You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina b406f209c3 cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) ... cmd/{containerboot,k8s-operator},kube: add preshutdown hook for egress PG proxies This change is part of work towards minimizing downtime during update rollouts of egress ProxyGroup replicas. This change: - updates the containerboot health check logic to return Pod IP in headers, if set - always runs the health check for egress PG proxies - updates ClusterIP Services created for PG egress endpoints to include the health check endpoint - implements preshutdown endpoint in proxies. The preshutdown endpoint logic waits till, for all currently configured egress services, the ClusterIP Service health check endpoint is no longer returned by the shutting-down Pod (by looking at the new Pod IP header). - ensures that kubelet is configured to call the preshutdown endpoint This reduces the possibility that, as replicas are terminated during an update, a replica gets terminated to which cluster traffic is still being routed via the ClusterIP Service because kube proxy has not yet updated routig rules. This is not a perfect check as in practice, it only checks that the kube proxy on the node on which the proxy runs has updated rules. However, overall this might be good enough. The preshutdown logic is disabled if users have configured a custom health check port via TS_LOCAL_ADDR_PORT env var. This change throws a warnign if so and in future setting of that env var for operator proxies might be disallowed (as users shouldn't need to configure this for a Pod directly). This is backwards compatible with earlier proxy versions. Updates tailscale/tailscale#14326 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		10 months ago
..
addlicense	all: fix golangci-lint errors	11 months ago
build-webclient	client/web: precompress assets	2 years ago
checkmetrics	cmd/checkmetrics: add command for checking metrics against kb	1 year ago
cloner	cmd/cloner, cmd/viewer, util/codegen: add support for aliases of cloneable types	1 year ago
connector-gen	cmd/connector-gen: add helper tool for wide app connector configurations	2 years ago
containerboot	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
derper	go.mod: bump depaware, add --internal flag to stop hiding internal packages	10 months ago
derpprobe	prober: support filtering regions by region ID in addition to code	11 months ago
dist	release/dist/qnap: add qnap target builder	2 years ago
get-authkey	cmd,{get-authkey,tailscale}: remove unnecessary scope qualifier from OAuth clients	1 year ago
gitops-pusher	cmd/gitops-pusher: default previousEtag to controlEtag (#14296)	1 year ago
hello	cmd/hello: link to the Hello KB article (#11022)	2 years ago
k8s-nameserver	cmd/k8s-nameserver: fix AAAA record query response (#12412)	2 years ago
k8s-operator	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
mkmanifest	cmd/mkmanifest, cmd/tailscale, cmd/tailscaled: remove Windows arm32 resources from OSS	3 years ago
mkpkg	go.mod: upgrade nfpm to v2 (#8786)	2 years ago
mkversion	version/mkversion: open-source version generation logic	3 years ago
nardump	all: update copyright and license headers	3 years ago
natc	cmd/natc: expose netstack metrics in client metrics in natc	10 months ago
netlogfmt	all: use Go 1.22 range-over-int	2 years ago
nginx-auth	tailcfg,all: add and use Node.IsTagged()	3 years ago
pgproxy	tsnet: split user facing and backend logging	2 years ago
printdep	cmd/printdep: print correct toolchain URL	3 years ago
proxy-to-grafana	cmd/proxy-to-grafana: add flag for alternative control server	1 year ago
sniproxy	all: use math/rand/v2 more	2 years ago
speedtest	all: update copyright and license headers	3 years ago
ssh-auth-none-demo	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh	10 months ago
stunc	cmd/stunc: enforce read timeout deadline (#14309)	1 year ago
stund	go.mod: bump depaware, add --internal flag to stop hiding internal packages	10 months ago
stunstamp	cmd/stunstamp: add protocol context to timeout logs (#13422)	1 year ago
sync-containers	all: adjust some build tags for plan9	2 years ago
systray	cmd/systray: add cmd/systray back as a small client/systray wrapper	11 months ago
tailscale	cmd/tailscale: add warning to help text of `--force-reauth` (#14778)	10 months ago
tailscaled	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh	10 months ago
testcontrol	all: use Go 1.22 range-over-int	2 years ago
testwrapper	util/slicesx: add MapKeys and MapValues from golang.org/x/exp/maps	11 months ago
tl-longchain	cmd/tl-longchain: tool to re-sign nodes with long rotation signatures	1 year ago
tsconnect	build(deps): bump braces from 3.0.2 to 3.0.3 in /cmd/tsconnect (#12468)	11 months ago
tsidp	cmd/tsidp: add --dir flag	1 year ago
tsshd	all: update copyright and license headers	3 years ago
tta	cmd/tta: pull out test driver dialing into a type, fix bugs	1 year ago
viewer	cmd/viewer,all: consistently use "read-only" instead of "readonly"	11 months ago
vnet	tstest/natlab/vnet: add start of IPv6 support	1 year ago
xdpderper	all: add test for package comments, fix, add comments as needed	1 year ago