You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/cmd/containerboot
Tom Proctor 138a83efe1
cmd/containerboot: wait for consistent state on shutdown (#14263)
tailscaled's ipn package writes a collection of keys to state after
authenticating to control, but one at a time. If containerboot happens
to send a SIGTERM signal to tailscaled in the middle of writing those
keys, it may shut down with an inconsistent state Secret and never
recover. While we can't durably fix this with our current single-use
auth keys (no atomic operation to auth + write state), we can reduce
the window for this race condition by checking for partial state
before sending SIGTERM to tailscaled. Best effort only.

Updates #14080

Change-Id: I0532d51b6f0b7d391e538468bd6a0a80dbe1d9f7
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
10 months ago
..
forwarding.go cmd/containerboot,util/linuxfw: create a SNAT rule for dst/src only once, clean up if needed (#13658) 1 year ago
healthz.go cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) 10 months ago
kube.go cmd/containerboot: wait for consistent state on shutdown (#14263) 10 months ago
kube_test.go cmd/containerboot: wait for consistent state on shutdown (#14263) 10 months ago
main.go cmd/containerboot: wait for consistent state on shutdown (#14263) 10 months ago
main_test.go cmd/containerboot: wait for consistent state on shutdown (#14263) 10 months ago
metrics.go cmd/containerboot: serve health on local endpoint (#14246) 1 year ago
serve.go cmd/{k8s-operator,containerboot},kube/kubetypes: parse Ingresses for ingress ProxyGroup (#14583) 11 months ago
serve_test.go cmd/containerboot: load containerboot serve config that does not contain HTTPS endpoint in tailnets with HTTPS disabled (#14538) 11 months ago
services.go cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) 10 months ago
services_test.go cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) 10 months ago
settings.go cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) 10 months ago
tailscaled.go cmd/containerboot: wait for consistent state on shutdown (#14263) 10 months ago
test_tailscale.sh cmd/containerboot: make a tests table, add more tests. 3 years ago
test_tailscaled.sh cmd/containerboot: avoid leaking bash scripts after test runs 2 years ago