You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Irbe Krumina 096b090caf cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531) ... * cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets This commit is first part of the work to allow running multiple replicas of the Kubernetes operator egress proxies per tailnet service + to allow exposing multiple tailnet services via each proxy replica. This expands the existing iptables/nftables-based proxy configuration mechanism. A proxy can now be configured to route to one or more tailnet targets via a (mounted) config file that, for each tailnet target, specifies: - the target's tailnet IP or FQDN - mappings of container ports to which cluster workloads will send traffic to tailnet target ports where the traffic should be forwarded. Example configfile contents: { "some-svc": {"tailnetTarget":{"fqdn":"foo.tailnetxyz.ts.net","ports"{"tcp:4006:80":{"protocol":"tcp","matchPort":4006,"targetPort":80},"tcp:4007:443":{"protocol":"tcp","matchPort":4007,"targetPort":443}}}} } A proxy that is configured with this config file will configure firewall rules to route cluster traffic to the tailnet targets. It will then watch the config file for updates as well as monitor relevant netmap updates and reconfigure firewall as needed. This adds a bunch of new iptables/nftables functionality to make it easier to dynamically update the firewall rules without needing to restart the proxy Pod as well as to make it easier to debug/understand the rules: - for iptables, each portmapping is a DNAT rule with a comment pointing at the 'service',i.e: -A PREROUTING ! -i tailscale0 -p tcp -m tcp --dport 4006 -m comment --comment "some-svc:tcp:4006 -> tcp:80" -j DNAT --to-destination 100.64.1.18:80 Additionally there is a SNAT rule for each tailnet target, to mask the source address. - for nftables, a separate prerouting chain is created for each tailnet target and all the portmapping rules are placed in that chain. This makes it easier to look up rules and delete services when no longer needed. (nftables allows hooking a custom chain to a prerouting hook, so no extra work is needed to ensure that the rules in the service chains are evaluated). The next steps will be to get the Kubernetes Operator to generate the configfile and ensure it is mounted to the relevant proxy nodes. Updates tailscale/tailscale#13406 Signed-off-by: Irbe Krumina <irbe@tailscale.com>		2 months ago
..
callback.go	wgengine/router: implement UpdateMagicsockPort for CallbackRouter (#10494)	12 months ago
consolidating_router.go	wgengine/router: consolidate routes before reconfiguring router for mobile clients	7 months ago
consolidating_router_test.go	wgengine/router: consolidate routes before reconfiguring router for mobile clients	7 months ago
ifconfig_windows.go	wgengine/router: use quad-100 as the nexthop on Windows	4 months ago
ifconfig_windows_test.go	all: use Go 1.22 range-over-int	7 months ago
router.go	various: implement stateful firewalling on Linux (#12025)	7 months ago
router_darwin.go	health, all: remove health.Global, finish plumbing health.Tracker	7 months ago
router_default.go	health, all: remove health.Global, finish plumbing health.Tracker	7 months ago
router_fake.go	util/linuxfw, wgengine: allow ingress to magicsock UDP port on Linux (#10370)	12 months ago
router_freebsd.go	health, all: remove health.Global, finish plumbing health.Tracker	7 months ago
router_linux.go	health: begin work to use structured health warnings instead of strings, pipe changes into ipn.Notify (#12406)	5 months ago
router_linux_test.go	cmd/containerboot,kube,util/linuxfw: configure kube egress proxies to route to 1+ tailnet targets (#13531)	2 months ago
router_openbsd.go	health, all: remove health.Global, finish plumbing health.Tracker	7 months ago
router_test.go	various: implement stateful firewalling on Linux (#12025)	7 months ago
router_userspace_bsd.go	health, all: remove health.Global, finish plumbing health.Tracker	7 months ago
router_windows.go	cmd/tailscaled, net/dns, wgengine/router: start Windows child processes with DETACHED_PROCESS when I/O is being piped	6 months ago
router_windows_test.go	wgengine/router: look up absolute path to netsh.exe on Windows	11 months ago
runner.go	all: update copyright and license headers	2 years ago