You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tom Proctor 711698f5a9 cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328) ... Previously, the operator checked the ProxyGroup status fields for information on how many of the proxies had successfully authed. Use their state Secrets instead as a more reliable source of truth. containerboot has written device_fqdn and device_ips keys to the state Secret since inception, and pod_uid since 1.78.0, so there's no need to use the API for that data. Read it from the state Secret for consistency. However, to ensure we don't read data from a previous run of containerboot, make sure we reset containerboot's state keys on startup. One other knock-on effect of that is ProxyGroups can briefly be marked not Ready while a Pod is restarting. Introduce a new ProxyGroupAvailable condition to more accurately reflect when downstream controllers can implement flows that rely on a ProxyGroup having at least 1 proxy Pod running. Fixes #16327 Change-Id: I026c18e9d23e87109a471a87b8e4fb6271716a66 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>		5 months ago
..
deploy	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	5 months ago
e2e	cmd,tsnet,internal/client: create internal shim to deprecated control plane API	10 months ago
generate	cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591)	1 year ago
connector.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
connector_test.go	cmd/k8s-operator: remove conffile hashing mechanism (#16335)	6 months ago
depaware.txt	cmd/tailscale/cli: add a risk message about rp_filter	6 months ago
dnsrecords.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
dnsrecords_test.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	9 months ago
egress-eps.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
egress-eps_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
egress-pod-readiness.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	9 months ago
egress-pod-readiness_test.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	9 months ago
egress-services-readiness.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
egress-services-readiness_test.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
egress-services.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
egress-services_test.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
ingress-for-pg.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
ingress-for-pg_test.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
ingress.go	cmd/k8s-operator: default ingress paths to '/' if not specified by user (#15706)	8 months ago
ingress_test.go	cmd/k8s-operator: remove conffile hashing mechanism (#16335)	6 months ago
metrics_resources.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	9 months ago
nameserver.go	cmd/k8s-operator: ensure status update errors are displayed to users (#16251)	6 months ago
nameserver_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
nodeport-service-ports.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	5 months ago
nodeport-services-ports_test.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	5 months ago
operator.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	5 months ago
operator_test.go	cmd/k8s-operator: remove conffile hashing mechanism (#16335)	6 months ago
proxyclass.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	5 months ago
proxyclass_test.go	cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)	5 months ago
proxygroup.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
proxygroup_specs.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
proxygroup_test.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
sts.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
sts_test.go	cmd/k8s-operator: configure proxies for HA Ingress to run in cert share mode (#15308)	9 months ago
svc-for-pg.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
svc-for-pg_test.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
svc.go	cmd/k8s-operator: validate Service tags, catch duplicate Tailscale Services (#16058)	7 months ago
testutils_test.go	cmd/k8s-operator: remove conffile hashing mechanism (#16335)	6 months ago
tsclient.go	cmd/k8s-operator: warn if Tailscale Services use attempted for tailnet without the feature enabled (#15931)	7 months ago
tsrecorder.go	cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)	5 months ago
tsrecorder_specs.go	{cmd,}/k8s-operator: support IRSA for Recorder resources (#15913)	7 months ago
tsrecorder_specs_test.go	cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299)	1 year ago
tsrecorder_test.go	{cmd,}/k8s-operator: support IRSA for Recorder resources (#15913)	7 months ago