You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

David Bond 2cb86cf65e cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344) ... This commit contains the implementation of multi-tailnet support within the Kubernetes Operator Each of our custom resources now expose the `spec.tailnet` field. This field is a string that must match the name of an existing `Tailnet` resource. A `Tailnet` resource looks like this: ```yaml apiVersion: tailscale.com/v1alpha1 kind: Tailnet metadata: name: example # This is the name that must be referenced by other resources spec: credentials: secretName: example-oauth ``` Each `Tailnet` references a `Secret` resource that contains a set of oauth credentials. This secret must be created in the same namespace as the operator: ```yaml apiVersion: v1 kind: Secret metadata: name: example-oauth # This is the name that's referenced by the Tailnet resource. namespace: tailscale stringData: client_id: "client-id" client_secret: "client-secret" ``` When created, the operator performs a basic check that the oauth client has access to all required scopes. This is done using read actions on devices, keys & services. While this doesn't capture a missing "write" permission, it catches completely missing permissions. Once this check passes, the `Tailnet` moves into a ready state and can be referenced. Attempting to use a `Tailnet` in a non-ready state will stall the deployment of `Connector`s, `ProxyGroup`s and `Recorder`s until the `Tailnet` becomes ready. The `spec.tailnet` field informs the operator that a `Connector`, `ProxyGroup`, or `Recorder` must be given an auth key generated using the specified oauth client. For backwards compatibility, the set of credentials the operator is configured with are considered the default. That is, where `spec.tailnet` is not set, the resource will be deployed in the same tailnet as the operator. Updates https://github.com/tailscale/corp/issues/34561		1 day ago
..
addlicense	all: fix golangci-lint errors	1 year ago
build-webclient	client/web: precompress assets	2 years ago
checkmetrics	cmd/checkmetrics: add command for checking metrics against kb	1 year ago
cigocacher	.github,cmd/cigocacher: add flags --version --stats --cigocached-host	1 month ago
cloner	cmd/cloner: support cloning arbitrarily-nested maps	2 months ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	2 years ago
containerboot	cmd/containerboot: allow for automatic ID token generation	1 week ago
derper	metrics: add a NewLabelMap helper to create and register label maps	1 week ago
derpprobe	cmd/derpprobe,prober: add run all probes handler (#16875)	5 months ago
dist	{cmd/dist,release/dist}: add support for intermediary QNAP signing certificates	5 months ago
distsign	cmd/distsign: add CLI for verifying package signatures (#18239)	2 weeks ago
featuretags	feature/featuretags,cmd/omitsize: support feature dependencies	4 months ago
get-authkey	cmd,tsnet,internal/client: create internal shim to deprecated control plane API	11 months ago
gitops-pusher	cmd,internal,feature: add workload idenity support to gitops pusher	2 weeks ago
hello	cmd/hello: display native ipv4 (#15191)	11 months ago
jsonimports	cmd/jsonimports: add static analyzer for consistent "json" imports (#17669)	3 months ago
k8s-nameserver	k8s-operator: add IPv6 support for DNS records (#16691)	4 months ago
k8s-operator	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	1 day ago
k8s-proxy	all: rename variables with lowercase-l/uppercase-I	2 months ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	3 years ago
mkversion	version/mkversion: open-source version generation logic	3 years ago
nardump	cmd/nardump: support symlinks, add basic test	10 months ago
natc	all: rename variables with lowercase-l/uppercase-I	2 months ago
netlogfmt	cmd/netlogfmt: allow empty --resolve-addrs flag (#18103)	2 months ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	3 years ago
omitsize	feature/featuretags,cmd/omitsize: support feature dependencies	4 months ago
pgproxy	all: use new LocalAPI client package location	12 months ago
printdep	cmd/printdep: print correct toolchain URL	3 years ago
proxy-test-server	net/tlsdial: fix TLS cert validation of HTTPS proxies	7 months ago
proxy-to-grafana	scripts/check_license_headers.sh: delete, rewrite as a Go test	7 months ago
sniproxy	all: rename variables with lowercase-l/uppercase-I	2 months ago
speedtest	all: update copyright and license headers	3 years ago
ssh-auth-none-demo	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh	12 months ago
stunc	cmd/stunc: enforce read timeout deadline (#14309)	1 year ago
stund	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
stunstamp	all: rename variables with lowercase-l/uppercase-I	2 months ago
sync-containers	all: rename variables with lowercase-l/uppercase-I	2 months ago
systray	client/systray: allow specifying tailscaled socket	6 months ago
tailscale	cmd,feature: add identity token auto generation for workload identity (#18373)	1 week ago
tailscaled	net/udprelay: advertise addresses from cloud metadata service (#18368)	3 days ago
testcontrol	all: use Go 1.22 range-over-int	2 years ago
testwrapper	cmd/testwrapper/flakytest: use t.Attr annotation on flaky tests	4 months ago
tl-longchain	all: rename variables with lowercase-l/uppercase-I	2 months ago
tsconnect	types/netmap,*: remove some redundant fields from NetMap	2 months ago
tsidp	cmd,feature: add identity token auto generation for workload identity (#18373)	1 week ago
tsshd	all: update copyright and license headers	3 years ago
tta	all: use new LocalAPI client package location	12 months ago
vet	k8s-operator,kube: allowing k8s api request events to be enabled via grants (#18393)	6 days ago
viewer	cmd/{cloner,viewer}: handle maps of views	2 months ago
vnet	cmd/vnet: add wsproxy mode	10 months ago
xdpderper	tsweb: split promvarz into an optional dependency	10 months ago