You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina 096b090caf cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531) ... * cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets This commit is first part of the work to allow running multiple replicas of the Kubernetes operator egress proxies per tailnet service + to allow exposing multiple tailnet services via each proxy replica. This expands the existing iptables/nftables-based proxy configuration mechanism. A proxy can now be configured to route to one or more tailnet targets via a (mounted) config file that, for each tailnet target, specifies: - the target's tailnet IP or FQDN - mappings of container ports to which cluster workloads will send traffic to tailnet target ports where the traffic should be forwarded. Example configfile contents: { "some-svc": {"tailnetTarget":{"fqdn":"foo.tailnetxyz.ts.net","ports"{"tcp:4006:80":{"protocol":"tcp","matchPort":4006,"targetPort":80},"tcp:4007:443":{"protocol":"tcp","matchPort":4007,"targetPort":443}}}} } A proxy that is configured with this config file will configure firewall rules to route cluster traffic to the tailnet targets. It will then watch the config file for updates as well as monitor relevant netmap updates and reconfigure firewall as needed. This adds a bunch of new iptables/nftables functionality to make it easier to dynamically update the firewall rules without needing to restart the proxy Pod as well as to make it easier to debug/understand the rules: - for iptables, each portmapping is a DNAT rule with a comment pointing at the 'service',i.e: -A PREROUTING ! -i tailscale0 -p tcp -m tcp --dport 4006 -m comment --comment "some-svc:tcp:4006 -> tcp:80" -j DNAT --to-destination 100.64.1.18:80 Additionally there is a SNAT rule for each tailnet target, to mask the source address. - for nftables, a separate prerouting chain is created for each tailnet target and all the portmapping rules are placed in that chain. This makes it easier to look up rules and delete services when no longer needed. (nftables allows hooking a custom chain to a prerouting hook, so no extra work is needed to ensure that the rules in the service chains are evaluated). The next steps will be to get the Kubernetes Operator to generate the configfile and ensure it is mounted to the relevant proxy nodes. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		2 months ago
..
bench	ipn/ipnlocal, all: plumb health trackers in tests	7 months ago
capture	wgengine/capture: fix v6 field typo in wireshark dissector	4 months ago
filter	wgengine/filter: support FilterRules matching on srcIP node caps [capver 100]	5 months ago
magicsock	wgengine/magicsock: fix check for EPERM on macOS	2 months ago
netlog	wgengine: add exit destination logging enable for wgengine logger (#11952)	7 months ago
netstack	util/usermetrics: make usermetrics non-global	2 months ago
router	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	2 months ago
wgcfg	ipn,wgengine: remove vestigial Prefs.AllowSingleHosts	6 months ago
wgint	wgengine{,/wgint}: add wgint.Peer wrapper type, add to wgengine.Engine	9 months ago
wglog	all: use Go 1.22 range-over-int	8 months ago
winnet	all: add test for package comments, fix, add comments as needed	5 months ago
mem_ios.go	…
pendopen.go	net/flowtrack: optimize Tuple type for use as map key	5 months ago
userspace.go	wgengine: make opts.Metrics mandatory	2 months ago
userspace_ext_test.go	util/usermetrics: make usermetrics non-global	2 months ago
userspace_test.go	util/usermetrics: make usermetrics non-global	2 months ago
watchdog.go	ipn/ipnlocal,net/tstun,wgengine: create and plumb jailed packet filter	7 months ago
watchdog_js.go	…
watchdog_test.go	util/usermetrics: make usermetrics non-global	2 months ago
wgengine.go	all: add test for package comments, fix, add comments as needed	5 months ago