Update "Upgrading a Nebula network to IPv6 overlay addresses" guide for v1.10 release

[jasikpark]

Now that Nebula v1.10 is released, IPv6 support is stable, let's update the docs to reflect that.

See https://ipv6.docs-nebula.pages.dev/docs/guides/upgrade-to-cert-v2-and-ipv6/

[cloudflare-workers-and-pages]

Deploying docs-nebula with    Cloudflare Pages

Latest commit:	4794a18
Status:	✅  Deploy successful!
Preview URL:	https://5879c4f2.docs-nebula.pages.dev
Branch Preview URL:	https://ipv6.docs-nebula.pages.dev

View logs

[nbrownus]

This section is no longer correct https://github.com/DefinedNet/nebula-docs/blob/ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles.

nebula-cert sign will default to using the CA certificate version. It is technically possible to issue a v1 certificate signed by a v2 CA but I don't think we want to teach people to do it that way.

We can also combine this step https://github.com/DefinedNet/nebula-docs/blob/ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles with this step https://github.com/DefinedNet/nebula-docs/blob/ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles. As long as the v1 certificate has the same ipv4 address as the v2 certificate, the v2 certificate can have additional ipv6 addresses. What might make more sense here is to show dropping support for ipv4 at the end.

[jasikpark]

This section is no longer correct ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles.

nebula-cert sign will default to using the CA certificate version. It is technically possible to issue a v1 certificate signed by a v2 CA but I don't think we want to teach people to do it that way.

We can also combine this step ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles with this step ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles. As long as the v1 certificate has the same ipv4 address as the v2 certificate, the v2 certificate can have additional ipv6 addresses. What might make more sense here is to show dropping support for ipv4 at the end.

Mind mentioning the line numbers? you linked to the same spots when saying two steps could be merged.

[nbrownus]

Line 66 https://github.com/DefinedNet/nebula-docs/blob/ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#issue-v1v2-certificates-bundles

Line 201 https://github.com/DefinedNet/nebula-docs/blob/ipv6/docs/guides/upgrade-to-cert-v2-and-ipv6/index.mdx#remove-v1-certificates-from-hosts

I strongly suggest you run through the actions described in this guide to verify they have the expected outcome. They were correct up until fairly recently, mainly when we merged slackhq/nebula#1535

[jasikpark]

Can a nebula 1.10 host with a v2 cert with an ipv4 address handshake with a nebula 1.9 host with a v1 cert? I'm guessing it's only nebula 1.10 hosts that can do v1 x v2 cert interop?

[JackDoan]

@jasikpark

correct

I just read through this and it seems good to me! A full run-through of the steps end-to-end is definitely in order, if you haven't already done that