10 Commits (af5a5864631931371eb1da70dd27bd6334aea6ae)

Author	SHA1	Message	Date
Maisem Ali	335a5aaf9a	cmd/k8s-operator: add APISERVER_PROXY env ... The kube-apiserver proxy in the operator would only run in auth proxy mode but thats not always desirable. There are situations where the proxy should just be a transparent proxy and not inject auth headers, so do that using a new env var APISERVER_PROXY and deprecate the AUTH_PROXY env. THe new env var has three options `false`, `true` and `noauth`. Updates #8317 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	306b85b9a3	cmd/k8s-operator: add metrics to track usage ... Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Brad Fitzpatrick	98a5116434	all: adjust some build tags for plan9 ... I'm not saying it works, but it compiles. Updates #5794 Change-Id: I2f3c99732e67fe57a05edb25b758d083417f083e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>	1 year ago
Maisem Ali	7f6bc52b78	cmd/k8s-operator: refactor operator code ... It was jumbled doing a lot of things, this breaks it up into the svc reconciliation and the tailscale sts reconciliation. Prep for future commit. Updates #502 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	24509f8b22	cmd/k8s-operator: add support for control plane assigned groups ... Previously we would use the Impersonate-Group header to pass through tags to the k8s api server. However, we would do nothing for non-tagged nodes. Now that we have a way to specify these via peerCaps respect those and send down groups for non-tagged nodes as well. For tagged nodes, it defaults to sending down the tags as groups to retain legacy behavior if there are no caps set. Otherwise, the tags are omitted. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	1 year ago
Maisem Ali	df89b7de10	cmd/k8s-operator: disable HTTP/2 for the auth proxy ... Kubernetes uses SPDY/3.1 which is incompatible with HTTP/2, disable it in the transport and server. Fixes #7645 Fixes #7646 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	c87782ba9d	cmd/k8s-operator: drop trailing dot in tagged node name ... Also update tailcfg docs. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	558735bc63	cmd/k8s-operator: require HTTPS to be enabled for AuthProxy ... Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	489e27f085	cmd/k8s-operator: make auth proxy pass tags as Impersonate-Group ... We were not handling tags at all, pass them through as Impersonate-Group headers. And use the FQDN for tagged nodes as Impersonate-User. Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago
Maisem Ali	05adf22383	cmd/k8s-operator: add support for running an auth proxy ... Updates #5055 Signed-off-by: Maisem Ali <maisem@tailscale.com>	2 years ago