archive
/
tailscale
mirror of https://github.com/tailscale/tailscale/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

docs/k8s: add prefix to (#5167)

Browse Source 
Signed-off-by: Walter Poupore <walterp@tailscale.com>
pull/5169/head
Walter Poupore 2 years ago committed by GitHub
parent 7fd03ad4b4
commit df9f3edea3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File

27
docs/k8s/README.md
Unescape Escape View File

@ -1,7 +1,11 @@
# Overview # Overview
There are quite a few ways of running Tailscale inside a Kubernetes Cluster, some of the common ones are covered in this doc. There are quite a few ways of running Tailscale inside a Kubernetes Cluster, some of the common ones are covered in this doc.
## Instructions ## Instructions
### Setup ### Setup
1. (Optional) Create the following secret which will automate login.<br> 1. (Optional) Create the following secret which will automate login.<br>
You will need to get an [auth key](https://tailscale.com/kb/1085/auth-keys/) from [Tailscale Admin Console](https://login.tailscale.com/admin/authkeys).<br> You will need to get an [auth key](https://tailscale.com/kb/1085/auth-keys/) from [Tailscale Admin Console](https://login.tailscale.com/admin/authkeys).<br>
If you don't provide the key, you can still authenticate using the url in the logs. If you don't provide the key, you can still authenticate using the url in the logs.
@ -12,12 +16,13 @@ There are quite a few ways of running Tailscale inside a Kubernetes Cluster, som
metadata: metadata:
name: tailscale-auth name: tailscale-auth
stringData: stringData:
AUTH_KEY: tskey-... TS_AUTH_KEY: tskey-...
``` ```
1. Tailscale (v1.16+) supports storing state inside a Kubernetes Secret. 1. Tailscale (v1.16+) supports storing state inside a Kubernetes Secret.
Configure RBAC to allow the Tailscale pod to read/write the `tailscale` secret. Configure RBAC to allow the Tailscale pod to read/write the `tailscale` secret.
```bash ```bash
export SA_NAME=tailscale export SA_NAME=tailscale
export TS_KUBE_SECRET=tailscale-auth export TS_KUBE_SECRET=tailscale-auth
@ -25,6 +30,7 @@ There are quite a few ways of running Tailscale inside a Kubernetes Cluster, som
``` ```
### Sample Sidecar ### Sample Sidecar
Running as a sidecar allows you to directly expose a Kubernetes pod over Tailscale. This is particularly useful if you do not wish to expose a service on the public internet. This method allows bi-directional connectivity between the pod and other devices on the Tailnet. You can use [ACLs](https://tailscale.com/kb/1018/acls/) to control traffic flow. Running as a sidecar allows you to directly expose a Kubernetes pod over Tailscale. This is particularly useful if you do not wish to expose a service on the public internet. This method allows bi-directional connectivity between the pod and other devices on the Tailnet. You can use [ACLs](https://tailscale.com/kb/1018/acls/) to control traffic flow.
1. Create and login to the sample nginx pod with a Tailscale sidecar 1. Create and login to the sample nginx pod with a Tailscale sidecar
@ -40,12 +46,15 @@ Running as a sidecar allows you to directly expose a Kubernetes pod over Tailsca
```bash ```bash
curl http://nginx curl http://nginx
``` ```
Or, if you have [MagicDNS](https://tailscale.com/kb/1081/magicdns/) disabled: Or, if you have [MagicDNS](https://tailscale.com/kb/1081/magicdns/) disabled:
```bash ```bash
curl "http://$(tailscale ip -4 nginx)" curl "http://$(tailscale ip -4 nginx)"
``` ```
#### Userspace Sidecar #### Userspace Sidecar
You can also run the sidecar in userspace mode. The obvious benefit is reducing the amount of permissions Tailscale needs to run, the downside is that for outbound connectivity from the pod to the Tailnet you would need to use either the [SOCKS proxy](https://tailscale.com/kb/1112/userspace-networking) or HTTP proxy. You can also run the sidecar in userspace mode. The obvious benefit is reducing the amount of permissions Tailscale needs to run, the downside is that for outbound connectivity from the pod to the Tailnet you would need to use either the [SOCKS proxy](https://tailscale.com/kb/1112/userspace-networking) or HTTP proxy.
1. Create and login to the sample nginx pod with a Tailscale sidecar 1. Create and login to the sample nginx pod with a Tailscale sidecar
@ -61,23 +70,29 @@ You can also run the sidecar in userspace mode. The obvious benefit is reducing
```bash ```bash
curl http://nginx curl http://nginx
``` ```
Or, if you have [MagicDNS](https://tailscale.com/kb/1081/magicdns/) disabled: Or, if you have [MagicDNS](https://tailscale.com/kb/1081/magicdns/) disabled:
```bash ```bash
curl "http://$(tailscale ip -4 nginx)" curl "http://$(tailscale ip -4 nginx)"
``` ```
### Sample Proxy ### Sample Proxy
Running a Tailscale proxy allows you to provide inbound connectivity to a Kubernetes Service. Running a Tailscale proxy allows you to provide inbound connectivity to a Kubernetes Service.
1. Provide the `ClusterIP` of the service you want to reach by either: 1. Provide the `ClusterIP` of the service you want to reach by either:
**Creating a new deployment** **Creating a new deployment**
```bash ```bash
kubectl create deployment nginx --image nginx kubectl create deployment nginx --image nginx
kubectl expose deployment nginx --port 80 kubectl expose deployment nginx --port 80
export TS_DEST_IP="$(kubectl get svc nginx -o=jsonpath='{.spec.clusterIP}')" export TS_DEST_IP="$(kubectl get svc nginx -o=jsonpath='{.spec.clusterIP}')"
``` ```
**Using an existing service** **Using an existing service**
```bash ```bash
export TS_DEST_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')" export TS_DEST_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')"
``` ```
@ -107,7 +122,7 @@ Running a Tailscale proxy allows you to provide inbound connectivity to a Kubern
Running a Tailscale [subnet router](https://tailscale.com/kb/1019/subnets/) allows you to access Running a Tailscale [subnet router](https://tailscale.com/kb/1019/subnets/) allows you to access
the entire Kubernetes cluster network (assuming NetworkPolicies allow) over Tailscale. the entire Kubernetes cluster network (assuming NetworkPolicies allow) over Tailscale.
1. Identify the Pod/Service CIDRs that cover your Kubernetes cluster. These will vary depending on [which CNI](https://kubernetes.io/docs/concepts/cluster-administration/networking/) you are using and on the Cloud Provider you are using. Add these to the `TS_ROUTES` variable as comma-separated values. 1. Identify the Pod/Service CIDRs that cover your Kubernetes cluster. These will vary depending on [which CNI](https://kubernetes.io/docs/concepts/cluster-administration/networking/) you are using and on the Cloud Provider you are using. Add these to the `TS_ROUTES` variable as comma-separated values.
```bash ```bash
SERVICE_CIDR=10.20.0.0/16 SERVICE_CIDR=10.20.0.0/16
@ -124,7 +139,7 @@ the entire Kubernetes cluster network (assuming NetworkPolicies allow) over Tail
``` ```
1. In the [Tailscale admin console](https://login.tailscale.com/admin/machines), ensure that the 1. In the [Tailscale admin console](https://login.tailscale.com/admin/machines), ensure that the
routes for the subnet-router are enabled. routes for the subnet-router are enabled.
1. Make sure that any client you want to connect from has `--accept-routes` enabled. 1. Make sure that any client you want to connect from has `--accept-routes` enabled.
@ -133,8 +148,8 @@ routes for the subnet-router are enabled.
```bash ```bash
# Get the Service IP # Get the Service IP
INTERNAL_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')" INTERNAL_IP="$(kubectl get svc <SVC_NAME> -o=jsonpath='{.spec.clusterIP}')"
# or, the Pod IP # or, the Pod IP
# INTERNAL_IP="$(kubectl get po <POD_NAME> -o=jsonpath='{.status.podIP}')" # INTERNAL_IP="$(kubectl get po <POD_NAME> -o=jsonpath='{.status.podIP}')"
INTERNAL_PORT=8080 INTERNAL_PORT=8080
curl http://$INTERNAL_IP:$INTERNAL_PORT curl http://$INTERNAL_IP:$INTERNAL_PORT
``` ```

Write Preview
Loading…
Cancel
Save