From 8a11f76a0dcb1ff6bb0d4637f843fc25788bfec2 Mon Sep 17 00:00:00 2001 From: Maisem Ali Date: Wed, 22 Mar 2023 15:10:04 -0700 Subject: [PATCH] ipn/ipnlocal: fix cert storage in Kubernetes We were checking against the wrong directory, instead if we have a custom store configured just use that. Fixes #7588 Fixes #7665 Signed-off-by: Maisem Ali --- cmd/tailscaled/depaware.txt | 2 +- ipn/ipnlocal/cert.go | 16 +++++++++++++--- ipn/ipnlocal/local.go | 2 +- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt index 3994ed614..bbed89d2f 100644 --- a/cmd/tailscaled/depaware.txt +++ b/cmd/tailscaled/depaware.txt @@ -212,7 +212,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de tailscale.com/ipn/ipnstate from tailscale.com/control/controlclient+ tailscale.com/ipn/localapi from tailscale.com/ipn/ipnserver tailscale.com/ipn/policy from tailscale.com/ipn/ipnlocal - tailscale.com/ipn/store from tailscale.com/cmd/tailscaled + tailscale.com/ipn/store from tailscale.com/cmd/tailscaled+ L tailscale.com/ipn/store/awsstore from tailscale.com/ipn/store L tailscale.com/ipn/store/kubestore from tailscale.com/ipn/store tailscale.com/ipn/store/mem from tailscale.com/ipn/store+ diff --git a/ipn/ipnlocal/cert.go b/ipn/ipnlocal/cert.go index ff29ffc39..05442c0da 100644 --- a/ipn/ipnlocal/cert.go +++ b/ipn/ipnlocal/cert.go @@ -35,6 +35,8 @@ import ( "tailscale.com/hostinfo" "tailscale.com/ipn" "tailscale.com/ipn/ipnstate" + "tailscale.com/ipn/store" + "tailscale.com/ipn/store/mem" "tailscale.com/types/logger" "tailscale.com/version" "tailscale.com/version/distro" @@ -150,13 +152,21 @@ type certStore interface { var errCertExpired = errors.New("cert expired") func (b *LocalBackend) getCertStore() (certStore, error) { + switch b.store.(type) { + case *store.FileStore: + case *mem.Store: + default: + if hostinfo.GetEnvType() == hostinfo.Kubernetes { + // We're running in Kubernetes with a custom StateStore, + // use that instead of the cert directory. + // TODO(maisem): expand this to other environments? + return certStateStore{StateStore: b.store}, nil + } + } dir, err := b.certDir() if err != nil { return nil, err } - if hostinfo.GetEnvType() == hostinfo.Kubernetes && dir == "/tmp" { - return certStateStore{StateStore: b.store}, nil - } return certFileStore{dir: dir}, nil } diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go index caf323064..b27509a22 100644 --- a/ipn/ipnlocal/local.go +++ b/ipn/ipnlocal/local.go @@ -299,7 +299,7 @@ func NewLocalBackend(logf logger.Logf, logID logid.PublicID, store ipn.StateStor statsLogf: logger.LogOnChange(logf, 5*time.Minute, time.Now), e: e, pm: pm, - store: pm.Store(), + store: store, dialer: dialer, backendLogID: logID, state: ipn.NoState,