You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina e89382897a cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342) ... * ipn/ipnlocal: don't fail profile unmarshal due to attestation keys (#18335) Soft-fail on initial unmarshal and try again, ignoring the AttestationKey. This helps in cases where something about the attestation key storage (usually a TPM) is messed up. The old key will be lost, but at least the node can start again. Updates #18302 Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> (cherry picked from commit 2e77b75e96) * cmd/tailscaled: disable state encryption / attestation by default (#18336) TPM-based features have been incredibly painful due to the heterogeneous devices in the wild, and many situations in which the TPM "changes" (is reset or replaced). All of this leads to a lot of customer issues. We hoped to iron out all the kinks and get all users to benefit from state encryption and hardware attestation without manually opting in, but the long tail of kinks is just too long. This change disables TPM-based features on Windows and Linux by default. Node state should get auto-decrypted on update, and old attestation keys will be removed. There's also tailscaled-on-macOS, but it won't have a TPM or Keychain bindings anyway. Updates #18302 Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> (cherry picked from commit 68617bb82e) * cmd/tailscaled,ipn/{ipnlocal,store/kubestore}: don't create attestation keys for stores that are not bound to a node (#18322) Ensure that hardware attestation keys are not added to tailscaled state stores that are Kubernetes Secrets or AWS SSM as those Tailscale devices should be able to be recreated on different nodes, for example, when moving Pods between nodes. Updates tailscale/tailscale#18302 Signed-off-by: Irbe Krumina <irbekrm@gmail.com> (cherry picked from commit 8ea90ba80d) --------- Signed-off-by: Andrew Lytvynov <awly@tailscale.com> Signed-off-by: Irbe Krumina <irbekrm@gmail.com> Co-authored-by: Andrew Lytvynov <awly@tailscale.com>		7 days ago
..
addlicense	all: fix golangci-lint errors	1 year ago
build-webclient	client/web: precompress assets	2 years ago
checkmetrics	cmd/checkmetrics: add command for checking metrics against kb	1 year ago
cigocacher	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
cloner	cmd/cloner: support cloning arbitrarily-nested maps	2 months ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	2 years ago
containerboot	all: rename variables with lowercase-l/uppercase-I	2 months ago
derper	cmd/derper: add GCP Certificate Manager support (#18161)	1 month ago
derpprobe	cmd/derpprobe,prober: add run all probes handler (#16875)	5 months ago
dist	{cmd/dist,release/dist}: add support for intermediary QNAP signing certificates	5 months ago
featuretags	feature/featuretags,cmd/omitsize: support feature dependencies	4 months ago
get-authkey	cmd,tsnet,internal/client: create internal shim to deprecated control plane API	11 months ago
gitops-pusher	scripts/check_license_headers.sh: delete, rewrite as a Go test	7 months ago
hello	cmd/hello: display native ipv4 (#15191)	10 months ago
jsonimports	cmd/jsonimports: add static analyzer for consistent "json" imports (#17669)	3 months ago
k8s-nameserver	k8s-operator: add IPv6 support for DNS records (#16691)	4 months ago
k8s-operator	cmd/k8s-operator,ipn/ipnlocal: allow opting out of ACME order replace extension (#18252) (#18343)	7 days ago
k8s-proxy	all: rename variables with lowercase-l/uppercase-I	2 months ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	2 years ago
mkversion	version/mkversion: open-source version generation logic	3 years ago
nardump	cmd/nardump: support symlinks, add basic test	9 months ago
natc	all: rename variables with lowercase-l/uppercase-I	2 months ago
netlogfmt	cmd/netlogfmt: support resolving IP addresses to synonymous labels (#17955)	2 months ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	3 years ago
omitsize	feature/featuretags,cmd/omitsize: support feature dependencies	4 months ago
pgproxy	all: use new LocalAPI client package location	11 months ago
printdep	cmd/printdep: print correct toolchain URL	3 years ago
proxy-test-server	net/tlsdial: fix TLS cert validation of HTTPS proxies	7 months ago
proxy-to-grafana	scripts/check_license_headers.sh: delete, rewrite as a Go test	7 months ago
sniproxy	all: rename variables with lowercase-l/uppercase-I	2 months ago
speedtest	all: update copyright and license headers	3 years ago
ssh-auth-none-demo	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh	12 months ago
stunc	cmd/stunc: enforce read timeout deadline (#14309)	1 year ago
stund	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
stunstamp	all: rename variables with lowercase-l/uppercase-I	2 months ago
sync-containers	all: rename variables with lowercase-l/uppercase-I	2 months ago
systray	client/systray: allow specifying tailscaled socket	5 months ago
tailscale	cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16	2 months ago
tailscaled	cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342)	7 days ago
testcontrol	all: use Go 1.22 range-over-int	2 years ago
testwrapper	cmd/testwrapper/flakytest: use t.Attr annotation on flaky tests	3 months ago
tl-longchain	all: rename variables with lowercase-l/uppercase-I	2 months ago
tsconnect	types/netmap,*: remove some redundant fields from NetMap	2 months ago
tsidp	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
tsshd	all: update copyright and license headers	3 years ago
tta	all: use new LocalAPI client package location	11 months ago
vet	tailcfg, control/controlclient: start moving MapResponse.DefaultAutoUpdate to a nodeattr	2 months ago
viewer	cmd/{cloner,viewer}: handle maps of views	2 months ago
vnet	cmd/vnet: add wsproxy mode	10 months ago
xdpderper	tsweb: split promvarz into an optional dependency	10 months ago