You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina b406f209c3 cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436) ... cmd/{containerboot,k8s-operator},kube: add preshutdown hook for egress PG proxies This change is part of work towards minimizing downtime during update rollouts of egress ProxyGroup replicas. This change: - updates the containerboot health check logic to return Pod IP in headers, if set - always runs the health check for egress PG proxies - updates ClusterIP Services created for PG egress endpoints to include the health check endpoint - implements preshutdown endpoint in proxies. The preshutdown endpoint logic waits till, for all currently configured egress services, the ClusterIP Service health check endpoint is no longer returned by the shutting-down Pod (by looking at the new Pod IP header). - ensures that kubelet is configured to call the preshutdown endpoint This reduces the possibility that, as replicas are terminated during an update, a replica gets terminated to which cluster traffic is still being routed via the ClusterIP Service because kube proxy has not yet updated routig rules. This is not a perfect check as in practice, it only checks that the kube proxy on the node on which the proxy runs has updated rules. However, overall this might be good enough. The preshutdown logic is disabled if users have configured a custom health check port via TS_LOCAL_ADDR_PORT env var. This change throws a warnign if so and in future setting of that env var for operator proxies might be disallowed (as users shouldn't need to configure this for a Pod directly). This is backwards compatible with earlier proxy versions. Updates tailscale/tailscale#14326 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		10 months ago
..
deploy	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
e2e	cmd/k8s-operator,k8s-operator: operator integration tests (#12792)	12 months ago
generate	cmd/k8s-operator,k8s-operator: add ProxyGroup CRD (#13591)	1 year ago
connector.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
connector_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
depaware.txt	ssh,tempfork/gliderlabs/ssh: replace github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh	10 months ago
dnsrecords.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
dnsrecords_test.go	cmd/k8s-operator: fix DNS reconciler for dual-stack clusters (#13057)	1 year ago
egress-eps.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
egress-eps_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
egress-services-readiness.go	cmd/k8s-operator: fix a bunch of status equality checks (#14270)	1 year ago
egress-services-readiness_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
egress-services.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
egress-services_test.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
ingress-for-pg.go	tailcfg: add ServiceName	10 months ago
ingress-for-pg_test.go	tailcfg: add ServiceName	10 months ago
ingress.go	cmd/{k8s-operator,containerboot},kube/kubetypes: parse Ingresses for ingress ProxyGroup (#14583)	11 months ago
ingress_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
metrics_resources.go	cmd/k8s-operator,k8s-operator: allow users to set custom labels for the optional ServiceMonitor (#14475)	11 months ago
nameserver.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
nameserver_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
operator.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
operator_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
proxy.go	all: fix golangci-lint errors	11 months ago
proxy_test.go	cmd/k8s-operator,ssh/tailssh,tsnet: optionally record 'kubectl exec' sessions via Kubernetes operator's API server proxy (#12274)	1 year ago
proxyclass.go	cmd/k8s-operator,k8s-operator: allow users to set custom labels for the optional ServiceMonitor (#14475)	11 months ago
proxyclass_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago
proxygroup.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
proxygroup_specs.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
proxygroup_test.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
sts.go	cmd/{k8s-operator,containerboot},kube: ensure egress ProxyGroup proxies don't terminate while cluster traffic is still routed to them (#14436)	10 months ago
sts_test.go	cmd/k8s-operator,k8s-operator: allow users to set custom labels for the optional ServiceMonitor (#14475)	11 months ago
svc.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
testutils_test.go	cmd/{k8s-operator,containerboot},kube/kubetypes: parse Ingresses for ingress ProxyGroup (#14583)	11 months ago
tsclient.go	cmd/{k8s-operator,containerboot},kube/kubetypes: parse Ingresses for ingress ProxyGroup (#14583)	11 months ago
tsrecorder.go	cmd/k8s-operator: don't error for transient failures (#14073)	1 year ago
tsrecorder_specs.go	cmd/k8s-operator,kube/kubeclient,docs/k8s: update rbac to emit events + small fixes (#14164)	1 year ago
tsrecorder_specs_test.go	cmd/k8s-operator,k8s-operator,kube: Add TSRecorder CRD + controller (#13299)	1 year ago
tsrecorder_test.go	go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps (#14601)	11 months ago