The load balancer replaces the source address, so an IPv6 client's real address reaches the pod only with PROXY protocol on. See Enable PROXY protocol .

Reach the API server over IPv6

By default, the Kubernetes API server endpoint in your kubeconfig uses the control-plane load balancer's IPv4 address, meaning all kubectl traffic defaults to IPv4. To allow clients to reach the API server over IPv6, you must assign a custom DNS hostname to the control plane using the clusterEndpointHost topology variable. Publish an A record by default, and add an AAAA only if IPv6-only clients need access (see the tradeoff below).

An AAAA costs client attribution in the audit log. KubeGate still reads the real client address from the load balancer's PROXY header, so a source-CIDR policy matches on it, but that address cannot be carried onto the node's IPv4 connection to the API server, so the audit record shows 127.0.7.1 instead of the caller. This is a supported tradeoff: publish an AAAA when IPv6-only clients need access, and leave it off when auditability is required.

Node-level networking

Nodes in Syself Autopilot clusters operate strictly as single-stack IPv4. No in-cluster services listen on IPv6, and any IPv6 subnet allocated by Hetzner is left unconfigured on node network interfaces.

Keep the following operational considerations in mind:

• IPv6-only egress: In-cluster workloads cannot connect to external endpoints that serves only over IPv6.
• Service traffic policies: Because the load balancer translates IPv6 to IPv4 before reaching the node, all Kubernetes Service features (including externalTrafficPolicy: Local) operate normally over IPv4.