VERSION.txt: this is v1.78.3

Signed-off-by: Nick Khyl <nickk@tailscale.com>

VERSION.txt

@@ -1 +1 @@
-1.77.0
+1.78.3

cmd/containerboot/kube.go

@@ -24,6 +24,7 @@ import (
 type kubeClient struct {
 	kubeclient.Client
 	stateSecret string
+	canPatch    bool // whether the client has permissions to patch Kubernetes Secrets
 }
 
 func newKubeClient(root string, stateSecret string) (*kubeClient, error) {

cmd/containerboot/main.go

@@ -331,8 +331,10 @@ authLoop:
 		if err := client.SetServeConfig(ctx, new(ipn.ServeConfig)); err != nil {
 			log.Fatalf("failed to unset serve config: %v", err)
 		}
-		if err := kc.storeHTTPSEndpoint(ctx, ""); err != nil {
-			log.Fatalf("failed to update HTTPS endpoint in tailscale state: %v", err)
+		if hasKubeStateStore(cfg) {
+			if err := kc.storeHTTPSEndpoint(ctx, ""); err != nil {
+				log.Fatalf("failed to update HTTPS endpoint in tailscale state: %v", err)
+			}
 		}
 	}
 

cmd/containerboot/serve.go

@@ -72,8 +72,10 @@ func watchServeConfigChanges(ctx context.Context, path string, cdChanged <-chan
 		if err := updateServeConfig(ctx, sc, certDomain, lc); err != nil {
 			log.Fatalf("serve proxy: error updating serve config: %v", err)
 		}
-		if err := kc.storeHTTPSEndpoint(ctx, certDomain); err != nil {
-			log.Fatalf("serve proxy: error storing HTTPS endpoint: %v", err)
+		if kc != nil && kc.canPatch {
+			if err := kc.storeHTTPSEndpoint(ctx, certDomain); err != nil {
+				log.Fatalf("serve proxy: error storing HTTPS endpoint: %v", err)
+			}
 		}
 		prevServeConfig = sc
 	}

cmd/containerboot/settings.go

@@ -214,6 +214,7 @@ func (cfg *settings) setupKube(ctx context.Context, kc *kubeClient) error {
 		return fmt.Errorf("some Kubernetes permissions are missing, please check your RBAC configuration: %v", err)
 	}
 	cfg.KubernetesCanPatch = canPatch
+	kc.canPatch = canPatch
 
 	s, err := kc.GetSecret(ctx, cfg.KubeSecret)
 	if err != nil {

health/health_test.go

@@ -14,6 +14,7 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/opt"
 	"tailscale.com/util/usermetric"
+	"tailscale.com/version"
 )
 
 func TestAppendWarnableDebugFlags(t *testing.T) {
@@ -352,6 +353,11 @@ func TestShowUpdateWarnable(t *testing.T) {
 }
 
 func TestHealthMetric(t *testing.T) {
+	unstableBuildWarning := 0
+	if version.IsUnstableBuild() {
+		unstableBuildWarning = 1
+	}
+
 	tests := []struct {
 		desc            string
 		check           bool
@@ -361,20 +367,20 @@ func TestHealthMetric(t *testing.T) {
 	}{
 		// When running in dev, and not initialising the client, there will be two warnings
 		// by default:
-		// - is-using-unstable-version
+		// - is-using-unstable-version (except on the release branch)
 		// - wantrunning-false
 		{
 			desc:            "base-warnings",
 			check:           true,
 			cv:              nil,
-			wantMetricCount: 2,
+			wantMetricCount: unstableBuildWarning + 1,
 		},
 		// with: update-available
 		{
 			desc:            "update-warning",
 			check:           true,
 			cv:              &tailcfg.ClientVersion{RunningLatest: false, LatestVersion: "1.2.3"},
-			wantMetricCount: 3,
+			wantMetricCount: unstableBuildWarning + 2,
 		},
 	}
 	for _, tt := range tests {

hostinfo/hostinfo_linux_test.go

@@ -35,8 +35,12 @@ remotes/origin/QTSFW_5.0.0`
 	}
 }
 
-func TestInContainer(t *testing.T) {
-	if got := inContainer(); !got.EqualBool(false) {
-		t.Errorf("inContainer = %v; want false due to absence of ts_package_container build tag", got)
+func TestPackageTypeNotContainer(t *testing.T) {
+	var got string
+	if packageType != nil {
+		got = packageType()
+	}
+	if got == "container" {
+		t.Fatal("packageType = container; should only happen if build tag ts_package_container is set")
 	}
 }