tailscale

Commit Graph

Author	SHA1	Message	Date
Irbe Krumina	1ec0273473	docs/k8s: fix subnet router manifests (#12305 ) In https://github.com/tailscale/tailscale/pull/11363 I changed the subnet router manifest to run in tun mode (for performance reasons), but did not change the security context to give it net_admin, which is required to for the tailscale socket. Updates tailscale/tailscale#12083 Signed-off-by: Irbe Krumina <irbe@tailscale.com>	6 months ago
Adrian Dewhurst	c8b0adb382	docs/windows/policy: add missing key expiration warning interval Fixes #11345 Change-Id: Ib53b639690b77d1b7d857304dca2119f197227ce Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	8 months ago
Andrea Gottardo	0001237253	docs/policy: update ADMX and ADML files with new Windows 1.62 syspolicies Updates ENG-2776 Updates the .admx and .adml files to include the new ManagedByOrganizationName, ManagedByCaption and ManagedByURL system policies, added in Tailscale v1.62 for Windows. Co-authored-by: Andrea Gottardo <andrea@gottardo.me> Signed-off-by: Nick Khyl <nickk@tailscale.com>	8 months ago
Irbe Krumina	3047b6274c	docs/k8s: don't run subnet router in userspace mode (#11363 ) There should not be a need to do that unless we run on host network Signed-off-by: Irbe Krumina <irbe@tailscale.com>	9 months ago
Irbe Krumina	dff6f3377f	docs/k8s: update docs (#11307 ) Update docs for static Tailscale deployments on kube to always use firewall mode autodection when in non-userspace. Also add a note about running multiple replicas and a few suggestions how folks could do that. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com> Co-authored-by: Anton Tolchanov <1687799+knyar@users.noreply.github.com>	9 months ago
ChandonPierre	2ce596ea7a	cmd/k8s-operator/deploy: allow modifying operator tags via Helm values Updates tailscale/tailscale#10659 Signed-off-by: Chandon Pierre <cpierre@coreweave.com>	11 months ago
Adrian Dewhurst	d50303bef7	docs: add Windows administrative template To make setting Windows policies easier, this adds ADMX policy descriptions. Fixes #6495 Updates ENG-2515 Change-Id: If4613c9d8ec734afec8bd781575e24b4aef9bb73 Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>	11 months ago
Andrew Lytvynov	2716250ee8	all: cleanup unused code, part 2 (#10670 ) And enable U1000 check in staticcheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	11 months ago
Maisem Ali	f53c3be07c	cmd/k8s-operator: use our own container image instead of busybox We already have sysctl in the `tailscale/tailscale` image, just use that. Updates #cleanup Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
James Tucker	13767e5108	docs/sysv: add a sysv style init script The script depends on a sufficiently recent start-stop-daemon as to provide the `-m` and `--remove-pidfile` flags. Updates #9502 Signed-off-by: James Tucker <james@tailscale.com>	1 year ago
David Wolever	0c427f23bd	docs/k8s: don't call kubectl directly from Makefile Instead of calling kubectl directly in k8s Makefile, write the yaml to stdout so it can be reviewed/edited/etc before manually applying with kubectl. Fixes: #8511 Signed-off-by: David Wolever <david@wolever.net>	1 year ago
Will Norris	71029cea2d	all: update copyright and license headers This updates all source files to use a new standard header for copyright and license declaration. Notably, copyright no longer includes a date, and we now use the standard SPDX-License-Identifier header. This commit was done almost entirely mechanically with perl, and then some minimal manual fixes. Updates #6865 Signed-off-by: Will Norris <will@tailscale.com>	2 years ago
Walter Poupore	11f7f7d4a0	docs/k8s: Use TS_AUTHKEY instead of TS_AUTH_KEY (#7092 ) Updates https://github.com/tailscale/tailscale-www/issues/2199. Signed-off-by: Walter Poupore <walterp@tailscale.com>	2 years ago
Andrew Dunham	a6dff4fb74	docs/webhooks: use subtle.ConstantTimeCompare for comparing signatures Fixes #6572 Signed-off-by: Andrew Dunham <andrew@du.nham.ca> Change-Id: I58610c46e0ea1d3a878f91d154db3da4de9cae00	2 years ago
David Anderson	5e703bdb55	docs/k8s: add secrets patching permission to the tailscale role. Fixes #6225. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
David Anderson	76904b82e7	cmd/containerboot: PID1 for running tailscaled in a container. This implements the same functionality as the former run.sh, but in Go and with a little better awareness of tailscaled's lifecycle. Also adds TS_AUTH_ONCE, which fixes the unfortunate behavior run.sh had where it would unconditionally try to reauth every time if you gave it an authkey, rather than try to use it only if auth is actually needed. This makes it a bit nicer to deploy these containers in automation, since you don't have to run the container once, then go and edit its definition to remove authkeys. Signed-off-by: David Anderson <danderson@tailscale.com>	2 years ago
Sonia Appasamy	944f43f1c8	docs/webhooks: add sample endpoint code Signed-off-by: Sonia Appasamy <sonia@tailscale.com>	2 years ago
Maisem Ali	5fc8843c4c	docs/k8s: [proxy] fix sysctl command Fixes #5805 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Anton Schubert	021bedfb89	docker: add ability to use a custom control socket Signed-off-by: Anton Schubert <anton.schubert@riedel.net>	2 years ago
hlts2	d988c9f098	fix auth key name Signed-off-by: hlts2 <hiroto.funakoshi.hiroto@gmail.com>	2 years ago
Tyler Lee	486eecc063	Switched Secret snippet to match run.sh Signed-off-by: Tyler Lee <tyler.lee@radius.ai>	2 years ago
Tyler Lee	b830c9975f	Updated secret example in readme to match the sidecar key value Signed-off-by: Tyler Lee <tyler.lee@radius.ai>	2 years ago
Maisem Ali	060ecb010f	docs/k8s: make run.sh handle SIGINT It was previously using jobcontrol to achieve this, but that apparently doesn't work when there is no tty. This makes it so that it directly handles SIGINT and SIGTERM and passes it on to tailscaled. I tested this works on a Digital Ocean K8s cluster. Fixes #5512 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Denton Gentry	0ae0439668	docs/k8s: add IPv6 forwarding in proxy.yaml Fixes https://github.com/tailscale/tailscale/issues/4999 Signed-off-by: Denton Gentry <dgentry@tailscale.com>	2 years ago
Walter Poupore	df9f3edea3	docs/k8s: add prefix to (#5167 ) Signed-off-by: Walter Poupore <walterp@tailscale.com>	2 years ago
Maisem Ali	1d33157ab9	docs/k8s: use job control in run.sh This has the benefit of propagating SIGINT to tailscaled, which in turn can react to the event and logout in case of an ephemeral node. Also fix missing run.sh in Dockerfile. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	bd4b27753e	docs/k8s: set statedir to /tmp when not specified This makes `tailscale cert` and Taildrop work on k8s and in ephemeral mode. Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Craig Rodrigues	9584d8aa7d	docs/k8s: Add env vars for tailscaled args - TS_SOCKS5_SERVER, argument passed to tailscaled --socks5-server - TS_OUTBOUND_HTTP_PROXY_LISTEN, argument passed to tailscaled -outbound-http-proxy-listen - TS_TAILSCALED_EXTRA_ARGS extra arguments passed to tailscaled Fixes #4985 Signed-off-by: Craig Rodrigues <rodrigc@crodrigues.org>	2 years ago
Jake Edgington	ea6e9099b9	fix: typo rename, ROUTES -> TS_ROUTES Signed-off-by: Jake Edgington <jake.edgington@gmail.com>	2 years ago
Jake Edgington	72b7edbba9	fix: typo rename, KUBE_SECRET -> TS_KUBE_SECRET Signed-off-by: Jake Edgington <jake.edgington@gmail.com>	2 years ago
Maisem Ali	3b55bf9306	build_docker.sh: add run.sh as an entrypoint to the docker image Fixes #4071 Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Brian Fallik	9fa6cdf7bf	fix minor typo Signed-off-by: Brian Fallik <bfallik@gmail.com>	3 years ago
Robert	cb030a0bb4	docs/k8s: add example about setting up a subnet router Signed-off-by: Robert <rspier@pobox.com> Co-authored-by: Maisem Ali <3953239+maisem@users.noreply.github.com>	3 years ago
Felipe Cruz Martinez	47ace13ac8	Fix k8s README Use the correct KUBE_SECRET value	3 years ago
Maisem Ali	e538d47bd5	docs/k8s: update run.sh to use the correct socket path Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	a6c3de72d6	docs/k8s: use ghcr.io for base image Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	45d4adcb63	docs/k8s: use tailscale/tailscale as base image Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	2c403cbb31	docs/k8s: add instructions on how to run as a sidecar or a proxy. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	0842e2f45b	ipn/store: add ability to store data as k8s secrets. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago
Maisem Ali	fd4838dc57	wgengine/userspace: add support to automatically enable/disable the tailscale protocol in BIRD, when the node is a primary subnet router as determined by control. Signed-off-by: Maisem Ali <maisem@tailscale.com>	3 years ago

40 Commits (380a3a083469f3950bf9bdd0a03ca8199fdb91dd)