You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina 096b090caf cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531) ... * cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets This commit is first part of the work to allow running multiple replicas of the Kubernetes operator egress proxies per tailnet service + to allow exposing multiple tailnet services via each proxy replica. This expands the existing iptables/nftables-based proxy configuration mechanism. A proxy can now be configured to route to one or more tailnet targets via a (mounted) config file that, for each tailnet target, specifies: - the target's tailnet IP or FQDN - mappings of container ports to which cluster workloads will send traffic to tailnet target ports where the traffic should be forwarded. Example configfile contents: { "some-svc": {"tailnetTarget":{"fqdn":"foo.tailnetxyz.ts.net","ports"{"tcp:4006:80":{"protocol":"tcp","matchPort":4006,"targetPort":80},"tcp:4007:443":{"protocol":"tcp","matchPort":4007,"targetPort":443}}}} } A proxy that is configured with this config file will configure firewall rules to route cluster traffic to the tailnet targets. It will then watch the config file for updates as well as monitor relevant netmap updates and reconfigure firewall as needed. This adds a bunch of new iptables/nftables functionality to make it easier to dynamically update the firewall rules without needing to restart the proxy Pod as well as to make it easier to debug/understand the rules: - for iptables, each portmapping is a DNAT rule with a comment pointing at the 'service',i.e: -A PREROUTING ! -i tailscale0 -p tcp -m tcp --dport 4006 -m comment --comment "some-svc:tcp:4006 -> tcp:80" -j DNAT --to-destination 100.64.1.18:80 Additionally there is a SNAT rule for each tailnet target, to mask the source address. - for nftables, a separate prerouting chain is created for each tailnet target and all the portmapping rules are placed in that chain. This makes it easier to look up rules and delete services when no longer needed. (nftables allows hooking a custom chain to a prerouting hook, so no extra work is needed to ensure that the rules in the service chains are evaluated). The next steps will be to get the Kubernetes Operator to generate the configfile and ensure it is mounted to the relevant proxy nodes. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		1 year ago
..
addlicense	all: update tools that manage copyright headers	3 years ago
build-webclient	client/web: precompress assets	2 years ago
cloner	cmd/cloner, cmd/viewer, util/codegen: add support for aliases of cloneable types	1 year ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	2 years ago
containerboot	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	1 year ago
derper	cli: add `tailscale dns query` (#13368)	1 year ago
derpprobe	cmd/derpprobe: use a status page from the prober library	1 year ago
dist	release/dist/qnap: add qnap target builder	2 years ago
get-authkey	util/cmpx: delete now that we're using Go 1.22	2 years ago
gitops-pusher	cmd/gitops-pusher: ignore previous etag if local acls match control (#13068)	1 year ago
hello	cmd/hello: link to the Hello KB article (#11022)	2 years ago
k8s-nameserver	cmd/k8s-nameserver: fix AAAA record query response (#12412)	2 years ago
k8s-operator	cmd/k8s-operator: remove auth key once proxy has logged in (#13612)	1 year ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	2 years ago
mkversion	version/mkversion: open-source version generation logic	3 years ago
nardump	all: update copyright and license headers	3 years ago
natc	cmd/natc: fix nil pointer	1 year ago
netlogfmt	all: use Go 1.22 range-over-int	2 years ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	3 years ago
pgproxy	tsnet: split user facing and backend logging	2 years ago
printdep	cmd/printdep: print correct toolchain URL	3 years ago
proxy-to-grafana	cmd/proxy-to-grafana: add flag for alternative control server	1 year ago
sniproxy	all: use math/rand/v2 more	2 years ago
speedtest	all: update copyright and license headers	3 years ago
ssh-auth-none-demo	all: replace deprecated ioutil references	2 years ago
stunc	cmd/stunc: support user-specified port (#12469)	1 year ago
stund	cli: add `tailscale dns query` (#13368)	1 year ago
stunstamp	cmd/stunstamp: add protocol context to timeout logs (#13422)	1 year ago
sync-containers	all: adjust some build tags for plan9	2 years ago
systray	cmd/systray: handle reconnects to IPN bus (#13386)	1 year ago
tailscale	cmd/tailscale: use tsaddr helpers	1 year ago
tailscaled	util/usermetrics: make usermetrics non-global	1 year ago
testcontrol	all: use Go 1.22 range-over-int	2 years ago
testwrapper	cmd/testwrapper: apply results of all unit tests to coverage for all packages	2 years ago
tl-longchain	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	1 year ago
tsconnect	all: use math/rand/v2 more	2 years ago
tsidp	cmd/tsidp: add funnel support (#12591)	1 year ago
tsshd	all: update copyright and license headers	3 years ago
tta	cmd/tta: pull out test driver dialing into a type, fix bugs	1 year ago
viewer	cmd/cloner, cmd/viewer, util/codegen: add support for aliases of cloneable types	1 year ago
vnet	tstest/natlab/vnet: add start of IPv6 support	1 year ago
xdpderper	all: add test for package comments, fix, add comments as needed	1 year ago