You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina e89382897a cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342) ... * ipn/ipnlocal: don't fail profile unmarshal due to attestation keys (#18335) Soft-fail on initial unmarshal and try again, ignoring the AttestationKey. This helps in cases where something about the attestation key storage (usually a TPM) is messed up. The old key will be lost, but at least the node can start again. Updates #18302 Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> (cherry picked from commit 2e77b75e96) * cmd/tailscaled: disable state encryption / attestation by default (#18336) TPM-based features have been incredibly painful due to the heterogeneous devices in the wild, and many situations in which the TPM "changes" (is reset or replaced). All of this leads to a lot of customer issues. We hoped to iron out all the kinks and get all users to benefit from state encryption and hardware attestation without manually opting in, but the long tail of kinks is just too long. This change disables TPM-based features on Windows and Linux by default. Node state should get auto-decrypted on update, and old attestation keys will be removed. There's also tailscaled-on-macOS, but it won't have a TPM or Keychain bindings anyway. Updates #18302 Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> (cherry picked from commit 68617bb82e) * cmd/tailscaled,ipn/{ipnlocal,store/kubestore}: don't create attestation keys for stores that are not bound to a node (#18322) Ensure that hardware attestation keys are not added to tailscaled state stores that are Kubernetes Secrets or AWS SSM as those Tailscale devices should be able to be recreated on different nodes, for example, when moving Pods between nodes. Updates tailscale/tailscale#18302 Signed-off-by: Irbe Krumina <irbekrm@gmail.com> (cherry picked from commit 8ea90ba80d) --------- Signed-off-by: Andrew Lytvynov <awly@tailscale.com> Signed-off-by: Irbe Krumina <irbekrm@gmail.com> Co-authored-by: Andrew Lytvynov <awly@tailscale.com>		2 weeks ago
..
childproc	all: update copyright and license headers	3 years ago
tailscaledhooks	feature/taildrop, ipn/ipnlocal: remove leftover dup calls to osshare	8 months ago
debug.go	feature/featuretags: make usermetrics modular	3 months ago
debug_forcereflect.go	cmd/tailscaled: add disabled debug file to force reflect for binary size experiments	4 months ago
depaware-min.txt	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
depaware-minbox.txt	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
depaware.txt	cmd/cigocacher,go.mod: add cigocacher cmd	2 months ago
deps_test.go	cmd/tailscale/cli,feature: add support for identity federation (#17529)	3 months ago
flag.go	cmd/tailscaled: default --encrypt-state to true if TPM is available (#17376)	4 months ago
generate.go	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
install_darwin.go	all: update copyright and license headers	3 years ago
install_windows.go	util/backoff: rename logtail/backoff package to util/backoff	4 months ago
manifest_windows_386.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	3 years ago
manifest_windows_amd64.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	3 years ago
manifest_windows_arm64.syso	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	3 years ago
netstack.go	cmd/tailscaled: start implementing ts_omit_netstack	4 months ago
proxy.go	feature, net/tshttpproxy: pull out support for using proxies as a feature	4 months ago
required_version.go	all: switch to and require Go 1.23	1 year ago
sigpipe.go	all: adjust some build tags for plan9	2 years ago
ssh.go	ssh/tailssh: add Plan 9 support for Tailscale SSH	10 months ago
tailscaled.defaults	cmd/tailscaled: rename relaynode reference in defaults file comment	6 years ago
tailscaled.go	cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342)	2 weeks ago
tailscaled.openrc	tstest/integration/vms: use an in-process logcatcher (#2360)	5 years ago
tailscaled.service	cmd/tailscaled: move cleanup to an implicit action during startup	2 years ago
tailscaled_bird.go	all: update copyright and license headers	3 years ago
tailscaled_drive.go	feature/drive: start factoring out Taildrive, add ts_omit_drive build tag	4 months ago
tailscaled_notwindows.go	all: update copyright and license headers	3 years ago
tailscaled_test.go	cmd/tailscaled/ipn{ipnlocal,store/kubestore}: disable hardware attestation by default, don't use it with non-file system state stores (#18342)	2 weeks ago
tailscaled_windows.go	feature/logtail: pull logtail + netlog out to modular features	4 months ago
webclient.go	derp/derpserver: split off derp.Server out of derp into its own package	4 months ago
windows-manifest.xml	cmd/{tailscale,tailscaled}: embed manifest into Windows binaries	3 years ago
with_cli.go	all: update copyright and license headers	3 years ago