You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

David Bond 2cb86cf65e cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344) ... This commit contains the implementation of multi-tailnet support within the Kubernetes Operator Each of our custom resources now expose the `spec.tailnet` field. This field is a string that must match the name of an existing `Tailnet` resource. A `Tailnet` resource looks like this: ```yaml apiVersion: tailscale.com/v1alpha1 kind: Tailnet metadata: name: example # This is the name that must be referenced by other resources spec: credentials: secretName: example-oauth ``` Each `Tailnet` references a `Secret` resource that contains a set of oauth credentials. This secret must be created in the same namespace as the operator: ```yaml apiVersion: v1 kind: Secret metadata: name: example-oauth # This is the name that's referenced by the Tailnet resource. namespace: tailscale stringData: client_id: "client-id" client_secret: "client-secret" ``` When created, the operator performs a basic check that the oauth client has access to all required scopes. This is done using read actions on devices, keys & services. While this doesn't capture a missing "write" permission, it catches completely missing permissions. Once this check passes, the `Tailnet` moves into a ready state and can be referenced. Attempting to use a `Tailnet` in a non-ready state will stall the deployment of `Connector`s, `ProxyGroup`s and `Recorder`s until the `Tailnet` becomes ready. The `spec.tailnet` field informs the operator that a `Connector`, `ProxyGroup`, or `Recorder` must be given an auth key generated using the specified oauth client. For backwards compatibility, the set of credentials the operator is configured with are considered the default. That is, where `spec.tailnet` is not set, the resource will be deployed in the same tailnet as the operator. Updates https://github.com/tailscale/corp/issues/34561		20 hours ago
..
deploy	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
e2e	cmd/k8s-operator/e2e,go.mod: remove client v2 dependency	2 weeks ago
generate	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
api-server-proxy-pg.go	cmd/k8s-operator: remove Services feature flag detection	3 months ago
api-server-proxy-pg_test.go	cmd/k8s-operator: allow HA ingresses to be deleted when VIP service does not exist (#18050)	2 months ago
api-server-proxy.go	cmd/{k8s-operator,k8s-proxy},kube: use consistent type for auth mode config (#16626)	6 months ago
connector.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
connector_test.go	cmd/k8s-operator: allow specifying replicas for connectors (#16721)	5 months ago
depaware.txt	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
dnsrecords.go	k8s-operator: add IPv6 support for DNS records (#16691)	4 months ago
dnsrecords_test.go	k8s-operator: add IPv6 support for DNS records (#16691)	4 months ago
egress-eps.go	all: rename variables with lowercase-l/uppercase-I	2 months ago
egress-eps_test.go	all-kube: create Tailscale Service for HA kube-apiserver ProxyGroup (#16572)	6 months ago
egress-pod-readiness.go	cleanup: fix typos across multiple files	2 months ago
egress-pod-readiness_test.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	10 months ago
egress-services-readiness.go	all: rename variables with lowercase-l/uppercase-I	2 months ago
egress-services-readiness_test.go	all: rename variables with lowercase-l/uppercase-I	2 months ago
egress-services.go	all: rename variables with lowercase-l/uppercase-I	2 months ago
egress-services_test.go	all: rename variables with lowercase-l/uppercase-I	2 months ago
ingress-for-pg.go	cmd/k8s-operator: add support for taiscale.com/http-redirect (#17596)	2 months ago
ingress-for-pg_test.go	cmd/k8s-operator fix populateTLSSecret on tests (#18088)	2 months ago
ingress.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
ingress_test.go	cmd/k8s-operator: fix statefulset template yaml indentation (#18194)	1 month ago
logger.go	cmd/k8s-operator: send operator logs to tailscale (#17110)	4 months ago
metrics_resources.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	10 months ago
nameserver.go	cmd/k8s-operator: use stable image for k8s-nameserver (#17985)	2 months ago
nameserver_test.go	cmd/k8s-operator: use stable image for k8s-nameserver (#17985)	2 months ago
nodeport-service-ports.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	7 months ago
nodeport-services-ports_test.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	7 months ago
operator.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
operator_test.go	cmd/k8s-operator: warn if users attempt to expose a headless Service (#18140)	1 month ago
proxyclass.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	7 months ago
proxyclass_test.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	7 months ago
proxygroup.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
proxygroup_specs.go	cmd/k8s-operator,ipn/ipnlocal: allow opting out of ACME order replace extension (#18252)	1 month ago
proxygroup_test.go	cmd/k8s-operator: rename 'l' variables (#17700)	3 months ago
sts.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
sts_test.go	cmd/k8s-operator: rename 'l' variables (#17700)	3 months ago
svc-for-pg.go	cmd/k8s-operator: remove Services feature flag detection	3 months ago
svc-for-pg_test.go	all-kube: create Tailscale Service for HA kube-apiserver ProxyGroup (#16572)	6 months ago
svc.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
tailnet.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
testutils_test.go	cmd/k8s-operator,ipn/ipnlocal: allow opting out of ACME order replace extension (#18252)	1 month ago
tsclient.go	cmd/k8s-operator: support workload identity federation	3 months ago
tsclient_test.go	cmd/k8s-operator: support workload identity federation	3 months ago
tsrecorder.go	cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)	20 hours ago
tsrecorder_specs.go	cmd/k8s-operator: add multi replica support for recorders (#17864)	2 months ago
tsrecorder_specs_test.go	cmd/k8s-operator: add multi replica support for recorders (#17864)	2 months ago
tsrecorder_test.go	cmd/k8s-operator: add multi replica support for recorders (#17864)	2 months ago